Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Software Collections for Red Hat Enterprise Linux 7, RHACS-3.74-RHEL-8, RHACS-4.1-RHEL-8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Software Collections Problem Types: CWE-89 Description: IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting constr
ion vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:7545 - https://access.redhat.com/errata/RHSA-2023:7579 - https://access.redhat.com/errata/RHSA-2023:7580 - https://access.redhat.com/errata/RHSA-2023:7581 - https://access.redhat.com/errata/RHSA-2023:7616 - https://access
580 - https://access.redhat.com/errata/RHSA-2023:7581 - https://access.redhat.com/errata/RHSA-2023:7616 - https://access.redhat.com/errata/RHSA-2023:7656 - https://access.redhat.com/errata/RHSA-2023:7666 - https://access.redhat.com/errata/RHSA-2023:7667 - https://access.redhat.com/errata/RHSA-2023:7694 - https://access.redhat.com/errata/RHSA-2023:7695 - https://access.redhat.com/errata/RHSA-2023:7714 - https://access.redhat.com/errata/RHSA-2023:7770 - https://access.redhat.com/errata/RHSA-2023:7772 - https://access.redhat.com/errata/RHSA-2023:7784 - https://access.redhat.com/errata/RHSA-2023:7785 - https://access.redhat.com/errata/RHSA-2023:7883 - https://access.redhat.com/errata/RHSA-2023:7
m/errata/RHSA-2023:7785 - https://access.redhat.com/errata/RHSA-2023:7883 - https://access.redhat.com/errata/RHSA-2023:7884 - https://access.redhat.com/errata/RHSA-2023:7885 - https://access.redhat.com/errata/RHSA-2024:0304 - https://access.redhat.com/errata/RHSA-2024:0332 - https://access.redhat.com/errata/RHSA-2024:0337 - https://access.redhat.com/security/cve/CVE-2023-39417 - https://bugzilla.redhat.com/show_bug.cgi?id=2228111 - https://www.postgresql.org/support/security/CVE-2023-39417
CVE ID: CVE-2023-39418 State: PUBLISHED Published: 2023-08-11T12:19:15.819Z Last Updated: 2025-11-21T07:05:52.288Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Software Collections Problem Types: CWE-1220 Description: A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid
ails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2023:7785 - https://access.redhat.com/errata/RHSA-2023:7883 - https://access.redhat.com/errata/RHSA-2023:7884 - https://access.redhat.com/errata/RHSA-2023:7885 - https://access.redhat.com/security/cve/CVE-2023-39418 - https://bugzilla.redhat.com/show_bug.cgi?id=2228112 - https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff
gi?id=2228112 - https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229 - https://www.postgresql.org/support/security/CVE-2023-39418/
CVE ID: CVE-2023-39419 State: PUBLISHED Published: 2023-08-08T09:21:00.284Z Last Updated: 2024-10-11T22:13:18.252Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Solid Edge SE2023 Problem Types: CWE-787 Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bounds write past the end of an allocated structure while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-po
rrent process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-811403.pdf
CVE ID: CVE-2023-39420 State: PUBLISHED Published: 2023-09-07T12:17:09.872Z Last Updated: 2024-09-26T19:15:02.834Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Resort Data Processing, Inc. Products: IRM Next Generation Problem Types: CWE-798 Description: The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" account and a corresponding password computed daily by a routine inside the DLL file. Once reverse-engineered, this routine can help an attacker generate the daily password and connect to application customers. Given that this is an administrative account, anyone logg
erate the daily password and connect to application customers. Given that this is an administrative account, anyone logging into a customer deployment has full, unrestricted access to the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained/
CVE ID: CVE-2023-39421 State: PUBLISHED Published: 2023-09-07T12:19:18.313Z Last Updated: 2024-09-26T19:30:24.601Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Resort Data Processing, Inc. Products: IRM Next Generation Problem Types: CWE-798 Description: The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services such as Twilio and Vonage. These keys allow unrestricted interaction with these services. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booki
ulnrichment: References: - https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained
CVE ID: CVE-2023-39422 State: PUBLISHED Published: 2023-09-07T12:22:52.239Z Last Updated: 2024-09-26T19:12:52.811Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Resort Data Processing, Inc. Products: IRM Next Generation Problem Types: CWE-798 Description: The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are however exposed in a JavaScript file loaded on the client side, thus rendering this extra safety mechanism useless. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bitdefender.com/blog/labs/check-out-with-extra-charges-vu
gram Container: - CISA ADP Vulnrichment: References: - https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained
CVE ID: CVE-2023-39423 State: PUBLISHED Published: 2023-09-07T12:24:41.564Z Last Updated: 2024-09-26T19:12:27.878Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Resort Data Processing, Inc. Products: IRM Next Generation Problem Types: CWE-89 Description: The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator, an attacker can leak the sessions table, obtain the currently valid sessions and impersonate a currently logged-in user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bitdefender.com/blog/labs/check-out-with-extra-char
VE Program Container: - CISA ADP Vulnrichment: References: - https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained
CVE ID: CVE-2023-39424 State: PUBLISHED Published: 2023-09-07T12:25:42.733Z Last Updated: 2024-09-26T19:11:57.436Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Resort Data Processing, Inc. Products: IRM Next Generation Problem Types: CWE-74 Description: A vulnerability in RDPngFileUpload.dll, as used in the IRM Next Generation booking system, allows a remote attacker to upload arbitrary content (such as a web shell component) to the SQL database and execute it with SYSTEM privileges. This vulnerability requires authentication to be exploited but can be paired with another vulnerability in the platform (CVE-2023-39420, which grants access to hardcoded cr
loited but can be paired with another vulnerability in the platform (CVE-2023-39420, which grants access to hardcoded credentials) to carry the attack without having assigned credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained
CVE ID: CVE-2023-39425 State: PUBLISHED Published: 2024-02-14T13:38:09.371Z Last Updated: 2024-08-15T15:52:13.212Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) DSA software Problem Types: escalation of privilege, CWE-284 Description: Improper access control in some Intel(R) DSA software before version 23.4.33 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00969.html
CVE ID: CVE-2023-39427 State: PUBLISHED Published: 2023-10-26T19:29:07.108Z Last Updated: 2025-01-16T21:27:53.916Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Cobalt, Xenon, Argon, Lithium, Cobalt Share Problem Types: CWE-787 Description: In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77), the affected applications lack proper validation of user-supplied data when parsing XE files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP V
te arbitrary code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-03
CVE ID: CVE-2023-39429 State: PUBLISHED Published: 2023-10-03T00:14:18.187Z Last Updated: 2024-09-20T18:32:39.836Z Vendors: FURUNO SYSTEMS Co.,Ltd. Products: ACERA 1210, ACERA 1150i, ACERA 1150w, ACERA 1110, ACERA 1020, ACERA 1010, ACERA 950, ACERA 850F, ACERA 900, ACERA 850M, ACERA 810, ACERA 800ST Problem Types: Cross-site scripting (XSS) Description: Cross-site scripting vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to inject an arbitrary script via a crafted configuration. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and
ERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.furunosystems.co.jp/news/
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.furunosystems.co.jp/news/info/vulner20231002.html - https://jvn.jp/en/vu/JVNVU94497038/
CVE ID: CVE-2023-39431 State: PUBLISHED Published: 2023-10-19T17:32:35.355Z Last Updated: 2025-01-16T21:28:59.360Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Santesoft Products: Sante DICOM Viewer Pro Problem Types: CWE-787 Description: Sante DICOM Viewer Pro lacks proper validation of user-supplied data when parsing DICOM files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-285-01
CVE ID: CVE-2023-39432 State: PUBLISHED Published: 2024-02-14T13:38:14.830Z Last Updated: 2024-08-06T17:22:00.999Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Ethernet tools and driver install software, Problem Types: escalation of privilege, CWE-284 Description: Improper access control element in some Intel(R) Ethernet tools and driver install software, before versions 28.2, may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-
ainer: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00993.html
CVE ID: CVE-2023-39433 State: PUBLISHED Published: 2024-05-16T20:47:30.516Z Last Updated: 2024-08-02T18:10:20.816Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: n/a Products: Intel(R) CST software Problem Types: escalation of privilege, CWE-284 Description: Improper access control for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01021.html
CVE ID: CVE-2023-39434 State: PUBLISHED Published: 2023-09-26T20:14:45.109Z Last Updated: 2025-05-02T17:46:48.633Z Vendors: Apple Products: iOS and iPadOS, macOS, watchOS Problem Types: Processing web content may lead to arbitrary code execution Description: A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213938 - https://support.apple.com/en-us/HT213940 - https://support.apple.com/en-us/HT213937 - http://www.openwa
en-us/HT213938 - https://support.apple.com/en-us/HT213940 - https://support.apple.com/en-us/HT213937 - http://www.openwall.com/lists/oss-security/2023/09/28/3 - http://seclists.org/fulldisclosure/2023/Oct/8 - http://seclists.org/fulldisclosure/2023/Oct/9 - http://seclists.org/fulldisclosure/2023/Oct/3 - https://security.gentoo.org/glsa/202401-33
CVE ID: CVE-2023-39435 State: PUBLISHED Published: 2023-11-08T22:54:00.819Z Last Updated: 2025-01-16T21:26:22.506Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Zavio Products: IP Camera CF7500, IP Camera CF7300, IP Camera CF7201, IP Camera CF7501, IP Camera CB3211, IP Camera CB3212, IP Camera CB5220, IP Camera CB6231, IP Camera B8520, IP Camera B8220, IP Camera CD321 Problem Types: CWE-121 Description: Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to stack-based overflows. During the process of updating certain settings sent from incoming network reques
