Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-36785 State: PUBLISHED Published: 2023-10-10T17:08:10.995Z Last Updated: 2025-04-14T22:46:42.673Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2022 (GDR), Microsoft ODBC Driver 17 for SQL Server on Windows, Microsoft ODBC Driver 17 for SQL Server on Linux, Microsoft ODBC Driver 17 for SQL Server on MacOS, Microsoft ODBC Driver 18 for SQL Server on Windows, Microsoft ODBC Driver 18 for SQL Server on Linux, Microsoft ODBC Driver 18 for SQL Server on MacOS, Microsoft SQL Server 2019 (CU 22), Microsoft SQL Server 2022 (CU 8) Problem Types: CWE-191 Descriptio
L Server on MacOS, Microsoft SQL Server 2019 (CU 22), Microsoft SQL Server 2022 (CU 8) Problem Types: CWE-191 Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36785
CVE ID: CVE-2023-36786 State: PUBLISHED Published: 2023-10-10T17:08:10.444Z Last Updated: 2025-04-14T22:45:49.379Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Skype for Business Server 2015 CU13, Skype for Business Server 2019 CU7 Problem Types: CWE-36 Description: Skype for Business Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36786
CVE ID: CVE-2023-36787 State: PUBLISHED Published: 2023-08-21T19:04:29.357Z Last Updated: 2025-01-01T01:58:31.434Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Edge (Chromium-based) Problem Types: CWE-416 Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36787
CVE ID: CVE-2023-36788 State: PUBLISHED Published: 2023-09-12T16:58:41.302Z Last Updated: 2025-10-30T18:18:10.649Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5 AND 4.8.1, Microsoft .NET Framework 3.5 and 4.6.2, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.0 Service Pack 2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1 Problem Types: Remote Code Execution Description: .NET Framework Remote Code Execution Vulnerability Addit
amework 3.5.1 Problem Types: Remote Code Execution Description: .NET Framework Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36788
CVE ID: CVE-2023-36789 State: PUBLISHED Published: 2023-10-10T17:08:09.912Z Last Updated: 2025-04-14T22:45:50.074Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Skype for Business Server 2019 CU7, Skype for Business Server 2015 CU13 Problem Types: CWE-94 Description: Skype for Business Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36789
CVE ID: CVE-2023-36790 State: PUBLISHED Published: 2023-10-10T17:08:09.390Z Last Updated: 2025-04-14T22:46:44.660Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation) Problem Types: CWE-284 Description: Windows RDP Encoder Mirror Driver Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-20
ional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36790
CVE ID: CVE-2023-36792 State: PUBLISHED Published: 2023-09-12T16:58:40.779Z Last Updated: 2025-10-30T18:18:10.174Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8), Microsoft Visual Studio 2022 version 17.2, Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10), Microsoft Visual Studio 2022 version 17.4, .NET 6.0, .NET 7.0, Microsoft Visual Studio 2022 version 17.6, PowerShell 7.2, Microsoft Visual Studio 2022 version 17.7, Microsoft .NET Framework 4.8, Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft .NET Framew
.NET Framework 4.8, Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5 AND 4.8.1, Microsoft .NET Framework 4.6.2, Microsoft .NET Framework 3.5 and 4.6.2, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.0 Service Pack 2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1 Problem Types: CWE-190 Description: Visual Studio Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-
CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36792
CVE ID: CVE-2023-36793 State: PUBLISHED Published: 2023-09-12T16:58:40.256Z Last Updated: 2025-10-30T18:18:09.586Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8), Microsoft Visual Studio 2022 version 17.2, Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10), Microsoft Visual Studio 2022 version 17.4, .NET 7.0, .NET 6.0, PowerShell 7.2, Microsoft Visual Studio 2022 version 17.6, Microsoft Visual Studio 2022 version 17.7, Microsoft .NET Framework 4.8, Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2, Micro
.NET Framework 4.8, Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5 AND 4.8.1, Microsoft .NET Framework 4.6.2, Microsoft .NET Framework 3.5 and 4.6.2, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.0 Service Pack 2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1 Problem Types: CWE-122 Description: Visual Studio Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-
CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36793
CVE ID: CVE-2023-36794 State: PUBLISHED Published: 2023-09-12T16:58:39.719Z Last Updated: 2025-10-30T18:18:08.911Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8), Microsoft Visual Studio 2022 version 17.2, Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10), Microsoft Visual Studio 2022 version 17.4, PowerShell 7.2, .NET 6.0, .NET 7.0, Microsoft Visual Studio 2022 version 17.6, Microsoft Visual Studio 2022 version 17.7, Microsoft .NET Framework 4.8, Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft .NET Framew
.NET Framework 4.8, Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5 AND 4.8.1, Microsoft .NET Framework 4.6.2, Microsoft .NET Framework 3.5 and 4.6.2, Microsoft .NET Framework 3.0 Service Pack 2, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1 Problem Types: CWE-191 Description: Visual Studio Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-
CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36794
CVE ID: CVE-2023-36796 State: PUBLISHED Published: 2023-09-12T16:58:39.186Z Last Updated: 2025-10-30T18:18:08.271Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Visual Studio 2022 version 17.6, Microsoft Visual Studio 2022 version 17.7, Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8), Microsoft Visual Studio 2022 version 17.2, Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10), Microsoft Visual Studio 2022 version 17.4, Microsoft Visual Studio 2013 Update 5, Microsoft Visual Studio 2015 Update 3, .NET 7.0, .NET 6.0, PowerShell 7.2, Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NE
oft Visual Studio 2015 Update 3, .NET 7.0, .NET 6.0, PowerShell 7.2, Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 4.8, Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5 AND 4.8.1, Microsoft .NET Framework 4.6.2, Microsoft .NET Framework 3.5 and 4.6.2, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.0 Service Pack 2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1 Problem Types: CWE-191 Description: Visual Studio Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Conta
Visual Studio Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36796
CVE ID: CVE-2023-36799 State: PUBLISHED Published: 2023-09-12T16:58:38.681Z Last Updated: 2025-10-30T18:18:07.707Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: .NET 6.0, .NET 7.0, Microsoft Visual Studio 2022 version 17.2, Microsoft Visual Studio 2022 version 17.4, Microsoft Visual Studio 2022 version 17.7, Microsoft Visual Studio 2022 version 17.6, PowerShell 7.2, PowerShell 7.3 Problem Types: CWE-400 Description: .NET Core and Visual Studio Denial of Service Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-20
SA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36799
CVE ID: CVE-2023-36800 State: PUBLISHED Published: 2023-09-12T16:58:38.175Z Last Updated: 2025-10-30T18:18:07.164Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Dynamics 365 for Finance and Operations Problem Types: CWE-79 Description: Dynamics Finance and Operations Cross-site Scripting Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36800
CVE ID: CVE-2023-36801 State: PUBLISHED Published: 2023-09-12T16:58:27.612Z Last Updated: 2025-10-30T18:17:54.145Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), W
008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-126 Description: DHCP Server Service Information Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36801
CVE ID: CVE-2023-36802 State: PUBLISHED Published: 2023-09-12T16:58:27.082Z Last Updated: 2025-10-30T18:17:53.504Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2 Problem Types: CWE-416 Description: Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-20
E Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36802
CVE ID: CVE-2023-36803 State: PUBLISHED Published: 2023-09-12T16:58:26.570Z Last Updated: 2025-10-30T18:17:52.833Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: CWE-126 Description: Windows Kernel Information Disclosure Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Containe
ws Kernel Information Disclosure Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36803
CVE ID: CVE-2023-36804 State: PUBLISHED Published: 2023-09-12T16:58:26.032Z Last Updated: 2025-10-30T18:17:52.209Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Wi
08 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-416 Description: Windows GDI Elevation of Privilege Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36804
CVE ID: CVE-2023-36805 State: PUBLISHED Published: 2023-09-12T16:58:25.501Z Last Updated: 2025-10-30T18:17:51.580Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Serve
R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-77 Description: Windows MSHTML Platform Security Feature Bypass Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36805
CVE ID: CVE-2023-36806 State: PUBLISHED Published: 2023-07-25T18:47:34.415Z Last Updated: 2025-02-13T16:56:24.200Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: contao Products: contao Problem Types: CWE-79 Description: Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview (back end) and on the website (front end). Installations are only affected if there are untrusted back end users who have the rights to modify headline fields
nd). Installations are only affected if there are untrusted back end users who have the rights to modify headline fields, or other fields using the input unit widget. Contao 4.9.42, 4.13.28, and 5.1.10 have a patch for this issue. As a workaround, disable the login for all untrusted back end users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/contao/contao/security/advisories/GHSA-4gpr-p634-922x - https://github.com/contao/contao/commit/5c9aff32cfc1f7dc452a045862ac2f86a6b9b4b4 - https://github.com/contao/contao/commit/c98585d36baa25fda69c062421e7e7eadc53c82b - https://github.com/contao/contao/commit/ccb64c777eb0f9c0e6490c9135d80
/commit/c98585d36baa25fda69c062421e7e7eadc53c82b - https://github.com/contao/contao/commit/ccb64c777eb0f9c0e6490c9135d80e915d37cd32 - https://herolab.usd.de/security-advisories/usd-2023-0020/
CVE ID: CVE-2023-36807 State: PUBLISHED Published: 2023-06-30T18:38:10.303Z Last Updated: 2024-11-06T19:51:43.120Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: py-pdf Products: pypdf Problem Types: CWE-835 Description: pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In version 2.10.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the user extracted metadata from such a malformed PDF. Ve
oes not affect memory usage. That is, for example, the case if the user extracted metadata from such a malformed PDF. Versions prior to 2.10.5 throw an error, but do not hang forever. This issue was fixed with https://github.com/py-pdf/pypdf/pull/1331 which has been included in release 2.10.6. Users are advised to upgrade. Users unable to upgrade should modify `PyPDF2/generic/_data_structures.py::read_object` to an an error throwing case. See GHSA-hm9v-vj3r-r55m for details. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/py-pdf/pypdf/security/advisories/GHSA-hm9v-vj3r-r55m - https://github.com/py-pdf/pypdf/issues/1329 - https://gi
thub.com/py-pdf/pypdf/security/advisories/GHSA-hm9v-vj3r-r55m - https://github.com/py-pdf/pypdf/issues/1329 - https://github.com/py-pdf/pypdf/pull/1331
CVE ID: CVE-2023-36808 State: PUBLISHED Published: 2023-07-05T20:52:48.874Z Last Updated: 2024-10-18T19:39:38.690Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-89 Description: GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native inventory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/securi
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-vf5h-jh9q-2gjm - https://github.com/glpi-project/glpi/releases/tag/10.0.8
CVE ID: CVE-2023-36809 State: PUBLISHED Published: 2023-07-05T21:02:37.602Z Last Updated: 2024-10-24T18:16:23.913Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: kiwitcms Products: Kiwi Problem Types: CWE-79, CWE-434 Description: Kiwi TCMS, an open source test management system allows users to upload attachments to test plans, test cases, etc. Versions of Kiwi TCMS prior to 12.5 had introduced changes which were meant to serve all uploaded files as plain text in order to prevent browsers from executing potentially dangerous files when such files are accessed directly. The previous Nginx configuration was incorrect allowing certain browsers like Firefox to ign
iles are accessed directly. The previous Nginx configuration was incorrect allowing certain browsers like Firefox to ignore the `Content-Type: text/plain` header on some occasions thus allowing potentially dangerous scripts to be executed. Additionally, file upload validators and parts of the HTML rendering code had been found to require additional sanitation and improvements. Version 12.5 fixes this vulnerability with updated Nginx content type configuration, improved file upload validation code to prevent more potentially dangerous uploads, and Sanitization of test plan names used in the `tree_view_html()` function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment
ames used in the `tree_view_html()` function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-jpgw-2r9m-8qfw - https://huntr.dev/bounties/511489dd-ba38-4806-9029-b28ab2830aa8/ - https://huntr.dev/bounties/c6eeb346-fa99-4d41-bc40-b68f8d689223/ - https://kiwitcms.org/blog/kiwi-tcms-team/2023/07/04/kiwi-tcms-125/ - https://www.github.com/kiwitcms/kiwi/commit/195ea53eaaf360c19227c864cc0fe58910032c3c - https://www.github.com/kiwitcms/kiwi/commit/ffb00450be52fe11a82a2507632c2328cae4ec9d
CVE ID: CVE-2023-36810 State: PUBLISHED Published: 2023-06-30T18:43:12.801Z Last Updated: 2025-02-13T16:56:24.866Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: py-pdf Products: pypdf Problem Types: CWE-407 Description: pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advis