Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-46204 State: PUBLISHED Published: 2023-10-24T10:53:42.698Z Last Updated: 2024-09-10T18:00:23.508Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Muller Digital Inc. Products: Duplicate Theme Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Muller Digital Inc. Duplicate Theme plugin <= 0.1.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/duplicate-theme/wordpress-duplicate-theme-plugin-0-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-46205 State: PUBLISHED Published: 2024-05-17T08:34:21.145Z Last Updated: 2024-08-02T20:37:40.108Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L) Vendors: Brainstorm Force Products: Ultimate Addons for WPBakery Page Builder Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder allows PHP Local File Inclusion.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through 3.19.14. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vuln
onal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ultimate_vc_addons/wordpress-ultimate-addons-for-wpbakery-page-builder-plugin-3-19-14-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2023-46206 State: PUBLISHED Published: 2025-01-02T12:00:16.727Z Last Updated: 2025-01-03T19:09:07.323Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: websoudan Products: MW WP Form Problem Types: CWE-862 Description: Missing Authorization vulnerability in websoudan MW WP Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MW WP Form: from n/a through 4.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/mw-wp-form/vulnerability/wordpress-mw-wp-form-plugin-4-4-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-46207 State: PUBLISHED Published: 2023-11-13T02:51:13.073Z Last Updated: 2024-08-28T15:38:57.255Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) Vendors: StylemixThemes Products: Motors – Car Dealer, Classifieds & Listing Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing.This issue affects Motors – Car Dealer, Classifieds & Listing: from n/a through 1.4.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/motors-car-dealership-classified-listings/wordpress-motors-car-dea
nces: - https://patchstack.com/database/vulnerability/motors-car-dealership-classified-listings/wordpress-motors-car-dealer-classifieds-listing-plugin-1-4-6-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-46208 State: PUBLISHED Published: 2023-10-27T20:28:52.640Z Last Updated: 2024-09-06T18:47:55.749Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: StylemixThemes Products: Motors – Car Dealer, Classifieds & Listing Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin <= 1.4.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/motors-car-dealership-classified-listings/wordpress-motors-car-dealer-classifieds-listing-plugin-1-4-6-reflected-cross-s
motors-car-dealership-classified-listings/wordpress-motors-car-dealer-classifieds-listing-plugin-1-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-46209 State: PUBLISHED Published: 2023-10-27T20:39:05.613Z Last Updated: 2024-09-06T18:48:15.299Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: G5Theme Products: Grid Plus – Unlimited grid layout Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in G5Theme Grid Plus – Unlimited grid plugin <= 1.3.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/grid-plus/wordpress-grid-plus-plugin-1-3-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-46210 State: PUBLISHED Published: 2023-10-31T07:38:50.902Z Last Updated: 2024-09-12T20:06:06.469Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: WebCource Products: WC Captcha Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WebCource WC Captcha plugin <= 1.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wc-captcha/wordpress-wc-captcha-plugin-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-46211 State: PUBLISHED Published: 2023-10-27T20:22:57.184Z Last Updated: 2024-09-06T18:47:25.502Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Brainstorm Force Products: Ultimate Addons for WPBakery Page Builder Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder plugin <= 3.19.14 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ultimate_vc_addons/wordpress-ultimate-addons-for-wpbakery-page-builder-plugin-3-19-14-cross-site-scripti
e/vulnerability/ultimate_vc_addons/wordpress-ultimate-addons-for-wpbakery-page-builder-plugin-3-19-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-46212 State: PUBLISHED Published: 2023-12-18T23:57:14.163Z Last Updated: 2024-08-02T20:37:40.124Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: TienCOP Products: WP EXtra Problem Types: CWE-862, CWE-352 Description: Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in TienCOP WP EXtra allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects WP EXtra: from n/a through 6.2. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-extra/wordpress-wp-extra-plugin-6-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-46213 State: PUBLISHED Published: 2023-11-16T20:15:46.739Z Last Updated: 2025-02-28T11:03:42.823Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Problem Types: CWE-79 Description: In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffective escaping in the “Show syntax Highlighted” feature can result in the execution of unauthorized code in a user’s web browser. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-1103 - https://research.splunk.com/application/1030bc63-0b37-4ac9-9ae0-9361c955a3cc/
