Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
onfigured to handle NTS packets. The issue was caused by improper slice indexing. The indexing operations were replaced by safer alternatives that do not crash the ntpd-rs server process but instead properly handle the error condition. A patch was released in version 0.3.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-qwhm-h7v3-mrjx - https://github.com/pendulum-project/ntpd-rs/pull/752
CVE ID: CVE-2023-33193 State: PUBLISHED Published: 2023-05-30T05:24:58.192Z Last Updated: 2025-01-10T19:48:24.089Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: EmbySupport Products: security Problem Types: CWE-444 Description: Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative access to an Emby Server system, depending on certain user account settings. By spoofing certain headers which are intended for interoperation with reverse proxy servers, it
user account settings. By spoofing certain headers which are intended for interoperation with reverse proxy servers, it may be possible to affect the local/non-local network determination to allow logging in without password or to view a list of user accounts which may have no password configured. Impacted are all Emby Server system which are publicly accessible and where the administrator hasn't tightened the account login configuration for administrative users. This issue has been patched in Emby Server Beta version 4.8.31 and Emby Server version 4.7.12. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/EmbySupport/security/securit
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/EmbySupport/security/security/advisories/GHSA-fffj-6fr6-3fgf
CVE ID: CVE-2023-33194 State: PUBLISHED Published: 2023-05-26T20:30:23.382Z Last Updated: 2025-01-14T19:25:11.922Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L) Vendors: craftcms Products: cms Problem Types: CWE-80 Description: Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/craftcms/cms/security/advisorie
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/craftcms/cms/security/advisories/GHSA-3wxg-w96j-8hq9 - https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888 - https://github.com/craftcms/cms/releases/tag/4.4.6
CVE ID: CVE-2023-33195 State: PUBLISHED Published: 2023-05-27T03:51:35.684Z Last Updated: 2025-01-14T18:21:23.065Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: craftcms Products: cms Problem Types: CWE-79 Description: Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/craftcms/cms/security/advisories/GHSA-qpgm-gjgf-8c2x - https://github.com/craftcms/cms/commit/b77cb3023bed4f4a37c11294c4d319ff9f598e1f - https://github.com/craftcms/cms/releases/tag
//github.com/craftcms/cms/commit/b77cb3023bed4f4a37c11294c4d319ff9f598e1f - https://github.com/craftcms/cms/releases/tag/4.4.6
CVE ID: CVE-2023-33196 State: PUBLISHED Published: 2023-05-26T20:22:23.637Z Last Updated: 2025-01-14T19:29:53.100Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: craftcms Products: cms Problem Types: CWE-80 Description: Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/craftcms/cms/security/advisories/GHSA-cjmm-x9x9-m2w5 - https://github.com/craftcms/cms/commit/053d7119697e480ff81c5723bb9a33eaa49e0fc7 - https://github.com/craftcms/cms/rele
- https://github.com/craftcms/cms/commit/053d7119697e480ff81c5723bb9a33eaa49e0fc7 - https://github.com/craftcms/cms/releases/tag/4.4.7
CVE ID: CVE-2023-33197 State: PUBLISHED Published: 2023-05-26T19:17:23.375Z Last Updated: 2025-01-14T19:32:21.443Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: craftcms Products: cms Problem Types: CWE-80 Description: Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/craftcms/cms/security/advisories/GHSA-6qjx-787v-6pxr - https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766 - https:
dvisories/GHSA-6qjx-787v-6pxr - https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766 - https://github.com/craftcms/cms/releases/tag/4.4.6
CVE ID: CVE-2023-33198 State: PUBLISHED Published: 2023-05-30T04:37:13.928Z Last Updated: 2025-01-10T20:08:33.075Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: tgstation Products: tgstation-server Problem Types: CWE-941 Description: tgstation-server is a production scale tool for BYOND server management. The DreamMaker API (DMAPI) chat channel cache can possibly be poisoned by a tgstation-server (TGS) restart and reattach. This can result in sending chat messages to one of any of the configured IRC or Discord channels for the instance on enabled chat bots. This lasts until the instance's chat channels are updated in TGS or DreamDaemon is restarted. TGS ch
enabled chat bots. This lasts until the instance's chat channels are updated in TGS or DreamDaemon is restarted. TGS chat commands are unaffected, custom or otherwise. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tgstation/tgstation-server/security/advisories/GHSA-p2xj-w57r-6f5m - https://github.com/tgstation/tgstation-server/pull/1493 - https://github.com/tgstation/tgstation-server/releases/tag/tgstation-server-v5.12.2
CVE ID: CVE-2023-33199 State: PUBLISHED Published: 2023-05-26T22:52:15.973Z Last Updated: 2025-01-14T19:07:53.630Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: sigstore Products: rekor Problem Types: CWE-617 Description: Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised t
ll continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sigstore/rekor/security/advisories/GHSA-frqx-jfcm-6jjr - https://github.com/sigstore/rekor/commit/140c5add105179e5ffd9e3e114fd1b6b93aebbd4
