Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-46956 State: PUBLISHED Published: 2023-11-30T00:00:00 Last Updated: 2024-10-15T17:42:54.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Packers and Movers Management System v.1.0 allows a remote attacker to execute arbitrary code via crafted payload to the /mpms/admin/?page=user/manage_user&id file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/geilihan/bug_reports/blob/main/packers-and-movers-management-system/SQL-1.md
CVE ID: CVE-2023-46958 State: PUBLISHED Published: 2023-11-02T00:00:00 Last Updated: 2024-09-06T14:02:50.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in lmxcms v.1.41 allows a remote attacker to execute arbitrary code via a crafted script to the admin.php file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.lmxcms.com/ - http://lmxcms.com - https://gist.github.com/durian5201314/6507d1057c62f4bf93e740a631617434
CVE ID: CVE-2023-46960 State: PUBLISHED Published: 2024-04-29T00:00:00 Last Updated: 2024-08-02T21:01:22.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in PyPXE v.1.8.4 allows a remote attacker to cause a denial of service via the handle function in the tftp module. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pypxe/PyPXE/issues/206
CVE ID: CVE-2023-46963 State: PUBLISHED Published: 2023-11-04T00:00:00 Last Updated: 2024-09-05T14:32:38.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Beijing Yunfan Internet Technology Co., Ltd, Yunfan Learning Examination System v.6.5 allows a remote attacker to obtain sensitive information via the password parameter in the login function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/NBSLclass/glassfish/blob/main/Proof-of-vulnerability.md
CVE ID: CVE-2023-46964 State: PUBLISHED Published: 2023-11-04T00:00:00 Last Updated: 2024-09-05T14:30:40.694Z Vendors: Hillstone Products: Next Generation FireWall SG-6000-E3960 Problem Types: Cross Site Scripting (XSS) Description: Cross Site Scripting (XSS) vulnerability in Hillstone Next Generation FireWall SG-6000-e3960 v.5.5 allows a remote attacker to execute arbitrary code via the use front-end filtering instead of back-end filtering. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://foremost-smash-52a.notion.site/Hillstone-Next-Generation-FireWall-XSS-CVE-2023-46964-6cf1fe91e7ed4795adb1d89d75030d16
CVE ID: CVE-2023-46967 State: PUBLISHED Published: 2024-02-20T00:00:00 Last Updated: 2024-08-06T16:35:06.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in the sanitize function in Enhancesoft osTicket 1.18.0 allows a remote attacker to escalate privileges via a crafted support ticket. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sonarsource.com/blog/pitfalls-of-desanitization-leaking-customer-data-from-osticket/
CVE ID: CVE-2023-46974 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T21:01:22.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Best Courier Management System v.1.000 allows a remote attacker to execute arbitrary code via a crafted payload to the page parameter in the URL. Additional Analyst Notes: - CVE Program Container: References: - https://youtu.be/5oVfJHT_-Ys - https://github.com/yte121/CVE-2023-46974/
CVE ID: CVE-2023-46976 State: PUBLISHED Published: 2023-10-31T00:00:00 Last Updated: 2024-09-06T19:36:43.025Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3300R 17.0.0cu.557_B20221024 contains a command injection via the file_name parameter in the UploadFirmwareFile function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shinypolaris/vuln-reports/blob/master/TOTOLINK%20A3300R/1/README.md
CVE ID: CVE-2023-46977 State: PUBLISHED Published: 2023-10-31T00:00:00 Last Updated: 2024-09-06T19:47:55.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK LR1200GB V9.1.0u.6619_B20230130 was discovered to contain a stack overflow via the password parameter in the function loginAuth. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shinypolaris/vuln-reports/blob/master/TOTOLINK%20LR1200GB/1/README.md
CVE ID: CVE-2023-46978 State: PUBLISHED Published: 2023-10-31T00:00:00 Last Updated: 2024-09-06T19:52:25.749Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK X6000R V9.4.0cu.852_B20230719 is vulnerable to Incorrect Access Control.Attackers can reset login password & WIFI passwords without authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shinypolaris/vuln-reports/blob/master/TOTOLINK%20X6000R/1/README.md
CVE ID: CVE-2023-46979 State: PUBLISHED Published: 2023-10-31T00:00:00 Last Updated: 2024-09-06T19:53:33.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK X6000R V9.4.0cu.852_B20230719 was discovered to contain a command injection vulnerability via the enable parameter in the setLedCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shinypolaris/vuln-reports/blob/master/TOTOLINK%20X6000R/2/README.md
