Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-32186 State: PUBLISHED Published: 2023-09-19T09:32:49.121Z Last Updated: 2024-09-25T14:50:27.689Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SUSE Products: RKE2 Problem Types: CWE-770 Description: A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supervisor port (TCP 6443) cause denial of service. This issue affects RKE2: from 1.24.0 before 1.24.17+rke2r1, from v1.25.0 before v1.25.13+rke2r1, from v1.26.0 before v1.26.8+rke2r1, from v1.27.0 before v1.27.5+rke2r1, from v1.28.0 before v1.28.1+rke2r1. Additional Analyst Notes: - CVE Program Container: - CIS
27.0 before v1.27.5+rke2r1, from v1.28.0 before v1.28.1+rke2r1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rancher/rke2/security/advisories/GHSA-p45j-vfv5-wprq - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32186
CVE ID: CVE-2023-32187 State: PUBLISHED Published: 2023-09-18T12:04:27.767Z Last Updated: 2024-09-25T20:48:50.658Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SUSE Products: k3s Problem Types: CWE-770 Description: An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port (TCP 6443) cause denial of service. This issue affects k3s: from v1.24.0 before v1.24.17+k3s1, from v1.25.0 before v1.25.13+k3s1, from v1.26.0 before v1.26.8+k3s1, from sev1.27.0 before v1.27.5+k3s1, from v1.28.0 before v1.28.1+k3s1. Additional Analyst Notes: - CVE Program Container: - CISA ADP V
0 before v1.27.5+k3s1, from v1.28.0 before v1.28.1+k3s1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32187https:// - https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2
CVE ID: CVE-2023-32188 State: PUBLISHED Published: 2024-10-16T08:25:59.699Z Last Updated: 2024-10-16T17:25:54.710Z Vendors: SUSE Products: neuvector Problem Types: CWE-1270 Description: A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32188 - https://github.com/neuvector/neuvector/security/advisories/GHSA-622h-h2p8-743x
CVE ID: CVE-2023-32189 State: PUBLISHED Published: 2024-10-16T13:48:39.236Z Last Updated: 2024-10-29T19:27:29.996Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: SUSE Products: SUSE Manager Server Module 4.3 Description: Insecure handling of ssh keys used to bootstrap clients allows local attackers to potentially gain access to the keys Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32189
CVE ID: CVE-2023-32190 State: PUBLISHED Published: 2024-10-16T12:03:05.078Z Last Updated: 2025-03-19T14:39:07.458Z Vendors: SUSE Products: openSUSE Tumbleweed Description: mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable by abusing insecure file operations that run with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32190
CVE ID: CVE-2023-32191 State: PUBLISHED Published: 2024-10-16T12:17:02.324Z Last Updated: 2024-10-16T15:58:10.698Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SUSE Products: rke Problem Types: CWE-922 Description: When RKE provisions a cluster, it stores the cluster state in a configmap called `full-cluster-state` inside the `kube-system` namespace of the cluster itself. The information available in there allows non-admin users to escalate to admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32191 - https://github.com/rancher/rke/security/advisories/GHSA-6gr4-52w6-vmqx
CVE ID: CVE-2023-32192 State: PUBLISHED Published: 2024-10-16T12:23:17.271Z Last Updated: 2024-10-16T17:25:48.514Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: SUSE Products: apiserver Problem Types: CWE-80 Description: A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in the API Server's public API endpoint can be exploited, allowing an attacker to execute arbitrary JavaScript code in the victim browser Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32192 - https://github.com/rancher/apiserver/security/advisories/GHSA-833m-37f7-jq55
CVE ID: CVE-2023-32193 State: PUBLISHED Published: 2024-10-16T12:27:13.591Z Last Updated: 2024-10-16T16:23:57.223Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: SUSE Products: norman Problem Types: CWE-80 Description: A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman's public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32193 - https://github.com/rancher/norman/security/advisories/GHSA-r8f4-hv23-6
ugzilla.suse.com/show_bug.cgi?id=CVE-2023-32193 - https://github.com/rancher/norman/security/advisories/GHSA-r8f4-hv23-6qp6
CVE ID: CVE-2023-32194 State: PUBLISHED Published: 2024-10-16T12:56:37.617Z Last Updated: 2024-10-16T17:25:32.070Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SUSE Products: rancher Problem Types: CWE-269 Description: A vulnerability has been identified when granting a create or * global role for a resource type of "namespaces"; no matter the API group, the subject will receive * permissions for core namespaces. This can lead to someone being capable of accessing, creating, updating, or deleting a namespace in the project. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32194 - https://git
yst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32194 - https://github.com/rancher/rancher/security/advisories/GHSA-c85r-fwc7-45vc
CVE ID: CVE-2023-32196 State: PUBLISHED Published: 2024-10-16T13:01:47.230Z Last Updated: 2024-10-16T16:00:35.764Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SUSE Products: rancher Problem Types: CWE-269 Description: A vulnerability has been identified whereby privilege escalation checks are not properly enforced for RoleTemplateobjects when external=true, which in specific scenarios can lead to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32196 - https://github.com/rancher/rancher/security/advisories/GHSA-64jq-m7rq-768h
CVE ID: CVE-2023-32197 State: PUBLISHED Published: 2025-04-16T08:40:54.464Z Last Updated: 2025-04-18T03:55:39.538Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SUSE Products: rancher Problem Types: CWE-269 Description: A Improper Privilege Management vulnerability in SUSE rancher in RoleTemplateobjects when external=true is set can lead to privilege escalation in specific scenarios.This issue affects rancher: from 2.7.0 before 2.7.14, from 2.8.0 before 2.8.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32197 - https://github.com/rancher/rancher/security/advisories/GHSA-64jq-m7rq-768h
CVE ID: CVE-2023-32199 State: PUBLISHED Published: 2025-10-29T14:54:04.162Z Last Updated: 2025-10-29T15:26:02.274Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: SUSE Products: rancher Problem Types: CWE-281 Description: A vulnerability has been identified within Rancher Manager, where after removing a custom GlobalRole that gives administrative access or the corresponding binding, the user still retains access to clusters. This only affects custom Global Roles that have a * on * in * rule for resources or have a * on * rule for non-resource URLs Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2
ce URLs Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32199 - https://github.com/rancher/rancher/security/advisories/GHSA-j4vr-pcmw-hx59
CVE ID: CVE-2023-32200 State: PUBLISHED Published: 2023-07-12T07:49:55.432Z Last Updated: 2024-10-07T19:42:49.706Z Vendors: Apache Software Foundation Products: Apache Jena Problem Types: CWE-917 Description: There is insufficient restrictions of called script functions in Apache Jena versions 4.8.0 and earlier. It allows a remote user to execute javascript via a SPARQL query. This issue affects Apache Jena: from 3.7.0 through 4.8.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cve.org/CVERecord?id=CVE-2023-22665 - https://lists.apache.org/thread/7hg0t2kws3fyr75dl7lll8389xzzc46z
CVE ID: CVE-2023-32201 State: PUBLISHED Published: 2023-06-19T00:00:00 Last Updated: 2024-12-23T21:33:25.974Z Vendors: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. Products: TELLUS and TELLUS Lite Problem Types: Stack-based Buffer Overflow Description: Stack-based buffer overflow vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. Opening a specially crafted SIM2 file may lead to information disclosure and/or arbitrary code execution. This vulnerability is different from CVE-2023-32538 and CVE-2023-32273. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.ph
ntainer: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php - https://jvn.jp/en/vu/JVNVU98818508/
CVE ID: CVE-2023-32202 State: PUBLISHED Published: 2023-08-23T21:18:39.418Z Last Updated: 2024-09-30T19:13:33.969Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Walchem Products: Intuition 9 Problem Types: CWE-287 Description: Walchem Intuition 9 firmware versions prior to v4.21 are vulnerable to improper authentication. Login credentials are stored in a format that could allow an attacker to use them as-is to login and gain access to the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-229-04
CVE ID: CVE-2023-32203 State: PUBLISHED Published: 2023-06-06T16:23:54.359Z Last Updated: 2025-01-07T18:45:37.744Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Horner Automation Products: Cscape, Cscape EnvisionRV Problem Types: CWE-787 Description: Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-bounds write at CScape_EnvisionRV+0x2e374b. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-even
