Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-32651 State: PUBLISHED Published: 2024-02-14T13:37:58.475Z Last Updated: 2024-08-14T18:39:09.688Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software Problem Types: denial of service, CWE-1287 Description: Improper validation of specified type of input for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/se
CVE ID: CVE-2023-32652 State: PUBLISHED Published: 2023-07-06T23:03:35.078Z Last Updated: 2024-11-13T21:30:59.211Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: PiiGAB Products: M-Bus SoftwarePack Problem Types: CWE-79 Description: PiiGAB M-Bus does not validate identification strings before processing, which could make it vulnerable to cross-site scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-187-01
CVE ID: CVE-2023-32653 State: PUBLISHED Published: 2023-09-25T15:22:33.625Z Last Updated: 2025-11-04T19:16:25.698Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Accusoft Products: ImageGear Problem Types: CWE-191 Description: An out-of-bounds write vulnerability exists in the dcm_pixel_data_decode functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1802
CVE ID: CVE-2023-32654 State: PUBLISHED Published: 2023-07-28T04:30:45.707Z Last Updated: 2025-02-13T16:54:54.946Z Vendors: Apple Products: macOS Problem Types: A user may be able to read information belonging to another user Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.5. A user may be able to read information belonging to another user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213843 - https://support.apple.com/kb/HT213843
CVE ID: CVE-2023-32655 State: PUBLISHED Published: 2023-11-14T19:04:50.082Z Last Updated: 2024-08-30T15:47:24.334Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) NUC Kits & Mini PCs - NUC8i7HVK & NUC8HNK USB Type C power delivery controller installatio software Problem Types: escalation of privilege, CWE-249 Description: Path transversal in some Intel(R) NUC Kits & Mini PCs - NUC8i7HVK & NUC8HNK USB Type C power delivery controller installatio software before version 1.0.10.3 for Windows may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: -
er to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00908.html
CVE ID: CVE-2023-32656 State: PUBLISHED Published: 2023-08-11T02:37:24.133Z Last Updated: 2024-10-04T13:05:24.192Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA Problem Types: escalation of privilege, CWE-92 Description: Improper buffer restrictions in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-ce
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00912.html
CVE ID: CVE-2023-32657 State: PUBLISHED Published: 2023-07-19T21:47:37.160Z Last Updated: 2024-10-28T14:20:52.959Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Weintek Products: Weincloud Problem Types: CWE-307 Description: Weintek Weincloud v0.13.6 could allow an attacker to efficiently develop a brute force attack on credentials with authentication hints from error message responses. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-04
CVE ID: CVE-2023-32658 State: PUBLISHED Published: 2023-11-14T19:04:45.847Z Last Updated: 2024-08-30T17:03:01.364Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) NUC Kits NUC7i3DN, NUC7i5DN, NUC7i7DN HDMI firmware update tool software Problem Types: escalation of privilege, CWE-428 Description: Unquoted search path in some Intel(R) NUC Kits NUC7i3DN, NUC7i5DN, NUC7i7DN HDMI firmware update tool software before version 1.79.1.1 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/con
ess. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00908.html
CVE ID: CVE-2023-32659 State: PUBLISHED Published: 2023-06-19T20:18:36.913Z Last Updated: 2024-12-09T20:48:27.468Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:L) Vendors: SUBNET Solutions Inc. Products: PowerSYSTEM Center Problem Types: CWE-79 Description: SUBNET PowerSYSTEM Center versions 2020 U10 and prior contain a cross-site scripting vulnerability that may allow an attacker to inject malicious code into report header graphic files that could propagate out of the system and reach users who are subscribed to email notifications. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisori
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-166-01
CVE ID: CVE-2023-32660 State: PUBLISHED Published: 2023-11-14T19:04:46.955Z Last Updated: 2024-08-30T16:36:44.414Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) NUC Kit NUC6i7KYK Thunderbolt(TM) 3 Firmware Update Tool installation software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path in some Intel(R) NUC Kit NUC6i7KYK Thunderbolt(TM) 3 Firmware Update Tool installation software before version 46 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.int
local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00908.html
CVE ID: CVE-2023-32661 State: PUBLISHED Published: 2023-11-14T19:04:43.625Z Last Updated: 2024-08-30T17:09:14.996Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) NUC Kits NUC7PJYH and NUC7CJYH Realtek* SD Card Reader Driver installation software Problem Types: escalation of privilege, CWE-287 Description: Improper authentication in some Intel(R) NUC Kits NUC7PJYH and NUC7CJYH Realtek* SD Card Reader Driver installation software before version 10.0.19041.29098 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
lation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00908.html
CVE ID: CVE-2023-32662 State: PUBLISHED Published: 2023-11-14T19:05:03.453Z Last Updated: 2024-08-30T15:22:22.830Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel Battery Life Diagnostic Tool installation software Problem Types: escalation of privilege, CWE-285 Description: Improper authorization in some Intel Battery Life Diagnostic Tool installation software before version 2.2.1 may allow a privilaged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00843.
- CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00843.html
CVE ID: CVE-2023-32663 State: PUBLISHED Published: 2023-08-11T02:37:34.706Z Last Updated: 2024-10-15T18:59:30.781Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) RealSense(TM) SDKs in version 2.53.1 Problem Types: escalation of privilege, Incorrect default permissions Description: Incorrect default permissions in some Intel(R) RealSense(TM) SDKs in version 2.53.1 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00946.html
CVE ID: CVE-2023-32664 State: PUBLISHED Published: 2023-07-19T13:16:36.811Z Last Updated: 2025-11-04T19:16:26.851Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: Foxit Reader Problem Types: CWE-843 Description: A type confusion vulnerability exists in the Javascript checkThisBox method as implemented in Foxit Reader 12.1.2.15332. Specially crafted Javascript code inside a malicious PDF document can cause memory corruption and lead to remote code execution. User would need to open a malicious file to trigger the vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1795
CVE ID: CVE-2023-32665 State: PUBLISHED Published: 2023-09-14T19:03:58.229Z Last Updated: 2025-02-13T16:54:55.463Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: n/a, Red Hat, Fedora Products: glib2, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Fedora 38, Extra Packages for Enterprise Linux, Fedora, Fedora 37 Problem Types: CWE-400 Description: A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Con
excessive processing, leading to denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-32665 - https://bugzilla.redhat.com/show_bug.cgi?id=2211827 - https://gitlab.gnome.org/GNOME/glib/-/issues/2121 - https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html - https://security.gentoo.org/glsa/202311-18 - https://security.netapp.com/advisory/ntap-20240426-0006/
CVE ID: CVE-2023-32666 State: PUBLISHED Published: 2024-03-14T16:45:44.785Z Last Updated: 2025-02-13T16:54:56.071Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: n/a Products: 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX Problem Types: escalation of privilege, CWE-1191 Description: On-chip debug and test interface with improper access control in some 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www
via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00986.html - https://security.netapp.com/advisory/ntap-20240405-0010/
CVE ID: CVE-2023-32668 State: PUBLISHED Published: 2023-05-11T00:00:00.000Z Last Updated: 2025-11-03T21:48:34.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tug.org/pipermail/tex-live/2023-May/049188.html - https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/tags/1.17.0 - https://gitlab.lisn.up
il/tex-live/2023-May/049188.html - https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/tags/1.17.0 - https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/blob/b266ef076c96b382cd23a4c93204e247bb98626a/source/texk/web2c/luatexdir/ChangeLog#L1-L3 - https://tug.org/~mseven/luatex.html#luasocket
CVE ID: CVE-2023-32669 State: PUBLISHED Published: 2023-10-03T12:23:24.533Z Last Updated: 2024-09-06T14:10:21.920Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: BuddyBoss Products: BuddyBoss Problem Types: CWE-639 Description: Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users' albums. This vulnerability can be exploited by changing the album identification (id). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-budyboss
CVE ID: CVE-2023-32670 State: PUBLISHED Published: 2023-10-03T12:25:05.203Z Last Updated: 2024-09-19T19:51:45.995Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: BuddyBoss Products: BuddyBoss Problem Types: CWE-79 Description: Cross-Site Scripting vulnerability in BuddyBoss 2.2.9 version , which could allow a local attacker with basic privileges to execute a malicious payload through the "[name]=image.jpg" parameter, allowing to assign a persistent javascript payload that would be triggered when the associated image is loaded. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notic
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-budyboss
CVE ID: CVE-2023-32671 State: PUBLISHED Published: 2023-10-03T12:26:44.072Z Last Updated: 2024-09-06T14:09:55.335Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: BuddyBoss Products: BuddyBoss Problem Types: CWE-79 Description: A stored XSS vulnerability has been found on BuddyBoss Platform affecting version 2.2.9. This vulnerability allows an attacker to store a malicious javascript payload via POST request when sending an invitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-budyboss
CVE ID: CVE-2023-32672 State: PUBLISHED Published: 2023-09-06T13:16:02.396Z Last Updated: 2024-09-26T15:52:02.025Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-863 Description: An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thr
. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/ococ6nlj80f0okkwfwpjczy3q84j3wkp
CVE ID: CVE-2023-32673 State: PUBLISHED Published: 2023-06-12T21:39:31.381Z Last Updated: 2025-01-03T18:54:51.530Z Vendors: HP Inc. Products: HP PC Hardware Diagnostics Windows, HP Image Assistant, and HP Thunderbolt Dock G2 Firmware Description: Certain versions of HP PC Hardware Diagnostics Windows, HP Image Assistant, and HP Thunderbolt Dock G2 Firmware are potentially vulnerable to elevation of privilege. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_8128401-8128440-16/hspbhf03848
CVE ID: CVE-2023-32674 State: PUBLISHED Published: 2023-06-12T21:40:45.091Z Last Updated: 2025-01-03T18:54:02.827Z Vendors: HP Inc. Products: HP PC Hardware Diagnostics Windows Description: Certain versions of HP PC Hardware Diagnostics Windows are potentially vulnerable to buffer overflow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_8128401-8128440-16/hspbhf03848
CVE ID: CVE-2023-32675 State: PUBLISHED Published: 2023-05-19T19:46:18.047Z Last Updated: 2025-02-12T16:36:34.945Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: vyperlang Products: vyper Problem Types: CWE-670 Description: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked `nonpayable`. This applies to contracts compiled with vyper versions prior to 0.3.8. This issue was fixed by the removal of the global `calldatasize` check in commit `02339dfda`. Users are advised to upgrade to v
sue was fixed by the removal of the global `calldatasize` check in commit `02339dfda`. Users are advised to upgrade to version 0.3.8. Users unable to upgrade should avoid use of nonpayable default functions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vyperlang/vyper/security/advisories/GHSA-vxmm-cwh2-q762 - https://github.com/vyperlang/vyper/commit/02339dfda0f3caabad142060d511d10bfe93c520
CVE ID: CVE-2023-32676 State: PUBLISHED Published: 2023-05-26T22:44:09.157Z Last Updated: 2024-10-15T16:29:34.601Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H) Vendors: autolab Products: Autolab Problem Types: CWE-22 Description: Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the Install assessment functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted Tar file. Using the install assessment functionality an attacker can feed a Tar file that contain files with paths pointing outside of the target
l assessment functionality an attacker can feed a Tar file that contain files with paths pointing outside of the target directory (e.g., `../../../../tmp/tarslipped1.sh`). When the Install assessment form is submitted the files inside of the archives are expanded to the attacker-chosen locations. This issue has been addressed in version 2.11.0. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/autolab/Autolab/security/advisories/GHSA-x9hj-r9q4-832c - https://github.com/autolab/Autolab/commit/14f508484a8323eceb0cf3a128573b43eabbc80d - https://securitylab.github.com/advisories/GHSL-2023-081_GHSL-2023-082_A
ommit/14f508484a8323eceb0cf3a128573b43eabbc80d - https://securitylab.github.com/advisories/GHSL-2023-081_GHSL-2023-082_Autolab/
CVE ID: CVE-2023-32677 State: PUBLISHED Published: 2023-05-19T20:44:47.105Z Last Updated: 2025-02-12T16:37:08.157Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: zulip Products: zulip Problem Types: CWE-862 Description: Zulip is an open-source team collaboration tool with unique topic-based threading. Zulip administrators can configure Zulip to limit who can add users to streams, and separately to limit who can invite users to the organization. In Zulip Server 6.1 and below, the UI which allows a user to invite a new user also allows them to set the streams that the new user is invited to -- even if the inviting user would not have permissions to add an existi
set the streams that the new user is invited to -- even if the inviting user would not have permissions to add an existing user to streams. While such a configuration is likely rare in practice, the behavior does violate security-related controls. This does not let a user invite new users to streams they cannot see, or would not be able to add users to if they had that general permission. This issue has been addressed in version 6.2. Users are advised to upgrade. Users unable to upgrade may limit sending of invitations down to users who also have the permission to add users to streams. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.co
to streams. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zulip/zulip/security/advisories/GHSA-mrvp-96q6-jpvc - https://github.com/zulip/zulip/commit/7c2693a2c64904d1d0af8503b57763943648cbe5 - https://zulip.com/help/configure-who-can-invite-to-streams - https://zulip.com/help/restrict-account-creation#change-who-can-send-invitations
CVE ID: CVE-2023-32678 State: PUBLISHED Published: 2023-08-25T20:04:49.432Z Last Updated: 2024-09-30T18:17:38.788Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: zulip Products: zulip Problem Types: CWE-285 Description: Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. Users who used to be subscribed to a private stream and have been removed from it since retain the ability to edit messages/topics, move messages to other streams, and delete messages that they used to have access to, if other relevant organization permissions allow these actions. For example, a user may be able to edit or delete their ol
other relevant organization permissions allow these actions. For example, a user may be able to edit or delete their old messages they posted in such a private stream. An administrator will be able to delete old messages (that they had access to) from the private stream. This issue was fixed in Zulip Server version 7.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zulip/zulip/security/advisories/GHSA-q3wg-jm9p-35fj - https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-7-3
CVE ID: CVE-2023-32679 State: PUBLISHED Published: 2023-05-19T19:40:14.858Z Last Updated: 2025-02-12T16:37:52.522Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: craftcms Products: cms Problem Types: CWE-74 Description: Craft CMS is an open source content management system. In affected versions of Craft CMS an unrestricted file extension may lead to Remote Code Execution. If the name parameter value is not empty string('') in the View.php's doesTemplateExist() -> resolveTemplate() -> _resolveTemplateInternal() -> _resolveTemplate() function, it returns directly without extension verification, so that arbitrary extension files are rendered as twig templates. W