Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
low, FortiProxy version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.8, version 2.0.12 and below and FortiOS-6K7K version 7.0.5, version 6.4.0 through 6.4.10 and version 6.2.0 through 6.2.10 and below allows a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-001
CVE ID: CVE-2023-25611 State: PUBLISHED Published: 2023-03-07T16:04:36.606Z Last Updated: 2024-10-22T20:48:54.796Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N/E:X/RL:X/RC:X) Vendors: Fortinet Products: FortiAnalyzer Problem Types: CWE-1236 Description: A improper neutralization of formula elements in a CSV file vulnerability in Fortinet FortiAnalyzer 6.4.0 - 6.4.9, 7.0.0 - 7.0.5, and 7.2.0 - 7.2.1 allows local attacker to execute unauthorized code or commands via inserting spreadsheet formulas in macro names. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-488
CVE ID: CVE-2023-25613 State: PUBLISHED Published: 2023-02-20T15:29:39.154Z Last Updated: 2024-08-02T11:25:19.226Z Vendors: Apache Software Foundation Products: Apache Kerby LDAP Backend Problem Types: CWE-74 Description: An LDAP Injection vulnerability exists in the LdapIdentityBackend of Apache Kerby before 2.0.3. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/ynz3hhbbq6d980fzpncwbh5jd8mkyt5y
CVE ID: CVE-2023-25614 State: PUBLISHED Published: 2023-02-14T03:20:11.856Z Last Updated: 2025-03-20T20:16:11.329Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP Products: NetWeaver AS ABAP (BSP Framework) Problem Types: CWE-79 Description: SAP NetWeaver AS ABAP (BSP Framework) application - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allow an unauthenticated attacker to inject the code that can be executed by the application over the network. On successful exploitation it can gain access to the sensitive information which leads to a limited impact on the confidentiality and the integrity of the application. Additional Anal
information which leads to a limited impact on the confidentiality and the integrity of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3274585 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-25615 State: PUBLISHED Published: 2023-03-14T04:40:25.108Z Last Updated: 2025-02-27T18:12:21.203Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: SAP Products: ABAP Platform Problem Types: CWE-89 Description: Due to insufficient input sanitization, SAP ABAP - versions 751, 753, 753, 754, 756, 757, 791, allows an authenticated high privileged user to alter the current session of the user by injecting the malicious database queries over the network and gain access to the unintended data. This may lead to a high impact on the confidentiality and no impact on the availability and integrity of the application. Additional Analyst Notes: - CVE Prog
confidentiality and no impact on the availability and integrity of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3289844 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-25616 State: PUBLISHED Published: 2023-03-14T04:41:28.901Z Last Updated: 2025-02-27T18:09:04.335Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP Products: Business Objects Business Intelligence Platform (CMC) Problem Types: CWE-74 Description: In some scenario, SAP Business Objects Business Intelligence Platform (CMC) - versions 420, 430, Program Object execution can lead to code injection vulnerability which could allow an attacker to gain access to resources that are allowed by extra privileges. Successful attack could highly impact the confidentiality, Integrity, and Availability of the system. Additional Analyst Notes: - CVE Progr
ould highly impact the confidentiality, Integrity, and Availability of the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3245526 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-25617 State: PUBLISHED Published: 2023-03-14T04:42:40.759Z Last Updated: 2025-02-27T18:07:16.954Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: SAP Products: Business Objects (Adaptive Job Server) Problem Types: CWE-78 Description: SAP Business Object (Adaptive Job Server) - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects execution is enabled, to authenticated users with scheduling rights, using the BI Launchpad, Central Management Console or a custom application based on the public java SDK. Programs could impact the confidentiality, integrity and availability of the system. Additional Analys
public java SDK. Programs could impact the confidentiality, integrity and availability of the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3283438 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-25618 State: PUBLISHED Published: 2023-03-14T04:51:29.976Z Last Updated: 2025-02-27T15:11:45.115Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP Products: NetWeaver AS for ABAP and ABAP Platform Problem Types: CWE-400 Description: SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in an unused class for error handling in which an attacker authenticated as a non-administrative user can craft a request with certain parameters which will consume the server's resources sufficiently to make it unavailable. There is no abilit
ith certain parameters which will consume the server's resources sufficiently to make it unavailable. There is no ability to view or modify any information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3296346 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-25619 State: PUBLISHED Published: 2023-04-19T07:53:15.405Z Last Updated: 2025-02-05T15:08:51.526Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Schneider Electric Products: Modicon M340 CPU (part numbers BMXP34*) , Modicon M580 CPU (part numbers BMEP* and BMEH*), Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S), Modicon Momentum Unity M1E Processor (171CBU*), Modicon MC80 (BMKC80), Legacy Modicon Quantum (140CPU65*), Legacy Modicon Premium CPUs (TSXP57*) Problem Types: CWE-754 Description: A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller when
eck for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller when communicating over the Modbus TCP protocol. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-05.pdf
CVE ID: CVE-2023-25620 State: PUBLISHED Published: 2023-04-19T08:17:57.240Z Last Updated: 2025-02-05T14:58:06.851Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Schneider Electric Products: Modicon M340 CPU (part numbers BMXP34*) , Modicon M580 CPU (part numbers BMEP* and BMEH*), Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S), Modicon Momentum Unity M1E Processor (171CBU*), Modicon MC80 (BMKC80), Legacy Modicon Quantum (140CPU65*), Legacy Modicon Premium CPUs (TSXP57*) Problem Types: CWE-754 Description: A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller wh
Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller when a malicious project file is loaded onto the controller by an authenticated user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-05.pdf
CVE ID: CVE-2023-25621 State: PUBLISHED Published: 2023-02-23T08:42:37.104Z Last Updated: 2025-03-18T15:01:24.410Z Vendors: Apache Software Foundation Products: Apache Sling Problem Types: Privilege Escalation Description: Privilege Escalation vulnerability in Apache Software Foundation Apache Sling. Any content author is able to create i18n dictionaries in the repository in a location the author has write access to. As these translations are used across the whole product, it allows an author to change any text or dialog in the product. For example an attacker might fool someone by changing the text on a delete button to "Info". This issue affects the i18n module of Apache Sling up to versio
meone by changing the text on a delete button to "Info". This issue affects the i18n module of Apache Sling up to version 2.5.18. Version 2.6.2 and higher limit by default i18m dictionaries to certain paths in the repository (/libs and /apps). Users of the module are advised to update to version 2.6.2 or higher, check the configuration for resource loading and then adjust the access permissions for the configured path accordingly. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sling.apache.org/news.html
CVE ID: CVE-2023-25632 State: PUBLISHED Published: 2023-11-27T07:03:12.145Z Last Updated: 2024-10-11T17:58:24.336Z Vendors: NAVER Products: NAVER Whale browser Problem Types: CWE-359 Description: The Android Mobile Whale browser app before 3.0.1.2 allows the attacker to bypass its browser unlock function via 'Open in Whale' feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cve.naver.com/detail/cve-2023-25632.html
CVE ID: CVE-2023-25642 State: PUBLISHED Published: 2023-12-14T07:17:08.945Z Last Updated: 2024-08-02T11:25:19.252Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: ZTE Products: MC801A, MC801A1 Problem Types: CWE-120 Description: There is a buffer overflow vulnerability in some ZTE mobile internet producsts. Due to insufficient validation of tcp port parameter, an authenticated attacker could use the vulnerability to perform a denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032504