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04
CVE ID: CVE-2023-32204 State: PUBLISHED Published: 2023-11-14T19:05:00.372Z Last Updated: 2024-08-14T20:08:29.570Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) OFU software Problem Types: escalation of privilege, CWE-284 Description: Improper access control in some Intel(R) OFU software before version 14.1.31 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00900.html
CVE ID: CVE-2023-32205 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-05-27T16:53:11.148Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Browser prompts could have been obscured by popups Description: In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1753339 - https://bugzilla.mozilla.org/show_bug.cgi?id=1753341 - https://security.gento
illa.mozilla.org/show_bug.cgi?id=1753339 - https://bugzilla.mozilla.org/show_bug.cgi?id=1753341 - https://security.gentoo.org/glsa/202312-03 - https://security.gentoo.org/glsa/202401-10 - https://www.mozilla.org/security/advisories/mfsa2023-16/ - https://www.mozilla.org/security/advisories/mfsa2023-17/ - https://www.mozilla.org/security/advisories/mfsa2023-18/
CVE ID: CVE-2023-32206 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-05-27T16:53:11.734Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Crash in RLBox Expat driver Description: An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1824892 - https://security.gentoo.org/glsa/202312-03 - https://security.gentoo.org/glsa/202401-10 - https://www.mozilla.org/security/advisories/mfsa2023-16/ - https://www.mozilla.org/security/advisor
org/glsa/202401-10 - https://www.mozilla.org/security/advisories/mfsa2023-16/ - https://www.mozilla.org/security/advisories/mfsa2023-17/ - https://www.mozilla.org/security/advisories/mfsa2023-18/
CVE ID: CVE-2023-32207 State: PUBLISHED Published: 2023-06-02T00:00:00.000Z Last Updated: 2025-05-27T16:53:12.234Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Potential permissions request bypass via clickjacking Description: A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1826116 - https://security.gentoo.org/glsa/202312-03 - https://security.gentoo.org/glsa/202
.mozilla.org/show_bug.cgi?id=1826116 - https://security.gentoo.org/glsa/202312-03 - https://security.gentoo.org/glsa/202401-10 - https://www.mozilla.org/security/advisories/mfsa2023-16/ - https://www.mozilla.org/security/advisories/mfsa2023-17/ - https://www.mozilla.org/security/advisories/mfsa2023-18/
CVE ID: CVE-2023-32208 State: PUBLISHED Published: 2023-06-19T09:30:32.314Z Last Updated: 2025-05-27T16:53:15.666Z Vendors: Mozilla Products: Firefox Problem Types: Leak of script base URL in service workers via import() Description: Service workers could reveal script base URL due to dynamic `import()`. This vulnerability affects Firefox < 113. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1646034 - https://security.gentoo.org/glsa/202401-10 - https://www.mozilla.org/security/advisories/mfsa2023-16/
CVE ID: CVE-2023-32209 State: PUBLISHED Published: 2023-06-19T09:36:11.768Z Last Updated: 2025-05-27T16:53:16.158Z Vendors: Mozilla Products: Firefox Problem Types: Persistent DoS via favicon image Description: A maliciously crafted favicon could have led to an out of memory crash. This vulnerability affects Firefox < 113. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1767194 - https://security.gentoo.org/glsa/202401-10 - https://www.mozilla.org/security/advisories/mfsa2023-16/
CVE ID: CVE-2023-32210 State: PUBLISHED Published: 2023-06-19T09:37:25.092Z Last Updated: 2025-05-27T16:53:16.609Z Vendors: Mozilla Products: Firefox Problem Types: Incorrect principal object ordering Description: Documents were incorrectly assuming an ordering of principal objects when ensuring we were loading an appropriately privileged principal. In certain circumstances it might have been possible to cause a document to be loaded with a higher privileged principal than intended. This vulnerability affects Firefox < 113. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1776755 - https://security.gentoo.org/glsa/202401-10 - https
References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1776755 - https://security.gentoo.org/glsa/202401-10 - https://www.mozilla.org/security/advisories/mfsa2023-16/