e vulnerable to stack-based overflows. During the process of updating certain settings sent from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03
CVE ID: CVE-2023-39436 State: PUBLISHED Published: 2023-08-08T00:48:18.892Z Last Updated: 2024-10-15T20:13:19.519Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Supplier Relationship Management Problem Types: CWE-306 Description: SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to SRM within Vendor Master Data for Business Partners replication functionality.This information could be used to allow the attacker to specialize their attacks against SRM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
ialize their attacks against SRM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/2067220 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-39437 State: PUBLISHED Published: 2023-08-08T00:48:38.640Z Last Updated: 2024-10-11T22:21:09.655Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: SAP_SE Products: SAP Business One Problem Types: CWE-79 Description: SAP business One allows - version 10.0, allows an attacker to insert malicious code into the content of a web page or application and gets it delivered to the client, resulting to Cross-site scripting. This could lead to harmful action affecting the Confidentiality, Integrity and Availability of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3358300
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3358300 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-39438 State: PUBLISHED Published: 2023-08-15T16:23:58.888Z Last Updated: 2024-10-08T20:18:54.236Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: SAP_SE Products: CLA Assistant Problem Types: CWE-862 Description: A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including information of the persons who signed them as well as custom fields the CLA requester had configured. In addition, an arbitrary authenticated user can update or delete the CLA-configuratio
the CLA requester had configured. In addition, an arbitrary authenticated user can update or delete the CLA-configuration for repositories or organizations using CLA-assistant. The stored access tokens for GitHub are not affected, as these are redacted from the API-responses. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cla-assistant/cla-assistant/security/advisories/GHSA-gw8p-frwv-25gh
CVE ID: CVE-2023-39439 State: PUBLISHED Published: 2023-08-08T00:49:01.594Z Last Updated: 2025-02-27T21:10:56.748Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP Commerce Problem Types: CWE-258 Description: SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3346500 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-39440 State: PUBLISHED Published: 2023-08-08T00:49:17.862Z Last Updated: 2024-10-08T16:25:51.455Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP BusinessObjects Business Intelligence Problem Types: CWE-312 Description: In SAP BusinessObjects Business Intelligence - version 420, If a user logs in to a particular program, under certain specific conditions memory might not be cleared up properly, due to which attacker might be able to get access to user credentials. For a successful attack, the attacker needs to have local access to the system. There is no impact on availability and integrity. Additional Analyst Notes: - C
eeds to have local access to the system. There is no impact on availability and integrity. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3312586 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-39441 State: PUBLISHED Published: 2023-08-23T15:39:51.632Z Last Updated: 2025-02-13T17:03:05.348Z Vendors: Apache Software Foundation Products: Apache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow Problem Types: CWE-295 Description: Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate vulnerability. The default SSL context with SSL library did not check a server's X.509 certificate. Instead, the code accepted any certificate, which could result in the disclosure of mail server credentials or mail contents when the client connects to an
ficate, which could result in the disclosure of mail server credentials or mail contents when the client connects to an attacker in a MITM position. Users are strongly advised to upgrade to Apache Airflow version 2.7.0 or newer, Apache Airflow IMAP Provider version 3.3.0 or newer, and Apache Airflow SMTP Provider version 1.3.0 or newer to mitigate the risk associated with this vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/33075 - https://github.com/apache/airflow/pull/33108 - https://github.com/apache/airflow/pull/33070 - https://lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb - http://w
tps://github.com/apache/airflow/pull/33070 - https://lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb - http://www.openwall.com/lists/oss-security/2023/08/23/2
CVE ID: CVE-2023-39443 State: PUBLISHED Published: 2024-01-08T14:47:40.394Z Last Updated: 2025-11-04T18:16:32.359Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-119 Description: Multiple out-of-bounds write vulnerabilities exist in the LXT2 parsing functionality of GTKWave 3.3.115. A specially-crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write perfomed by the prefix copy loop. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosin
fix copy loop. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1826 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html