CVE ID: CVE-2023-25643 State: PUBLISHED Published: 2023-12-14T07:19:08.757Z Last Updated: 2024-08-28T14:10:23.264Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: ZTE Products: MC801A, MC801A1 Problem Types: CWE-77 Description: There is a command injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of multiple network parameters, an authenticated attacker could use the vulnerability to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032504
CVE ID: CVE-2023-25644 State: PUBLISHED Published: 2023-12-14T08:04:26.281Z Last Updated: 2025-05-22T17:53:37.661Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ZTE Products: MC801A, MC801A1 Problem Types: CWE-755 Description: There is a denial of service vulnerability in some ZTE mobile internet products. Due to insufficient validation of Web interface parameter, an attacker could use the vulnerability to perform a denial of service attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032624
CVE ID: CVE-2023-25645 State: PUBLISHED Published: 2023-06-16T00:00:00 Last Updated: 2024-12-12T17:14:29.564Z Vendors: n/a Products: UP T2 4K, ZXV10 B866V2-H, ZXV10 B866V2, ZXV10 B860H V5D0, ZXV10 B866V2F Problem Types: permission and access control Description: There is a permission and access control vulnerability in some ZTE AndroidTV STBs. Due to improper permission settings, non-privileged application can perform functions that are protected with signature/privilege-level permissions. Exploitation of this vulnerability could clear personal data and applications on the user's device, affecting device operation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
user's device, affecting device operation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1031464
CVE ID: CVE-2023-25646 State: PUBLISHED Published: 2024-06-20T06:20:44.058Z Last Updated: 2024-08-02T11:25:19.252Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: ZTE Products: ZXHN H388X Problem Types: CWE-281 Description: There is an unauthorized access vulnerability in ZTE H388X. If H388X is caused by brute-force serial port cracking,attackers with common user permissions can use this vulnerability to obtain elevated permissions on the affected device by performing specific operations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1035844
CVE ID: CVE-2023-25647 State: PUBLISHED Published: 2023-08-17T02:13:19.932Z Last Updated: 2024-10-01T18:17:44.385Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: ZTE Products: Some ZTE Mobile Phones Problem Types: CWE-269 Description: There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could monitor the touch event. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032264
CVE ID: CVE-2023-25648 State: PUBLISHED Published: 2023-12-14T06:46:39.187Z Last Updated: 2024-08-02T11:25:19.340Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: ZTE Products: ZXCLOUD iRAI Problem Types: CWE-732 Description: There is a weak folder permission vulnerability in ZTE's ZXCLOUD iRAI product. Due to weak folder permission, an attacker with ordinary user privileges could construct a fake DLL to execute command to escalate local privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032584
CVE ID: CVE-2023-25649 State: PUBLISHED Published: 2023-08-25T09:37:36.684Z Last Updated: 2024-10-02T15:09:39.756Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ZTE Products: MF286R Problem Types: CWE-77 Description: There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032544
CVE ID: CVE-2023-25650 State: PUBLISHED Published: 2023-12-14T06:52:23.199Z Last Updated: 2024-08-02T11:25:19.352Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: ZTE Products: ZXCLOUD iRAI Problem Types: CWE-20 Description: There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Since the backend does not escape special strings or restrict paths, an attacker with user permission could access the download interface by modifying the request parameter, causing arbitrary file downloads. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032904
CVE ID: CVE-2023-25651 State: PUBLISHED Published: 2023-12-14T07:03:54.704Z Last Updated: 2024-08-02T11:25:19.271Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: ZTE Products: Mobile Internet Products Problem Types: CWE-20 Description: There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use the vulnerability to execute SQL injection and cause information leak. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032684
CVE ID: CVE-2023-25652 State: PUBLISHED Published: 2023-04-25T19:17:35.315Z Last Updated: 2025-11-04T16:09:58.740Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: git Products: git Problem Types: CWE-22 Description: Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.