CVE ID: CVE-2023-32211 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-05-27T16:53:12.745Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Content process crash due to invalid wasm code Description: A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1823379 - https://security.gentoo.org/glsa/202312-03 - https://security.gentoo.org/glsa/202401-10 - https://www.mozilla.org/security/advisories/mfsa2023-16/ - htt
/202312-03 - https://security.gentoo.org/glsa/202401-10 - https://www.mozilla.org/security/advisories/mfsa2023-16/ - https://www.mozilla.org/security/advisories/mfsa2023-17/ - https://www.mozilla.org/security/advisories/mfsa2023-18/
CVE ID: CVE-2023-32212 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-05-27T16:53:13.344Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Potential spoof due to obscured address bar Description: An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1826622 - https://security.gentoo.org/glsa/202312-03 - https://security.gentoo.org/glsa/202401-10 - https://www.mozilla.org/security/advisories/mfsa2
ntoo.org/glsa/202312-03 - https://security.gentoo.org/glsa/202401-10 - https://www.mozilla.org/security/advisories/mfsa2023-16/ - https://www.mozilla.org/security/advisories/mfsa2023-17/ - https://www.mozilla.org/security/advisories/mfsa2023-18/
CVE ID: CVE-2023-32213 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-05-27T16:53:13.932Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Potential memory corruption in FileReader::DoReadData() Description: When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1826666 - https://security.gentoo.org/glsa/202312-03 - https://security.gentoo.org/glsa/202401-10 - https://www.mozilla.org/security/advisories/mfsa2023-16/ - https:
2312-03 - https://security.gentoo.org/glsa/202401-10 - https://www.mozilla.org/security/advisories/mfsa2023-16/ - https://www.mozilla.org/security/advisories/mfsa2023-17/ - https://www.mozilla.org/security/advisories/mfsa2023-18/
CVE ID: CVE-2023-32214 State: PUBLISHED Published: 2023-06-19T09:38:56.644Z Last Updated: 2025-05-27T16:53:14.473Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Potential DoS via exposed protocol handlers Description: Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service. *Note: This attack only affects Windows. Other operating systems are not affected.* This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1828716 - https://security.gentoo.org/glsa/202312-03 - https://se
rences: - https://bugzilla.mozilla.org/show_bug.cgi?id=1828716 - https://security.gentoo.org/glsa/202312-03 - https://security.gentoo.org/glsa/202401-10 - https://www.mozilla.org/security/advisories/mfsa2023-16/ - https://www.mozilla.org/security/advisories/mfsa2023-17/ - https://www.mozilla.org/security/advisories/mfsa2023-18/
CVE ID: CVE-2023-32215 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-05-27T16:53:14.999Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 Description: Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 113, Firefox E
ffort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1540883%2C1751943%2C1814856%2C1820210%2C1821480%2C1827019%2C1827024%2C1827144%2C1827359%2C1830186 - https://security.gentoo.org/glsa/202312-03 - https://security.gentoo.org/glsa/202401-10 - https://www.mozilla.org/security/advisories/mfsa2023-16/ - https://www.mozilla.org/security/advisories/mfsa2023-17/ - https://www.mozilla.org/security/advisories/mfsa2023-18/
CVE ID: CVE-2023-32216 State: PUBLISHED Published: 2023-06-19T09:42:17.546Z Last Updated: 2025-05-27T16:53:17.147Z Vendors: Mozilla Products: Firefox Problem Types: Memory safety bugs fixed in Firefox 113 Description: Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 113. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1
113. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1746479%2C1806852%2C1815987%2C1820359%2C1823568%2C1824803%2C1824834%2C1825170%2C1827020%2C1828130 - https://security.gentoo.org/glsa/202401-10 - https://www.mozilla.org/security/advisories/mfsa2023-16/
CVE ID: CVE-2023-32217 State: PUBLISHED Published: 2023-05-31T00:00:00 Last Updated: 2025-01-10T15:40:35.132Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: SailPoint Products: IdentityIQ Problem Types: CWE-470 Description: IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke a Java constructor with no arguments or a Java constructor with a single Map argument in any Java class available in the IdentityIQ application classpath. Additional Analyst Notes: