Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-50092 State: PUBLISHED Published: 2024-01-03T00:00:00.000Z Last Updated: 2025-06-17T15:30:33.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: APIIDA API Gateway Manager for Broadcom Layer7 v2023.2 is vulnerable to Cross Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://apiida.com/product/apiida-api-gateway-manager/ - https://senscybersecurity.nl/cve-2023-50092-explained/
CVE ID: CVE-2023-50093 State: PUBLISHED Published: 2024-01-03T00:00:00.000Z Last Updated: 2025-06-18T15:29:44.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: APIIDA API Gateway Manager for Broadcom Layer7 v2023.2.2 is vulnerable to Host Header Injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://apiida.com/product/apiida-api-gateway-manager/ - https://senscybersecurity.nl/cve-2023-50093-explained/
CVE ID: CVE-2023-50094 State: PUBLISHED Published: 2024-01-01T00:00:00.000Z Last Updated: 2025-04-17T18:55:32.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/yogeshojha/rengine/blob/5e120bd5f9dfbd1da82a193e8c9702e483d38d22/web/api/views.py#L195 - https://github.com/yogeshojha/rengine/security - https://github.com/yogeshojha/rengine/release
2/web/api/views.py#L195 - https://github.com/yogeshojha/rengine/security - https://github.com/yogeshojha/rengine/releases - https://www.mattz.io/posts/cve-2023-50094/ - https://github.com/yogeshojha/rengine/security/advisories/GHSA-fx7f-f735-vgh4 - https://github.com/yogeshojha/rengine/commit/3d5f1724dd12cf9861443742e7d7c02ff8c75a6f - https://github.com/yogeshojha/rengine/commit/edd3c85ee16f93804ad38dac5602549d2d30a93e - https://github.com/yogeshojha/rengine/blob/53d9f505f04861a5040195ea71f20907ff90577a/web/api/views.py#L268-L275
CVE ID: CVE-2023-50096 State: PUBLISHED Published: 2024-01-01T00:00:00 Last Updated: 2024-09-09T17:21:45.294Z Vendors: n/a Products: n/a Problem Types: n/a Description: STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an adversary has the ability to read from and write to the I2C bus. This is caused by an StSafeA_ReceiveBytes buffer overflow in the X-CUBE-SAFEA1 Software Package for STSAFE-A sample applications (1.2.0), and thus can affect user-written code that was derived from a published sample application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/elttam/publications/blob/master/writeups
VE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/elttam/publications/blob/master/writeups/CVE-2023-50096.md
CVE ID: CVE-2023-50100 State: PUBLISHED Published: 2023-12-14T00:00:00 Last Updated: 2024-08-02T22:09:49.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Jarvis-616/cms/blob/master/There%20is%20a%20storage%20type%20XSS%20for%20carousel%20image%20editing.md
CVE ID: CVE-2023-50101 State: PUBLISHED Published: 2023-12-14T00:00:00 Last Updated: 2024-11-26T15:07:18.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Jarvis-616/cms/blob/master/Label%20management%20editing%20with%20stored%20XSS.md
CVE ID: CVE-2023-50102 State: PUBLISHED Published: 2023-12-14T00:00:00 Last Updated: 2024-08-02T22:09:49.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Jarvis-616/cms/blob/master/Content%20data%20exists%20in%20storage%20XSS%20for%20editing.md
CVE ID: CVE-2023-50104 State: PUBLISHED Published: 2023-12-28T00:00:00 Last Updated: 2024-08-02T22:09:49.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZZCMS 2023 has a file upload vulnerability in 3/E_bak5.1/upload/index.php, allowing attackers to exploit this loophole to gain server privileges and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zzq66/cve4
CVE ID: CVE-2023-50110 State: PUBLISHED Published: 2023-12-30T00:00:00 Last Updated: 2024-08-02T22:09:49.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: TestLink through 1.9.20 allows type juggling for authentication bypass because === is not used. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TestLinkOpenSourceTRMS/testlink-code/pull/357
CVE ID: CVE-2023-50119 State: REJECTED Published: N/A Last Updated: 2023-12-21T14:26:53.232644 Description: No description available.
CVE ID: CVE-2023-50120 State: PUBLISHED Published: 2024-01-10T00:00:00.000Z Last Updated: 2025-06-17T15:58:50.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: MP4Box GPAC version 2.3-DEV-rev636-gfbd7e13aa-master was discovered to contain an infinite loop in the function av1_uvlc at media_tools/av_parsers.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gpac/gpac/issues/2698
CVE ID: CVE-2023-50121 State: PUBLISHED Published: 2024-01-06T00:00:00.000Z Last Updated: 2025-04-17T18:32:25.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: Autel EVO NANO drone flight control firmware version 1.6.5 is vulnerable to denial of service (DoS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Drone-Lab/Reports-of-AUTEL-drones-losing-control-at-the-edge-of-the-no-fly-zone/tree/main
CVE ID: CVE-2023-50123 State: PUBLISHED Published: 2024-01-11T00:00:00.000Z Last Updated: 2025-06-20T16:13:24.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: The number of attempts to bring the Hozard Alarm system (alarmsystemen) v1.0 to a disarmed state is not limited. This could allow an attacker to perform a brute force on the SMS authentication, to bring the alarm system to a disarmed state. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices
CVE ID: CVE-2023-50124 State: PUBLISHED Published: 2024-01-11T00:00:00 Last Updated: 2024-09-03T18:27:44.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: Flient Smart Door Lock v1.0 is vulnerable to Use of Default Credentials. Due to default credentials on a debug interface, in combination with certain design choices, an attacker can unlock the Flient Smart Door Lock by replacing the fingerprint that is stored on the scanner. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices
CVE ID: CVE-2023-50125 State: PUBLISHED Published: 2024-01-11T00:00:00.000Z Last Updated: 2025-06-20T16:14:10.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: A default engineer password set on the Hozard alarm system (Alarmsysteem) v1.0 allows an attacker to bring the alarm system to a disarmed state. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices
CVE ID: CVE-2023-50126 State: PUBLISHED Published: 2024-01-11T00:00:00.000Z Last Updated: 2025-06-03T14:25:48.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: Missing encryption in the RFID tags of the Hozard alarm system (Alarmsysteem) v1.0 allow attackers to create a cloned tag via brief physical proximity to one of the original tags, which results in an attacker being able to bring the alarm system to a disarmed state. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices
CVE ID: CVE-2023-50127 State: PUBLISHED Published: 2024-01-11T00:00:00.000Z Last Updated: 2025-06-20T16:15:07.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hozard alarm system (Alarmsysteem) v1.0 is vulnerable to Improper Authentication. Commands sent via the SMS functionality are accepted from random phone numbers, which allows an attacker to bring the alarm system to a disarmed state from any given phone number. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices
CVE ID: CVE-2023-50128 State: PUBLISHED Published: 2024-01-11T00:00:00.000Z Last Updated: 2025-06-20T16:16:01.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: The remote keyless system of the Hozard alarm system (alarmsystemen) v1.0 sends an identical radio frequency signal for each request, which results in an attacker being able to conduct replay attacks to bring the alarm system to a disarmed state. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices - http://hozard.com
CVE ID: CVE-2023-50129 State: PUBLISHED Published: 2024-01-11T00:00:00.000Z Last Updated: 2025-06-20T16:16:49.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: Missing encryption in the NFC tags of the Flient Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original tags, which results in an attacker gaining access to the perimeter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices
CVE ID: CVE-2023-50136 State: PUBLISHED Published: 2024-01-09T00:00:00.000Z Last Updated: 2025-06-03T14:33:52.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new custom table. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/yukino-hiki/CVE/blob/main/2/There%20is%20a%20stored%20xss%20at%20the%20custom%20table.md
CVE ID: CVE-2023-50137 State: PUBLISHED Published: 2023-12-14T00:00:00 Last Updated: 2024-08-02T22:09:49.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yukino-hiki/CVE/blob/main/3/There%20is%20a%20storage%20type%20xss%20in%20the%20site%20management%20office.md
CVE ID: CVE-2023-50147 State: PUBLISHED Published: 2023-12-22T00:00:00 Last Updated: 2024-08-28T14:26:10.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an arbitrary command execution vulnerability in the setDiagnosisCfg function of the cstecgi .cgi of the TOTOlink A3700R router device in its firmware version V9.1.2u.5822_B20200513. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://815yang.github.io/2023/12/04/a3700r/TOTOlink%20A3700R%28setDiagnosisCfg%29/
CVE ID: CVE-2023-50159 State: PUBLISHED Published: 2024-01-11T00:00:00.000Z Last Updated: 2025-06-17T16:03:06.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ScaleFusion (Windows Desktop App) agent 10.5.2, Kiosk mode application restrictions can be bypassed allowing arbitrary code to be executed. This is fixed in 10.5.7 by preventing the launching of the file explorer in Agent-based Multi-App and Single App Kiosk mode. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/nestedif/vulnerability-disclosure-kiosk-mode-bypass-scalefusion-4752dfa2dc59 - https://medium.com/nestedif/vulnerability-disclosure-browser-mode-kios
sure-kiosk-mode-bypass-scalefusion-4752dfa2dc59 - https://medium.com/nestedif/vulnerability-disclosure-browser-mode-kiosk-bypass-scalefusion-832f5a18ebb6 - https://help.scalefusion.com/docs/security-advisory-for-windows-mdm-agent
CVE ID: CVE-2023-50162 State: PUBLISHED Published: 2024-01-08T00:00:00.000Z Last Updated: 2025-06-03T14:38:56.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in EmpireCMS v7.5, allows remote attackers to execute arbitrary code and obtain sensitive information via the DoExecSql function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Teresazdy/CVE
CVE ID: CVE-2023-50164 State: PUBLISHED Published: 2023-12-07T08:49:19.853Z Last Updated: 2025-03-14T03:55:16.463Z Vendors: Apache Software Foundation Products: Apache Struts Problem Types: CWE-552 Description: An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj - https://www.openwall.com/lis
nrichment: References: - https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj - https://www.openwall.com/lists/oss-security/2023/12/07/1 - http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html - https://security.netapp.com/advisory/ntap-20231214-0010/
CVE ID: CVE-2023-50165 State: PUBLISHED Published: 2024-01-31T17:21:04.235Z Last Updated: 2024-10-17T17:47:07.748Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: Pegasystems Products: Pega Platform Problem Types: CWE-918 Description: Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected by an Generated PDF issue that could expose file contents. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.pega.com/support-doc/pega-security-advisory-g23-vulnerability-remediation-note
CVE ID: CVE-2023-50166 State: PUBLISHED Published: 2024-01-31T17:26:42.731Z Last Updated: 2025-06-11T17:50:06.873Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Pegasystems Products: Pega Platform Problem Types: CWE-79 Description: Pega Platform from 8.5.4 to 8.8.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.pega.com/support-doc/pega-security-advisory-h23-vulnerability-remediation-note
CVE ID: CVE-2023-50167 State: PUBLISHED Published: 2024-03-06T17:15:08.248Z Last Updated: 2024-08-02T22:09:49.662Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Pegasystems Products: Pega Platform Problem Types: CWE-79 Description: Pega Platform from 7.1.7 to 23.1.1 is affected by an XSS issue with editing/rendering user html content. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.pega.com/support-doc/pega-security-advisory-i23-vulnerability-remediation-note
CVE ID: CVE-2023-50168 State: PUBLISHED Published: 2024-03-14T15:40:23.961Z Last Updated: 2024-08-02T22:09:49.636Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Pegasystems Products: Pega Platform Problem Types: CWE-611 Description: Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.pega.com/support-doc/pega-security-advisory-a24-vulnerability-remediation-note
CVE ID: CVE-2023-50170 State: REJECTED Published: N/A Last Updated: 2025-02-13T17:18:59.373Z Description: No description available.
CVE ID: CVE-2023-50172 State: PUBLISHED Published: 2024-01-10T15:48:08.638Z Last Updated: 2025-11-04T18:20:29.953Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: WWBN Products: AVideo Problem Types: CWE-640 Description: A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to the silent creation of a recovery pass code for any user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1897
CVE ID: CVE-2023-50174 State: REJECTED Published: N/A Last Updated: 2025-02-13T17:18:59.970Z Description: No description available.
CVE ID: CVE-2023-50175 State: PUBLISHED Published: 2023-12-26T07:21:15.728Z Last Updated: 2025-04-23T15:59:54.774Z Vendors: WESEEK, Inc. Products: GROWI Problem Types: Cross-site scripting (XSS) Description: Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and the Customize (/admin/customize) page of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://weseek.co.jp/ja/news/2023/11/21/growi-p
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/ - https://jvn.jp/en/jp/JVN18715935/
CVE ID: CVE-2023-50176 State: PUBLISHED Published: 2024-11-12T18:53:44.324Z Last Updated: 2024-11-13T18:31:27.279Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:X) Vendors: Fortinet Products: FortiOS Problem Types: CWE-384 Description: A session fixation in Fortinet FortiOS version 7.4.0 through 7.4.3 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or commands via phishing SAML authentication link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-475
CVE ID: CVE-2023-50178 State: PUBLISHED Published: 2024-07-09T15:33:32.203Z Last Updated: 2024-08-02T22:09:49.750Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:F/RL:U/RC:C) Vendors: Fortinet Products: FortiADC Problem Types: CWE-295 Description: An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2.0 through 7.2.3, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions and 6.0 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and various remote servers such as private SDN connectors and FortiToken Cloud. Additional Analyst Not
etween the device and various remote servers such as private SDN connectors and FortiToken Cloud. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.fortinet.com/psirt/FG-IR-22-298
CVE ID: CVE-2023-50179 State: PUBLISHED Published: 2024-07-09T15:33:27.266Z Last Updated: 2024-08-02T22:09:49.647Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:F/RL:U/RC:C) Vendors: Fortinet Products: FortiADC Problem Types: CWE-295 Description: An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2 all versions, 7.1 all versions, 7.0 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and public SDN connectors. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.fortinet.com/psirt/FG-IR
alyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-480
CVE ID: CVE-2023-50180 State: PUBLISHED Published: 2024-05-14T16:19:13.773Z Last Updated: 2024-08-02T22:09:49.697Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiADC Problem Types: CWE-497 Description: An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiADC version 7.4.1 and below, version 7.2.3 and below, version 7.1.4 and below, version 7.0.5 and below, version 6.2.6 and below may allow a read-only admin to view data pertaining to other admins. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt
. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-433
CVE ID: CVE-2023-50181 State: PUBLISHED Published: 2024-07-09T15:33:31.910Z Last Updated: 2024-08-02T22:09:49.954Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiADC Problem Types: CWE-284 Description: An improper access control vulnerability [CWE-284] in Fortinet FortiADC version 7.4.0 through 7.4.1 and before 7.2.4 allows a read only authenticated attacker to perform some write actions via crafted HTTP or HTTPS requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-469
CVE ID: CVE-2023-50182 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:04.110Z Description: No description available.
CVE ID: CVE-2023-50183 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:03.651Z Description: No description available.
CVE ID: CVE-2023-50184 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:03.210Z Description: No description available.
CVE ID: CVE-2023-50185 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:02.742Z Description: No description available.
CVE ID: CVE-2023-50186 State: PUBLISHED Published: 2024-05-03T02:14:13.976Z Last Updated: 2024-08-02T22:09:49.773Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GStreamer Products: GStreamer Problem Types: CWE-121 Description: GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of metadata within AV1 encoded video files. The issue result
implementation. The specific flaw exists within the parsing of metadata within AV1 encoded video files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22300. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-368/ - https://gstreamer.freedesktop.org/security/sa-2023-0011.html