CVE ID: CVE-2023-33200 State: PUBLISHED Published: 2023-10-03T16:39:10.086Z Last Updated: 2025-03-07T18:29:58.220Z Vendors: Arm Ltd Products: Bifrost GPU Kernel Driver, Valhall GPU Kernel Driver, Arm 5th Gen GPU Architecture Kernel Driver Problem Types: CWE-416 Description: A local non-privileged user can make improper GPU processing operations to exploit a software race condition. If the system’s memory is carefully prepared by the user, then this in turn could give them access to already freed memory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE ID: CVE-2023-33201 State: PUBLISHED Published: 2023-07-05T00:00:00 Last Updated: 2024-12-04T15:48:15.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bouncycastle.org - https://github.c
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bouncycastle.org - https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc - https://github.com/bcgit/bc-java/wiki/CVE-2023-33201 - https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html - https://security.netapp.com/advisory/ntap-20230824-0008/
CVE ID: CVE-2023-33202 State: PUBLISHED Published: 2023-11-23T00:00:00.000Z Last Updated: 2025-08-18T16:22:17.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.) Additional Analyst
(For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bouncycastle.org - https://github.com/bcgit/bc-java/wiki/CVE-2023-33202 - https://security.netapp.com/advisory/ntap-20240125-0001/ - https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902023%E2%80%9033202
CVE ID: CVE-2023-33203 State: PUBLISHED Published: 2023-05-18T00:00:00.000Z Last Updated: 2025-05-05T15:57:42.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/emac.c if a physically proximate attacker unplugs an emac based device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=1210685 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6b6bc5b8bd2d4ca9e1efa9ae0f98a0b0687ace75 - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.9 - https://bu
?id=6b6bc5b8bd2d4ca9e1efa9ae0f98a0b0687ace75 - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.9 - https://bugzilla.redhat.com/show_bug.cgi?id=2192667
CVE ID: CVE-2023-33204 State: PUBLISHED Published: 2023-05-18T00:00:00.000Z Last Updated: 2025-11-03T17:31:04.036Z Vendors: n/a Products: n/a Problem Types: n/a Description: sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c. NOTE: this issue exists because of an incomplete fix for CVE-2022-39377. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sysstat/sysstat/pull/360 - https://lists.debian.org/debian-lts-announce/2023/05/msg00026.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NUBFX3UNOSM7KFUIB3J32ASYT5ZRXJQV/ - https://lists.fedora
rchives/list/package-announce%40lists.fedoraproject.org/message/NUBFX3UNOSM7KFUIB3J32ASYT5ZRXJQV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7UUEKMNDMC6RZTI4O367ZD2YKCOX5THX/
CVE ID: CVE-2023-33206 State: PUBLISHED Published: 2024-08-08T00:00:00 Last Updated: 2024-08-10T15:23:05.018Z Vendors: n/a Products: n/a Problem Types: n/a Description: Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR16, 4.0.0 SR06, 4.1.0 SR04, 4.2.0 SR03, and 4.3.0 SR01 fails to validate symlinks during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who is able to manipulate the contents of the system's hard disk. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dieboldnixdorf.com/en-us/banking/portfolio/software/security/ - https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20
/portfolio/software/security/ - https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Matt%20Burch%20-%20Where%E2%80%99s%20the%20Money%20-%20Defeating%20ATM%20Disk%20Encryption-white%20paper.pdf
CVE ID: CVE-2023-33207 State: PUBLISHED Published: 2023-11-13T01:07:21.140Z Last Updated: 2024-08-28T18:10:43.987Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Krzysztof Wielogórski Products: Stop Referrer Spam Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Krzysztof Wielogórski Stop Referrer Spam plugin <= 1.3.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/stop-referrer-spam/wordpress-stop-referrer-spam-plugin-1-2-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-33208 State: PUBLISHED Published: 2023-08-30T12:03:00.556Z Last Updated: 2024-09-24T19:23:27.515Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: gsmith Products: Cookie Monster Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gsmith Cookie Monster plugin <= 1.51 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/cookiemonster/wordpress-cookie-monster-plugin-1-51-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-33209 State: PUBLISHED Published: 2023-12-20T15:49:50.953Z Last Updated: 2024-09-16T18:25:11.956Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: CrawlSpider Products: SEO Change Monitor – Track Website Changes Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CrawlSpider SEO Change Monitor – Track Website Changes.This issue affects SEO Change Monitor – Track Website Changes: from n/a through 1.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/seo-change-monitor/wordpres
tainer: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/seo-change-monitor/wordpress-seo-change-monitor-plugin-1-2-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-33210 State: PUBLISHED Published: 2023-08-30T12:24:11.192Z Last Updated: 2024-09-24T19:23:19.283Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: nuajik Products: nuajik Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nuajik plugin <= 0.1.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/nuajik-cdn/wordpress-nuajik-cdn-plugin-0-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-33211 State: PUBLISHED Published: 2023-05-28T18:14:59.485Z Last Updated: 2025-02-19T21:30:08.163Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: André Bräkling Products: WP-Matomo Integration (WP-Piwik) Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in André Bräkling WP-Matomo Integration (WP-Piwik) plugin <= 1.0.27 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-piwik/wordpress-wp-matomo-integration-wp-piwik-plugin-1-0-27-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-33212 State: PUBLISHED Published: 2023-05-28T17:20:01.207Z Last Updated: 2024-11-08T18:37:42.471Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Crocoblock Products: JetFormBuilder — Dynamic Blocks Form Builder Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.0.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/jetformbuilder/wordpress-jetformbuilder-plugin-3-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-33213 State: PUBLISHED Published: 2023-06-19T12:42:25.276Z Last Updated: 2024-10-10T18:55:14.014Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: gVectors Products: Display Custom Fields – wpView Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Display Custom Fields – wpView plugin <= 1.3.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wpview/wordpress-wpview-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-33214 State: PUBLISHED Published: 2023-12-18T15:48:14.505Z Last Updated: 2024-08-28T14:04:59.352Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Tagbox Products: Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: from n/a through 3.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/t
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/taggbox-widget/wordpress-taggbox-ugc-galleries-social-media-widgets-user-reviews-analytics-plugin-2-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-33215 State: PUBLISHED Published: 2024-12-13T14:23:28.766Z Last Updated: 2024-12-13T20:37:38.844Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Tagbox Products: Taggbox Problem Types: CWE-862 Description: Missing Authorization vulnerability in Tagbox Taggbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taggbox: from n/a through 3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/taggbox-widget/vulnerability/wordpress-taggbox-ugc-galleries-social-media-widgets-user-reviews-analytics-plugin-2-9-broken-access-control-vulnerability?
dpress-taggbox-ugc-galleries-social-media-widgets-user-reviews-analytics-plugin-2-9-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-33216 State: PUBLISHED Published: 2023-05-28T16:58:52.208Z Last Updated: 2024-10-10T17:31:16.623Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: gVectors Team Products: WooDiscuz – WooCommerce Comments Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Team WooDiscuz – WooCommerce Comments woodiscuz-woocommerce-comments allows Stored XSS.This issue affects WooDiscuz – WooCommerce Comments: from n/a through 2.2.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woodiscuz-woocommerce-comments/wordp
CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woodiscuz-woocommerce-comments/wordpress-woodiscuz-woocommerce-comments-plugin-2-2-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-33217 State: PUBLISHED Published: 2023-12-15T10:45:30.637Z Last Updated: 2024-08-02T15:39:35.734Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IDEMIA Products: SIGMA Lite & Lite +, SIGMA Wide, SIGMA Extreme, MorphoWave Compact/XP, VisionPass, MorphoWave SP Problem Types: CWE-20 Description: By abusing a design flaw in the firmware upgrade mechanism of the impacted terminal it's possible to cause a permanent denial of service for the terminal. the only way to recover the terminal is by sending back the terminal to the manufacturer Additional Analyst Notes: - CVE Program Container: References: - https://www.idemia.com/wp-content/uploads/2023/
acturer Additional Analyst Notes: - CVE Program Container: References: - https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf
CVE ID: CVE-2023-33218 State: PUBLISHED Published: 2023-12-15T11:31:27.575Z Last Updated: 2024-08-02T15:39:35.856Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: IDEMIA Products: SIGMA Lite & Lite +, SIGMA Wide, SIGMA Extreme, MorphoWave Compact/XP, VisionPass, MorphoWave SP Problem Types: CWE-121 Description: The Parameter Zone Read and Parameter Zone Write command handlers allow performing a Stack buffer overflow. This could potentially lead to a Remote Code execution on the targeted device. Additional Analyst Notes: - CVE Program Container: References: - https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf
CVE ID: CVE-2023-33219 State: PUBLISHED Published: 2023-12-15T11:31:45.798Z Last Updated: 2024-08-02T15:39:35.844Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: IDEMIA Products: SIGMA Lite & Lite +, SIGMA Wide, SIGMA Extreme, MorphoWave Compact/XP, VisionPass, MorphoWave SP Problem Types: CWE-121 Description: The handler of the retrofit validation command doesn't properly check the boundaries when performing certain validation operations. This allows a stack-based buffer overflow that could lead to a potential Remote Code Execution on the targeted device Additional Analyst Notes: - CVE Program Container: References: - https://www.idemia.com/wp-content/up
he targeted device Additional Analyst Notes: - CVE Program Container: References: - https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf
CVE ID: CVE-2023-33220 State: PUBLISHED Published: 2023-12-15T11:32:14.742Z Last Updated: 2024-08-02T15:39:35.750Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: IDEMIA Products: SIGMA Lite & Lite +, SIGMA Wide, SIGMA Extreme, MorphoWave Compact/XP, VisionPass, MorphoWave SP Problem Types: CWE-121 Description: During the retrofit validation process, the firmware doesn't properly check the boundaries while copying some attributes to check. This allows a stack-based buffer overflow that could lead to a potential Remote Code Execution on the targeted device Additional Analyst Notes: - CVE Program Container: References: - https://www.idemia.com/wp-content/upl
e targeted device Additional Analyst Notes: - CVE Program Container: References: - https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf