Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-33221 State: PUBLISHED Published: 2023-12-15T11:32:48.427Z Last Updated: 2024-08-02T15:39:35.729Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IDEMIA Products: SIGMA Lite & Lite +, SIGMA Wide, SIGMA Extreme, MorphoWave Compact/XP, VisionPass, MorphoWave SP Problem Types: CWE-122 Description: When reading DesFire keys, the function that reads the card isn't properly checking the boundaries when copying internally the data received. This allows a heap based buffer overflow that could lead to a potential Remote Code Execution on the targeted device. This is especially problematic if you use Default DESFire key. Additional Analyst Notes: - CV
on on the targeted device. This is especially problematic if you use Default DESFire key. Additional Analyst Notes: - CVE Program Container: References: - https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf
CVE ID: CVE-2023-33222 State: PUBLISHED Published: 2023-12-15T11:33:17.760Z Last Updated: 2024-08-02T15:39:35.827Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IDEMIA Products: SIGMA Lite & Lite +, SIGMA Wide, SIGMA Extreme, MorphoWave Compact/XP, VisionPass, MorphoWave SP Problem Types: CWE-121 Description: When handling contactless cards, usage of a specific function to get additional information from the card which doesn't check the boundary on the data received while reading. This allows a stack-based buffer overflow that could lead to a potential Remote Code Execution on the targeted device Additional Analyst Notes: - CVE Program Container: Reference
to a potential Remote Code Execution on the targeted device Additional Analyst Notes: - CVE Program Container: References: - https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf
CVE ID: CVE-2023-33224 State: PUBLISHED Published: 2023-07-26T13:53:31.357Z Last Updated: 2024-10-23T15:37:37.577Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-696 Description: The SolarWinds Platform was susceptible to the Incorrect Behavior Order Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/cve-2023-33224 - https://documentation.sola
t: References: - https://www.solarwinds.com/trust-center/security-advisories/cve-2023-33224 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3_release_notes.htm
CVE ID: CVE-2023-33225 State: PUBLISHED Published: 2023-07-26T13:46:19.198Z Last Updated: 2025-07-09T13:48:53.623Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-697 Description: The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/cve-2023-33225 - https://documentation.solarwinds.com/en
: - https://www.solarwinds.com/trust-center/security-advisories/cve-2023-33225 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3_release_notes.htm
CVE ID: CVE-2023-33226 State: PUBLISHED Published: 2023-11-01T15:31:09.130Z Last Updated: 2024-09-05T19:34:18.162Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Network Configuration Manager Problem Types: CWE-22 Description: The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to perform the actions with SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-33226 - https://documentation.solarwinds.com/en/success_cent
ww.solarwinds.com/trust-center/security-advisories/CVE-2023-33226 - https://documentation.solarwinds.com/en/success_center/ncm/content/release_notes/ncm_2023-4_release_notes.htm
CVE ID: CVE-2023-33227 State: PUBLISHED Published: 2023-11-01T15:31:27.347Z Last Updated: 2024-09-05T19:33:38.979Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Network Configuration Manager Problem Types: CWE-22 Description: The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability This vulnerability allows a low level user to perform the actions with SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-33227 - https://documentation.solarwinds.com/en/success_cente
w.solarwinds.com/trust-center/security-advisories/CVE-2023-33227 - https://documentation.solarwinds.com/en/success_center/ncm/content/release_notes/ncm_2023-4_release_notes.htm
CVE ID: CVE-2023-33228 State: PUBLISHED Published: 2023-11-01T15:32:03.881Z Last Updated: 2024-09-05T19:32:17.272Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: SolarWinds Products: Network Configuration Manager Problem Types: CWE-311 Description: The SolarWinds Network Configuration Manager was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-33228 - https://docume
Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-33228 - https://documentation.solarwinds.com/en/success_center/ncm/content/release_notes/ncm_2023-4_release_notes.htm
CVE ID: CVE-2023-33229 State: PUBLISHED Published: 2023-07-26T14:22:53.948Z Last Updated: 2024-10-15T15:56:15.574Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-94 Description: The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject passive HTML. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/cve-2023-33229 - https://documentation.solarwinds.co
nces: - https://www.solarwinds.com/trust-center/security-advisories/cve-2023-33229 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3_release_notes.htm
CVE ID: CVE-2023-33231 State: PUBLISHED Published: 2023-07-18T16:50:43.296Z Last Updated: 2024-10-21T18:55:07.589Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SolarWinds Products: DPA Problem Types: CWE-79 Description: XSS attack was possible in DPA 2023.2 due to insufficient input validation Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-33231 - https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2023-2-100_release_notes.htm