CVE ID: CVE-2023-46980 State: PUBLISHED Published: 2023-11-03T00:00:00 Last Updated: 2024-09-06T13:45:57.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Best Courier Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the userID parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://youtu.be/3Mz2lSElg7Y - https://github.com/sajaljat/CVE-2023-46980/tree/main
CVE ID: CVE-2023-46981 State: PUBLISHED Published: 2023-11-04T00:00:00 Last Updated: 2024-09-05T14:27:15.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /common/log/list. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/JunFengDeng/Cve-List/blob/main/novel-plus/20231027/vuln/readme.md
CVE ID: CVE-2023-46987 State: PUBLISHED Published: 2023-12-28T00:00:00 Last Updated: 2024-08-02T21:01:22.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS v12.9 was discovered to contain a remote code execution (RCE) vulnerability via the component /augap/adminip.php. Additional Analyst Notes: - CVE Program Container: References: - http://seacms.com - http://www.seacms.com/ - https://blog.csdn.net/weixin_72610998/article/details/133420747?spm=1001.2014.3001.5501
CVE ID: CVE-2023-46988 State: PUBLISHED Published: 2025-04-01T00:00:00.000Z Last Updated: 2025-04-15T22:29:50.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote attacker to copy arbitrary files by manipulating the fileExt parameter in the /example/editor endpoint, leading to unauthorized access to sensitive files and potential Denial of Service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@mihat2/onlyoffice-document-server-path-traversal-fdd573fec291
CVE ID: CVE-2023-46989 State: PUBLISHED Published: 2023-12-28T00:00:00 Last Updated: 2024-09-12T18:44:14.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in the Innovadeluxe Quick Order module for PrestaShop before v.1.4.0, allows local attackers to execute arbitrary code via the getProducts() function in the productlist.php file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2023/12/12/idxquickorder.html
CVE ID: CVE-2023-46990 State: PUBLISHED Published: 2023-11-20T00:00:00 Last Updated: 2024-08-02T21:01:22.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sanluan/PublicCMS/issues/76#issue-1960443408
CVE ID: CVE-2023-46992 State: PUBLISHED Published: 2023-10-31T00:00:00 Last Updated: 2024-10-28T19:06:24.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 is vulnerable to Incorrect Access Control. Attackers are able to reset serveral critical passwords without authentication by visiting specific pages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/AuroraHaaash/vul_report/blob/main/TOTOLINK%20A3300R/readme.md
CVE ID: CVE-2023-46993 State: PUBLISHED Published: 2023-10-31T00:00:00 Last Updated: 2024-09-06T19:57:52.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK A3300R V17.0.0cu.557_B20221024 when dealing with setLedCfg request, there is no verification for the enable parameter, which can lead to command injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/AuroraHaaash/vul_report/blob/main/TOTOLINK%20A3300R-Command%20Injection/readme.md
CVE ID: CVE-2023-46998 State: PUBLISHED Published: 2023-11-07T00:00:00 Last Updated: 2024-08-02T21:01:22.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in BootBox Bootbox.js v.3.2 through 6.0 allows a remote attacker to execute arbitrary code via a crafted payload to alert(), confirm(), prompt() functions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bootboxjs/bootbox/issues/661 - https://github.com/soy-oreocato/CVE-2023-46998/
CVE ID: CVE-2023-47003 State: PUBLISHED Published: 2023-11-16T00:00:00 Last Updated: 2024-08-14T18:19:29.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in RedisGraph v.2.12.10 allows an attacker to execute arbitrary code and cause a denial of service via a crafted string in DataBlock_ItemIsDeleted. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/RedisGraph/RedisGraph/issues/3063
CVE ID: CVE-2023-47004 State: PUBLISHED Published: 2023-11-06T00:00:00.000Z Last Updated: 2025-04-29T20:02:13.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Redis RedisGraph v.2.x through v.2.12.8 and fixed in v.2.12.9 allows an attacker to execute arbitrary code via the code logic after valid authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/RedisGraph/RedisGraph/issues/3178
CVE ID: CVE-2023-47005 State: REJECTED Published: N/A Last Updated: 2024-01-19T18:50:21.482294 Description: No description available.