m the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/git/git/security/advisories/GHSA-2hvf-7c8p-28fx - https://github.com/git/git/commit/18e2b1cfc80990719275d7b08e6e50f3e8cbc902 - https://github.com/git/git/commit/668f2d53613ac8fd373926ebe2
m/git/git/commit/18e2b1cfc80990719275d7b08e6e50f3e8cbc902 - https://github.com/git/git/commit/668f2d53613ac8fd373926ebe219f2c29112d93e - http://www.openwall.com/lists/oss-security/2023/04/25/2 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BSXOGVVBJLYX26IAY
TYCU/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BSXOGVVBJLYX26IAYX6PJSYQB36BREWH/ - https://security.gentoo.org/glsa/202312-15 - https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html
CVE ID: CVE-2023-25653 State: PUBLISHED Published: 2023-02-16T18:15:27.085Z Last Updated: 2025-03-10T21:10:13.531Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: cisco Products: node-jose Problem Types: CWE-835 Description: node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default "fallback" crypto back-end, ECC operations in `node-jose` can trigger a Denial-of-Service (DoS) condition, due to a possible infinite loop in an internal calculation. For some ECC operations, this condition is triggered randomly; for others, it can be trigge
in an internal calculation. For some ECC operations, this condition is triggered randomly; for others, it can be triggered by malicious input. The issue has been patched in version 2.2.0. Since this issue is only present in the "fallback" crypto implementation, it can be avoided by ensuring that either WebCrypto or the Node `crypto` module is available in the JS environment where `node-jose` is being run. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cisco/node-jose/security/advisories/GHSA-5h4j-qrvg-9xhw - https://github.com/cisco/node-jose/commit/901d91508a70e3b9bdfc45688ea07bb4e1b8210d
CVE ID: CVE-2023-25654 State: PUBLISHED Published: 2023-03-23T19:22:30.154Z Last Updated: 2025-02-25T14:51:02.752Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: baserproject Products: basercms Problem Types: CWE-434 Description: baserCMS is a Content Management system. Prior to version 4.7.5, there is a Remote Code Execution (RCE) Vulnerability in the management system of baserCMS. Version 4.7.5 contains a patch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/baserproject/basercms/security/advisories/GHSA-h4cc-fxpp-pgw9 - https://github.com/baserproject/basercms/commit/002886be0998c74c386e04f0
ercms/security/advisories/GHSA-h4cc-fxpp-pgw9 - https://github.com/baserproject/basercms/commit/002886be0998c74c386e04f0b43688a8a45d7a96 - https://github.com/baserproject/basercms/commit/08247f0a633d8e836ce2e5cd2d53aa19901a1359 - https://github.com/baserproject/basercms/commit/60f83054d8131b0ace60716cec7e629b5eb3a8f0 - https://github.com/baserproject/basercms/releases/tag/basercms-4.7.5
CVE ID: CVE-2023-25655 State: PUBLISHED Published: 2023-03-23T19:23:58.897Z Last Updated: 2025-02-25T14:50:52.950Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: baserproject Products: basercms Problem Types: CWE-434 Description: baserCMS is a Content Management system. Prior to version 4.7.5, any file may be uploaded on the management system of baserCMS. Version 4.7.5 contains a patch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/baserproject/basercms/security/advisories/GHSA-mfvg-qwcw-qvc8 - https://github.com/baserproject/basercms/commit/922025a98b0e697ab78f6a785a004e0729aa9100 - https://g
SA-mfvg-qwcw-qvc8 - https://github.com/baserproject/basercms/commit/922025a98b0e697ab78f6a785a004e0729aa9100 - https://github.com/baserproject/basercms/commit/9297629983ed908c7f51bf61a0231dde91404ebd - https://github.com/baserproject/basercms/releases/tag/basercms-4.7.5
CVE ID: CVE-2023-25656 State: PUBLISHED Published: 2023-02-20T00:00:00 Last Updated: 2024-11-27T16:45:09.132Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: notaryproject Products: notation-go Problem Types: CWE-770 Description: notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users will find their application using excessive memory when verifying signatures. The application will be killed, and thus availability is impacted. The problem has been patched in the release v1.0.0-rc.3. Some workarounds are available. Users can review their own trust policy file