CVE ID: CVE-2023-33234 State: PUBLISHED Published: 2023-05-30T10:56:56.139Z Last Updated: 2024-10-10T14:29:26.536Z Vendors: Apache Software Foundation Products: Apache Airflow CNCF Kubernetes Provider Problem Types: CWE-74 Description: Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichm
rsion 7.0.0 which has removed the vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq
CVE ID: CVE-2023-33235 State: PUBLISHED Published: 2023-05-22T05:38:29.841Z Last Updated: 2025-01-21T21:45:49.327Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Moxa Products: MXsecurity Series Problem Types: CWE-77 Description: MXsecurity version 1.0 is vulnearble to command injection vulnerability. This vulnerability has been reported in the SSH CLI program, which can be exploited by attackers who have gained authorization privileges. The attackers can break out of the restricted shell and subsequently execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-su
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mxsecurity-command-injection-and-hardcoded-credential-vulnerabilities
CVE ID: CVE-2023-33236 State: PUBLISHED Published: 2023-05-22T06:40:22.242Z Last Updated: 2025-01-21T21:44:46.274Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Moxa Products: MXsecurity Series Problem Types: CWE-798 Description: MXsecurity version 1.0 is vulnearble to hardcoded credential vulnerability. This vulnerability has been reported that can be exploited to craft arbitrary JWT tokens and subsequently bypass authentication for web-based APIs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mxsecurity-command-injection-and-hardcoded-credentia
- https://www.moxa.com/en/support/product-support/security-advisory/mxsecurity-command-injection-and-hardcoded-credential-vulnerabilities
CVE ID: CVE-2023-33237 State: PUBLISHED Published: 2023-08-17T01:50:53.625Z Last Updated: 2024-10-28T06:01:08.088Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Moxa Products: TN-5900 Series Problem Types: CWE-863 Description: TN-5900 Series firmware version v3.3 and prior is vulnerable to improper-authentication vulnerability. This vulnerability arises from inadequate authentication measures implemented in the web API handler, allowing low-privileged APIs to execute restricted actions that only high-privileged APIs are allowed This presents a potential risk of unauthorized exploitation by malicious actors. Additional Analyst Notes: - CVE Program Container:
s a potential risk of unauthorized exploitation by malicious actors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities
CVE ID: CVE-2023-33238 State: PUBLISHED Published: 2023-08-17T02:04:50.789Z Last Updated: 2024-10-28T06:03:40.655Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Moxa Products: TN-5900 Series, TN-4900 Series, EDR-810 Series, EDR-G902 Series, EDR-G903 Series, EDR-G9010 Series, NAT-102 Series Problem Types: CWE-78 Description: TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from inadequate input validation in the certificate management function, which could potentially allow malicious users to execute remote code on affected devi
e certificate management function, which could potentially allow malicious users to execute remote code on affected devices. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities
CVE ID: CVE-2023-33239 State: PUBLISHED Published: 2023-08-17T02:13:25.280Z Last Updated: 2024-10-28T06:04:52.923Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Moxa Products: TN-5900 Series, TN-4900 Series, EDR-810 Series, EDR-G902 Series, EDR-G903 Series, EDR-G9010 Series, NAT-102 Series Problem Types: CWE-78 Description: TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from insufficient input validation in the key-generation function, which could potentially allow malicious users to execute remote code on affected devices. A
the key-generation function, which could potentially allow malicious users to execute remote code on affected devices. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities
CVE ID: CVE-2023-33240 State: PUBLISHED Published: 2023-05-19T00:00:00 Last Updated: 2025-01-21T19:36:50.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit PDF Reader (12.1.1.15289 and earlier) and Foxit PDF Editor (12.1.1.15289 and all previous 12.x versions, 11.2.5.53785 and all previous 11.x versions, and 10.1.11.37866 and earlier) on Windows allows Local Privilege Escalation when installed to a non-default directory because unprivileged users have access to an executable file of a system service. This is fixed in 12.1.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2023-33241 State: PUBLISHED Published: 2023-08-09T21:00:20.582Z Last Updated: 2024-10-10T14:37:44.417Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: GG TSS Implementations Products: Wallet Problem Types: Private Key Exfiltration Description: Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and cheating in the range proof. Depending on the Beta parameters chosen in the protocol implementation, the attack might require 16 signatures or more fully exfiltrate the other parties' private key shares. Additional Analyst Notes: - CVE Program Conta
signatures or more fully exfiltrate the other parties' private key shares. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.fireblocks.com/blog/gg18-and-gg20-paillier-key-vulnerability-technical-report/ - https://github.com/fireblocks-labs/mpc-ecdsa-attacks-23 - https://github.com/fireblocks-labs/safeheron-gg20-exploit-poc - https://eprint.iacr.org/2019/114.pdf - https://eprint.iacr.org/2020/540.pdf