CVE ID: CVE-2023-47006 State: REJECTED Published: N/A Last Updated: 2024-01-19T18:50:16.553766 Description: No description available.
CVE ID: CVE-2023-47007 State: REJECTED Published: N/A Last Updated: 2024-01-19T18:50:10.400766 Description: No description available.
CVE ID: CVE-2023-47008 State: REJECTED Published: N/A Last Updated: 2024-01-19T18:50:04.115502 Description: No description available.
CVE ID: CVE-2023-47014 State: PUBLISHED Published: 2023-11-22T00:00:00 Last Updated: 2024-08-02T21:01:22.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) vulnerability in Sourcecodester Sticky Notes App Using PHP with Source Code v.1.0 allows a local attacker to obtain sensitive information via a crafted payload to add-note.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/emirhanerdogu/CVE-2023-47014-Sticky-Notes-App-Using-PHP-with-Source-Code-v1.0-CSRF-to-CORS/blob/main/README.md
CVE ID: CVE-2023-47016 State: PUBLISHED Published: 2023-11-22T00:00:00 Last Updated: 2024-10-11T14:19:14.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian.h. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/radareorg/radare2/issues/22349 - https://github.com/radareorg/radare2/commit/40c9f50e127be80b9d816bce2ab2ee790831aefd - https://gist.github.com/gandalf4a/65705be4f84269cb7cd725a1d4ab2ffa
CVE ID: CVE-2023-47020 State: PUBLISHED Published: 2024-02-08T00:00:00.000Z Last Updated: 2025-06-10T16:05:45.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross-Site Request Forgery (CSRF) chaining in NCR Terminal Handler v.1.5.1 allows privileges to be escalated by an attacker through a crafted request involving user account creation and adding the user to an administrator group. This is exploited by an undisclosed function in the WSDL that lacks security controls and can accept custom content types. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://youtu.be/pGB3LKdf64w - https://github.com/Patrick0x41/Security-Advi
iner: - CISA ADP Vulnrichment: References: - https://youtu.be/pGB3LKdf64w - https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47020
CVE ID: CVE-2023-47022 State: PUBLISHED Published: 2024-02-06T00:00:00.000Z Last Updated: 2025-06-17T16:15:54.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Direct Object Reference in NCR Terminal Handler v.1.5.1 allows an unprivileged user to edit the audit logs for any user and can lead to CSV injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47022
CVE ID: CVE-2023-47024 State: PUBLISHED Published: 2024-01-20T00:00:00.000Z Last Updated: 2025-06-17T16:57:44.037Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Request Forgery (CSRF) in NCR Terminal Handler v.1.5.1 leads to a one-click account takeover. This is achieved by exploiting multiple vulnerabilities, including an undisclosed function in the WSDL that has weak security controls and can accept custom content types. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.google.com/document/d/18EOsFghBsAme0b3Obur8Oc6h5xV9zUCNKyQLw5ERs9Q/edit?usp=sharing - https://github.com/Patrick0x41/Security-Advisories/tree/main
sFghBsAme0b3Obur8Oc6h5xV9zUCNKyQLw5ERs9Q/edit?usp=sharing - https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47024
CVE ID: CVE-2023-47025 State: PUBLISHED Published: 2023-11-16T00:00:00 Last Updated: 2024-08-12T14:14:53.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Free5gc v.3.3.0 allows a local attacker to cause a denial of service via the free5gc-compose component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/free5gc/free5gc/issues/501
CVE ID: CVE-2023-47029 State: PUBLISHED Published: 2025-06-23T00:00:00.000Z Last Updated: 2025-06-26T15:08:53.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted POST request to the UserService component Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1oX5uKnWGiYMaBxnBuqPiOA53XLxv1Ef4/view?usp=sharing - https://github.com/pwahba/cve-research/blob/main/CVE-2023-47029/CVE-2023-47029.md
CVE ID: CVE-2023-47030 State: PUBLISHED Published: 2025-06-23T00:00:00.000Z Last Updated: 2025-06-24T17:58:32.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via a GET request to a UserService SOAP API endpoint to validate if a user exists. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1ujUcB8XEs78WwWzs8cmD-u1Twqi10yEh/view?usp=sharing - https://github.com/pwahba/cve-research/blob/main/CVE-2023-47030/CVE-2023-47030.md
CVE ID: CVE-2023-47031 State: PUBLISHED Published: 2025-06-23T00:00:00.000Z Last Updated: 2025-06-24T17:55:28.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to escalate privileges via a crafted POST request to the grantRolesToUsers, grantRolesToGroups, and grantRolesToOrganization SOAP API component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://terminal.com - http://ncr.com - https://drive.google.com/file/d/1f9riw_seicV9MB7pRQJFY-8voxkW8ZYH/view?usp=sharing
CVE ID: CVE-2023-47032 State: PUBLISHED Published: 2025-06-23T00:00:00.000Z Last Updated: 2025-06-24T17:54:34.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: Password Vulnerability in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code via a crafted script to the UserService SOAP API function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1rTKc2nxEc40VTItJiJ9moZ5VrHG3xQuj/view?usp=sharing - https://github.com/pwahba/cve-research/blob/main/CVE-2023-47032/CVE-2023-47032.md
CVE ID: CVE-2023-47033 State: PUBLISHED Published: 2024-01-19T00:00:00.000Z Last Updated: 2025-05-30T14:27:23.854Z Vendors: n/a Products: n/a Problem Types: n/a Description: MultiSigWallet 0xF0C99 was discovered to contain a reentrancy vulnerability via the function executeTransaction. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://etherscan.io/address/0xF0C9975eFd521282c2DF55774251912d691aC4d9 - https://github.com/RikkaLzw/CVE/blob/main/CVE-2024.1.19.md
CVE ID: CVE-2023-47034 State: PUBLISHED Published: 2024-01-19T00:00:00 Last Updated: 2024-09-03T19:36:45.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in UniswapFrontRunBot 0xdB94c allows attackers to cause financial losses via unspecified vectors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://etherscan.io/address/0xdB94c67460DdaA9D6a9d6a2B855B5440f9afEb7C - https://github.com/RikkaLzw/CVE/blob/main/CVE-2024.1.19-2.md
CVE ID: CVE-2023-47035 State: PUBLISHED Published: 2024-01-19T00:00:00.000Z Last Updated: 2025-05-30T14:26:59.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: RPTC 0x3b08c was discovered to not conduct status checks on the parameter tradingOpen. This vulnerability can allow attackers to conduct unauthorized transfer operations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://etherscan.io/token/0x3b08c03fa8278cf81b9043b228183760376fcdbb - https://github.com/RikkaLzw/CVE/blob/main/CVE-2024.1.19-3.md
CVE ID: CVE-2023-47037 State: PUBLISHED Published: 2023-11-12T13:12:23.137Z Last Updated: 2025-02-13T17:14:45.806Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-863 Description: We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.3 or later which has removed the vulnerability. Additional Analyst Notes: - CVE Program
s should upgrade to version 2.7.3 or later which has removed the vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/33413 - https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0 - http://www.openwall.com/lists/oss-security/2023/11/12/1
CVE ID: CVE-2023-47038 State: PUBLISHED Published: 2023-12-18T13:43:07.713Z Last Updated: 2025-11-20T17:57:09.298Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-122 Description: A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/R
tional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:2228 - https://access.redhat.com/errata/RHSA-2024:3128 - https://access.redhat.com/security/cve/CVE-2023-47038 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1056746 - https://bugzilla.redhat.com/show_bug.cgi?id=2249523
CVE ID: CVE-2023-47039 State: PUBLISHED Published: 2024-01-02T05:30:53.168Z Last Updated: 2025-11-20T17:57:11.573Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-122 Description: A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find and execute `cmd.exe` within the operating system. However, due to path search order iss
erpreter, Perl attempts to find and execute `cmd.exe` within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. This flaw allows an attacker with limited privileges to place`cmd.exe` in locations with weak permissions, such as `C:\ProgramData`. By doing so, arbitrary code can be executed when an administrator attempts to use this executable from these compromised locations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-47039 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1056746 - https://bugzilla.redhat.com/show_bug.
y/cve/CVE-2023-47039 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1056746 - https://bugzilla.redhat.com/show_bug.cgi?id=2249525
CVE ID: CVE-2023-47040 State: PUBLISHED Published: 2023-11-16T14:42:57.237Z Last Updated: 2024-09-04T20:48:43.007Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Media Encoder Problem Types: CWE-125 Description: Adobe Media Encoder version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Ana
t user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/media-encoder/apsb23-63.html