CVE ID: CVE-2023-46214 State: PUBLISHED Published: 2023-11-16T20:15:25.838Z Last Updated: 2025-06-10T13:56:17.530Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Problem Types: CWE-91 Description: In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advis
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2023-1104 - https://research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/ - https://research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/
CVE ID: CVE-2023-46215 State: PUBLISHED Published: 2023-10-28T07:10:57.943Z Last Updated: 2025-06-12T14:43:45.163Z Vendors: Apache Software Foundation Products: Apache Airflow Celery provider, Apache Airflow Problem Types: CWE-532 Description: Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend Note: the vulnerability is about the information exposed in the logs not about accessing the logs. This issue affects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3. Users are rec
fects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3. Users are recommended to upgrade Airflow Celery provider to version 3.4.1 and Apache Airlfow to version 2.7.0 which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/34954 - https://lists.apache.org/thread/wm1jfmks7r6m7bj0mq4lmw3998svn46n - http://www.openwall.com/lists/oss-security/2023/10/28/1
CVE ID: CVE-2023-46216 State: PUBLISHED Published: 2023-12-19T15:43:26.330Z Last Updated: 2024-08-02T20:37:40.148Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Wavelink Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. Additional Analyst Notes: - CVE Program Container: References: - https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE ID: CVE-2023-46217 State: PUBLISHED Published: 2023-12-19T15:43:26.322Z Last Updated: 2024-11-27T15:13:07.764Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Wavelink Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE ID: CVE-2023-46218 State: PUBLISHED Published: 2023-12-07T01:10:34.846Z Last Updated: 2025-06-30T16:20:37.028Z Vendors: curl Products: curl Description: This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed
ie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/2212193 - https://curl.se/docs/CVE-2023-46218.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ZX3VW67N4ACRAPMV2QS2LVYGD7H2MVE/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/ - https://lists.debian.org/debian-lts-announce/2023/12/msg00015.html - https://www.debian.org/security/2023/dsa-5587 - https://sec
lists.debian.org/debian-lts-announce/2023/12/msg00015.html - https://www.debian.org/security/2023/dsa-5587 - https://security.netapp.com/advisory/ntap-20240125-0007/
CVE ID: CVE-2023-46219 State: PUBLISHED Published: 2023-12-12T01:38:41.376Z Last Updated: 2025-11-04T19:25:34.066Z Vendors: curl Products: curl Description: When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/2236133 - https://curl.se/docs/CVE-2023-46219.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/ - https://www.debian.org/security/2023/dsa-5587 - https://security.netap
t.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/ - https://www.debian.org/security/2023/dsa-5587 - https://security.netapp.com/advisory/ntap-20240119-0007/
CVE ID: CVE-2023-46220 State: PUBLISHED Published: 2023-12-19T15:43:26.358Z Last Updated: 2024-08-02T20:37:40.128Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. Additional Analyst Notes: - CVE Program Container: References: - https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE ID: CVE-2023-46221 State: PUBLISHED Published: 2023-12-19T15:43:26.331Z Last Updated: 2024-08-02T20:37:40.137Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. Additional Analyst Notes: - CVE Program Container: References: - https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE ID: CVE-2023-46222 State: PUBLISHED Published: 2023-12-19T15:43:26.329Z Last Updated: 2024-08-02T20:37:40.176Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. Additional Analyst Notes: - CVE Program Container: References: - https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE ID: CVE-2023-46223 State: PUBLISHED Published: 2023-12-19T15:43:26.253Z Last Updated: 2024-08-02T20:37:40.182Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE ID: CVE-2023-46224 State: PUBLISHED Published: 2023-12-19T15:43:26.338Z Last Updated: 2024-09-16T18:31:43.409Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE ID: CVE-2023-46225 State: PUBLISHED Published: 2023-12-19T15:43:26.285Z Last Updated: 2024-08-02T20:37:40.139Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. Additional Analyst Notes: - CVE Program Container: References: - https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE ID: CVE-2023-46226 State: PUBLISHED Published: 2024-01-15T10:35:49.810Z Last Updated: 2025-06-20T16:51:31.364Z Vendors: Apache Software Foundation Products: Apache IoTDB Problem Types: Remote code execution Description: Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2. Users are recommended to upgrade to version 1.3.0, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/293b4ob65ftnfwyf62fb9zh8gwdy38hg - http://www.openwall.com/lists/oss-security/2024/01/15/1
CVE ID: CVE-2023-46227 State: PUBLISHED Published: 2023-10-19T09:40:46.423Z Last Updated: 2024-09-12T20:13:07.162Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-502 Description: Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can use \t to bypass. Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8814 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/m8txor4f76tmrxksrmc87tw42g57nz33
CVE ID: CVE-2023-46228 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-09-12T18:08:06.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: zchunk before 1.3.2 has multiple integer overflows via malformed zchunk files to lib/comp/comp.c, lib/comp/zstd/zstd.c, lib/dl/multipart.c, or lib/header.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zchunk/zchunk/commit/08aec2b4dfd7f709b6e3d511411ffcc83ed4efbe - https://bugzilla.suse.com/show_bug.cgi?id=1216268 - https://github.com/zchunk/zchunk/compare/1.3.1...1.3.2
CVE ID: CVE-2023-46229 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-09-12T18:06:21.757Z Vendors: n/a Products: n/a Problem Types: n/a Description: LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/langchain-ai/langchain/pull/11925 - https://github.com/langchain-ai/langchain/commit/9ecb7240a480720ec9d739b3877a52f76098a2b8
CVE ID: CVE-2023-46230 State: PUBLISHED Published: 2024-01-30T17:00:49.161Z Last Updated: 2025-05-30T18:47:36.661Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L) Vendors: Splunk Products: Splunk Add-on Builder Problem Types: CWE-532 Description: In Splunk Add-on Builder versions below 4.1.4, the app writes sensitive information to internal log files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2024-0111
CVE ID: CVE-2023-46231 State: PUBLISHED Published: 2024-01-30T17:00:46.832Z Last Updated: 2025-02-28T11:03:46.800Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Add-on Builder Problem Types: CWE-532 Description: In Splunk Add-on Builder versions below 4.1.4, the application writes user session tokens to its internal log files when you visit the Splunk Add-on Builder or when you build or edit a custom app or add-on. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2024-0110
CVE ID: CVE-2023-46232 State: PUBLISHED Published: 2023-10-25T21:01:51.692Z Last Updated: 2024-09-10T14:02:31.551Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: matter-labs Products: era-compiler-vyper Problem Types: CWE-471 Description: era-compiler-vyper is the EraVM Vyper compiler for zkSync Era, a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to era-compiler-vype version 1.3.10, a bug prevented the initialization of the first immutable variable for Vyper contracts meeting certain criteria. The problem arises when there is a String or Array with more 256-bit words allocated than initialized. It results in the second word’s inde
when there is a String or Array with more 256-bit words allocated than initialized. It results in the second word’s index unset, that is effectively set to 0, so the first immutable value with the actual 0 index is overwritten in the ImmutableSimulator. Version 1.3.10 fixes this issue by setting all indexes in advance. The problem will go away, but it will get more expensive if the user allocates a lot of uninitialized space, e.g. `String[4096]`. Upgrading and redeploying affected contracts is the only way of working around the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matter-labs/era-compiler-vyper/security/advisories
Container: - CISA ADP Vulnrichment: References: - https://github.com/matter-labs/era-compiler-vyper/security/advisories/GHSA-h8jv-969m-94r4 - https://github.com/matter-labs/era-compiler-vyper/commit/8be305a1b9c68d0fd47dad3434224ed85944ca25 - https://github.com/matter-labs/era-system-contracts/blob/main/contracts/ImmutableSimulator.sol#L37
CVE ID: CVE-2023-46233 State: PUBLISHED Published: 2023-10-25T20:49:31.582Z Last Updated: 2025-02-13T17:14:22.498Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: brix Products: crypto-js Problem Types: CWE-328, CWE-916 Description: crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when
re since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 4.2.0 contains a patch for this issue. As a workaround, configure crypto-js to use SHA256 with at least 250,000 iterations. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/brix/crypto-js/security/advisories/GHSA-xwcq-pm8m-c4vf - https://github.com/brix/crypto-js/commit/421dd538b2d34e7c24a5b72cc64dc2b9167db40a - https://lists
/GHSA-xwcq-pm8m-c4vf - https://github.com/brix/crypto-js/commit/421dd538b2d34e7c24a5b72cc64dc2b9167db40a - https://lists.debian.org/debian-lts-announce/2023/11/msg00025.html
CVE ID: CVE-2023-46234 State: PUBLISHED Published: 2023-10-26T14:31:35.895Z Last Updated: 2025-02-13T17:14:23.092Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: browserify Products: browserify-sign Problem Types: CWE-347 Description: browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input sign