CVE ID: CVE-2023-33242 State: PUBLISHED Published: 2023-08-09T21:01:37.417Z Last Updated: 2024-10-10T12:47:35.497Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: Lindell TSS Implementations Products: Wallet Problem Types: Private Key Exfiltration Description: Crypto wallets implementing the Lindell17 TSS protocol might allow an attacker to extract the full ECDSA private key by exfiltrating a single bit in every signature attempt (256 in total) because of not adhering to the paper's security proof's assumption regarding handling aborts after a failed signature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
ter a failed signature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.fireblocks.com/blog/lindell17-abort-vulnerability-technical-report/ - https://github.com/fireblocks-labs/mpc-ecdsa-attacks-23 - https://github.com/fireblocks-labs/zengo-lindell17-exploit-poc - https://eprint.iacr.org/2017/552.pdf
CVE ID: CVE-2023-33243 State: PUBLISHED Published: 2023-06-15T00:00:00 Last Updated: 2024-12-12T21:24:45.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application's database generally has become best practice to protect users' passwords in case of a database compromise, this is rendered ineffective when allowing to authenticate using the password hash. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
ng to authenticate using the password hash. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses - https://www.redteam-pentesting.de/en/advisories/rt-sa-2022-004/-starface-authentication-with-password-hash-possible
CVE ID: CVE-2023-33244 State: PUBLISHED Published: 2023-05-20T00:00:00.000Z Last Updated: 2025-01-31T17:28:33.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notification) via an embedded web page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuln.ryotak.net/advisories/66 - https://forum.obsidian.md/t/obsidian-release-v1-2-2-insider-build/57488
CVE ID: CVE-2023-33245 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-10T21:25:02.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: Minecraft through 1.19 and 1.20 pre-releases before 7 (Java) allow arbitrary file overwrite, and possibly code execution, via crafted world data that contains a symlink. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuln.ryotak.net/advisories/67 - https://www.minecraft.net/ja-jp/article/minecraft-1-20-pre-release-7 - https://help.minecraft.net/hc/en-us/articles/16165590199181
CVE ID: CVE-2023-33246 State: PUBLISHED Published: 2023-05-24T14:45:25.684Z Last Updated: 2025-10-21T23:05:47.340Z Vendors: Apache Software Foundation Products: Apache RocketMQ Problem Types: CWE-94 Description: For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protoc
users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x . Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp - http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html - http://www.openwall.com/lists/oss-security/2023/07/12/1
CVE ID: CVE-2023-33247 State: PUBLISHED Published: 2023-05-26T00:00:00 Last Updated: 2025-01-16T16:05:51.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server. (A mitigation is that the remote harvesting server should be behind a firewall that only allows access to the Talend Data Catalog server.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.talend.com/r/en-US/Talend-Products-CVEs/Talend-Products-CVEs
CVE ID: CVE-2023-33248 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2025-01-16T16:04:36.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz (often outside the range of human adult hearing). Commands at these frequencies are essentially never spoken by authorized actors, but a substantial fraction of the commands are successful. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cios2023.org/papers - https://www.useni
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cios2023.org/papers - https://www.usenix.org/system/files/sec23fall-prepub-261-xia-qi.pdf - https://sites.google.com/view/nuitattack/home - https://arxiv.org/abs/2305.10358 - https://github.com/reveondivad/nuance - https://youtu.be/3gEc5ZFWIWo
CVE ID: CVE-2023-33250 State: PUBLISHED Published: 2023-05-21T00:00:00.000Z Last Updated: 2025-03-18T18:36:45.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux kernel 6.3 has a use-after-free in iopt_unmap_iova_range in drivers/iommu/iommufd/io_pagetable.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://groups.google.com/g/syzkaller/c/G6P9yecsTZ8/m/iiqFVOM9BwAJ - https://lore.kernel.org/linux-iommu/ZDabT%2FuRl%2FjxFhm0%40ip-172-31-85-199.ec2.internal/T/ - https://security.netapp.com/advisory/ntap-20230622-0006/ - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=dbe245cdf5189e88d680379ed139013
30622-0006/ - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=dbe245cdf5189e88d680379ed13901356628b650 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=804ca14d04df09bf7924bacc5ad22a4bed80c94f - https://bugzilla.suse.com/show_bug.cgi?id=1211597
CVE ID: CVE-2023-33251 State: PUBLISHED Published: 2023-05-21T00:00:00.000Z Last Updated: 2025-01-31T15:32:41.262Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AC:H/AV:L/A:N/C:H/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions: it is readable by other users on Linux or UNIX, a similar issue to CVE-2022-41946. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://akka.io/security/akka-http-cve-2023-05-15.html
CVE ID: CVE-2023-33252 State: PUBLISHED Published: 2023-05-21T00:00:00 Last Updated: 2025-01-21T16:54:23.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: iden3 snarkjs through 0.6.11 allows double spending because there is no validation that the publicSignals length is less than the field modulus. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/iden3/snarkjs/commits/master/src/groth16_verify.js - https://github.com/iden3/snarkjs/tags