Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-49492 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-10-09T14:56:09.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the imgstick parameter at selectimages.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Hebing123/cve/issues/2
CVE ID: CVE-2023-49493 State: PUBLISHED Published: 2023-12-07T00:00:00.000Z Last Updated: 2025-05-28T15:20:04.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the v parameter at selectimages.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Hebing123/cve/issues/2
CVE ID: CVE-2023-49494 State: PUBLISHED Published: 2023-12-11T00:00:00 Last Updated: 2024-08-02T21:53:45.405Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select_media_post_wangEditor.php. Additional Analyst Notes: - CVE Program Container: References: - http://dedecms.com - https://github.com/Hebing123/cve/issues/3
CVE ID: CVE-2023-49501 State: PUBLISHED Published: 2024-04-19T00:00:00.000Z Last Updated: 2025-11-04T17:13:09.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/FFmpeg/FFmpeg - https://trac.ffmpeg.org/ticket/10686#no1 - https://trac.ffmpeg.org/ticket/10686 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEP
tps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/
CVE ID: CVE-2023-49502 State: PUBLISHED Published: 2024-04-19T00:00:00.000Z Last Updated: 2025-11-04T17:13:13.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/FFmpeg/FFmpeg - https://trac.ffmpeg.org/ticket/10688 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/ - https://lists.fedoraproject.or
st/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/
CVE ID: CVE-2023-49508 State: PUBLISHED Published: 2024-02-16T00:00:00.000Z Last Updated: 2025-03-27T14:56:06.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in YetiForceCompany YetiForceCRM versions 6.4.0 and before allows a remote authenticated attacker to obtain sensitive information via the license parameter in the LibraryLicense.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/29ed641d-eb03-4532-aed4-f96e11f78983/ - https://github.com/YetiForceCompany/YetiForceCRM/commit/ba3a348aa6ecdf0a1d8b289cbb679bebcda7a132 - https://github.com/c4v4r0n/Research/tree/ma
iForceCompany/YetiForceCRM/commit/ba3a348aa6ecdf0a1d8b289cbb679bebcda7a132 - https://github.com/c4v4r0n/Research/tree/main/CVE-2023-49508
CVE ID: CVE-2023-49515 State: PUBLISHED Published: 2024-01-17T00:00:00 Last Updated: 2024-08-02T22:01:24.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware v.1.3.4 and fixed in v.1.3.11 allows a physically proximate attacker to obtain sensitive information via a connection to the UART pin components. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/VineethKumarM/TAPO-TC70-Unauthorized-root-access-using-UART/tree/master - https://github.com/VineethKumarM/TAPO-TC70-Unauthorized-root-access-using-UART
CVE ID: CVE-2023-49528 State: PUBLISHED Published: 2024-04-12T00:00:00.000Z Last Updated: 2025-11-04T17:13:17.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://trac.ffmpeg.org/ticket/10691 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/ - https://lists.fedoraproject.org/archives/list/pa
e%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/
CVE ID: CVE-2023-49539 State: PUBLISHED Published: 2024-03-01T00:00:00 Last Updated: 2024-11-06T19:36:46.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/category. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the category parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://owasp.org/www-community/attacks/xss/ - https://www.sourcecodester.com/php/15748/book-store-management-system-project-using-php-codeigniter-3-free-source-code.htm
tps://www.sourcecodester.com/php/15748/book-store-management-system-project-using-php-codeigniter-3-free-source-code.html - https://owasp.org/Top10/A03_2021-Injection/ - https://github.com/geraldoalcantara/CVE-2023-49539
CVE ID: CVE-2023-49540 State: PUBLISHED Published: 2024-03-01T00:00:00 Last Updated: 2024-08-06T15:23:44.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/history. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the history parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://owasp.org/www-community/attacks/xss/ - https://www.sourcecodester.com/php/15748/book-store-management-system-project-using-php-codeigniter-3-free-source-code.html
s://www.sourcecodester.com/php/15748/book-store-management-system-project-using-php-codeigniter-3-free-source-code.html - https://owasp.org/Top10/A03_2021-Injection/ - https://github.com/geraldoalcantara/CVE-2023-49540
CVE ID: CVE-2023-49543 State: PUBLISHED Published: 2024-03-01T00:00:00 Last Updated: 2024-08-28T19:55:35.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in Book Store Management System v1 allows attackers to access unauthorized pages and execute administrative functions without authenticating. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/15748/book-store-management-system-project-using-php-codeigniter-3-free-source-code.html - https://owasp.org/Top10/A01_2021-Broken_Access_Control/ - https://github.com/geraldoalcantara/CVE-2023-49543
CVE ID: CVE-2023-49544 State: PUBLISHED Published: 2024-03-01T00:00:00 Last Updated: 2024-08-02T22:01:24.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: A local file inclusion (LFI) in Customer Support System v1 allows attackers to include internal PHP files and gain unauthorized acces via manipulation of the page= parameter at /customer_support/index.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html - https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testin
rg/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion - https://github.com/geraldoalcantara/CVE-2023-49544
CVE ID: CVE-2023-49545 State: PUBLISHED Published: 2024-03-01T00:00:00 Last Updated: 2024-08-26T19:21:36.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requiring authorization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html - https://cwe.mitre.org/data/definitions/548.html - https://github.com/geraldoalcantara/CVE-2023-49545
CVE ID: CVE-2023-49546 State: PUBLISHED Published: 2024-03-04T00:00:00 Last Updated: 2024-08-28T15:07:44.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: Customer Support System v1 was discovered to contain a SQL injection vulnerability via the email parameter at /customer_support/ajax.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html - https://github.com/geraldoalcantara/CVE-2023-49546
CVE ID: CVE-2023-49547 State: PUBLISHED Published: 2024-03-04T00:00:00 Last Updated: 2024-08-29T18:13:27.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customer_support/ajax.php?action=login. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html - https://github.com/geraldoalcantara/CVE-2023-49547
CVE ID: CVE-2023-49548 State: PUBLISHED Published: 2024-03-04T00:00:00 Last Updated: 2024-08-08T19:22:47.788Z Vendors: n/a Products: n/a Problem Types: n/a Description: Customer Support System v1 was discovered to contain a SQL injection vulnerability via the lastname parameter at /customer_support/ajax.php?action=save_user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html - https://github.com/geraldoalcantara/CVE-2023-49548
CVE ID: CVE-2023-49549 State: PUBLISHED Published: 2024-01-02T00:00:00.000Z Last Updated: 2025-06-16T19:33:45.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_getretvalpos function in the msj.c file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cesanta/mjs/issues/251
CVE ID: CVE-2023-49550 State: PUBLISHED Published: 2024-01-02T00:00:00.000Z Last Updated: 2025-05-16T17:28:57.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs+0x4ec508 component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cesanta/mjs/issues/252
CVE ID: CVE-2023-49551 State: PUBLISHED Published: 2024-01-02T00:00:00 Last Updated: 2024-09-06T17:57:41.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_parse function in the msj.c file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cesanta/mjs/issues/257
CVE ID: CVE-2023-49552 State: PUBLISHED Published: 2024-01-02T00:00:00.000Z Last Updated: 2025-04-17T18:39:48.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Out of Bounds Write in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_stringify function in the msj.c file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cesanta/mjs/issues/256
CVE ID: CVE-2023-49553 State: PUBLISHED Published: 2024-01-02T00:00:00.000Z Last Updated: 2025-06-03T14:53:22.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_destroy function in the msj.c file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cesanta/mjs/issues/253
CVE ID: CVE-2023-49554 State: PUBLISHED Published: 2024-01-02T00:00:00.000Z Last Updated: 2025-06-18T15:04:55.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use After Free vulnerability in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the do_directive function in the modules/preprocs/nasm/nasm-pp.c component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/yasm/yasm/issues/249
CVE ID: CVE-2023-49555 State: PUBLISHED Published: 2024-01-02T00:00:00.000Z Last Updated: 2025-06-17T15:28:44.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_smacro function in the modules/preprocs/nasm/nasm-pp.c component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/yasm/yasm/issues/248
CVE ID: CVE-2023-49556 State: PUBLISHED Published: 2024-01-02T00:00:00.000Z Last Updated: 2025-06-03T14:52:46.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expr_delete_term function in the libyasm/expr.c component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/yasm/yasm/issues/250
CVE ID: CVE-2023-49557 State: PUBLISHED Published: 2024-01-02T00:00:00.000Z Last Updated: 2025-06-18T15:06:12.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the yasm_section_bcs_first function in the libyasm/section.c component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/yasm/yasm/issues/253
CVE ID: CVE-2023-49558 State: PUBLISHED Published: 2024-01-02T00:00:00.000Z Last Updated: 2025-06-03T14:47:08.846Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_mmac_params function in the modules/preprocs/nasm/nasm-pp.c component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/yasm/yasm/issues/252
CVE ID: CVE-2023-49559 State: PUBLISHED Published: 2024-06-12T00:00:00 Last Updated: 2024-12-03T19:49:25.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in vektah gqlparser open-source-library v.2.5.10 allows a remote attacker to cause a denial of service via a crafted script to the parserDirectives function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/uvzz/d3ed9d4532be16ec1040a2cf3dfec8d1
CVE ID: CVE-2023-49563 State: PUBLISHED Published: 2023-12-12T00:00:00 Last Updated: 2024-08-02T22:01:25.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in Voltronic Power SNMP Web Pro v.1.1 allows an attacker to execute arbitrary code via a crafted script within a request to the webserver. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/ph4nt0mbyt3/b237bfb06b2bff405ab47e4ea52c0bd2
CVE ID: CVE-2023-49564 State: PUBLISHED Published: 2025-09-18T06:10:27.787Z Last Updated: 2025-09-18T18:01:12.717Z Vendors: Nokia Products: CBIS,NCS Description: The CBIS/NCS Manager API is vulnerable to an authentication bypass. By sending a specially crafted HTTP header, an unauthenticated user can gain unauthorized access to API functions. This flaw allows attackers to reach restricted or sensitive endpoints of the HTTP API without providing any valid credentials. The root cause of this vulnerability lies in a weak verification mechanism within the authentication implementation present in the Nginx Podman container on the CBIS/NCS Manager host machine. The risk can be partially mitigated
ntation present in the Nginx Podman container on the CBIS/NCS Manager host machine. The risk can be partially mitigated by restricting access to the management network using external firewall. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/CVE-2023-49564/
CVE ID: CVE-2023-49565 State: PUBLISHED Published: 2025-09-18T06:11:53.618Z Last Updated: 2025-09-18T17:56:10.960Z Vendors: Nokia Products: CBIS,NCS Description: The cbis_manager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized within the subprocess.Popen Python function without adequate validation, enabling a remote attacker to execute arbitrary commands on the underlying system by crafting malicious header values within an HTTP request to the affected endpoint. The web service executes with root privileges withi
cious header values within an HTTP request to the affected endpoint. The web service executes with root privileges within the container environment, the demonstrated remote code execution permits an attacker to acquire elevated privileges for the command execution. Restricting access to the management network with an external firewall can partially mitigate this risk. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/CVE-2023-49565/
CVE ID: CVE-2023-49566 State: PUBLISHED Published: 2024-07-15T07:56:51.500Z Last Updated: 2025-03-27T15:35:11.826Z Vendors: Apache Software Foundation Products: Apache Linkis DataSource Problem Types: CWE-502 Description: In Apache Linkis <=1.5.0, due to the lack of effective filtering of parameters, an attacker configuring malicious db2 parameters in the DataSource Manager Module will result in jndi injection. Therefore, the parameters in the DB2 URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis <=1.5.0 will be affected. We recommend users upgrade the version of Linkis to version 1
d out. Versions of Apache Linkis <=1.5.0 will be affected. We recommend users upgrade the version of Linkis to version 1.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/t68yy52lmv7pxgrxnq6rw7rwvk9tb1xj
CVE ID: CVE-2023-49567 State: PUBLISHED Published: 2024-10-18T07:59:02.244Z Last Updated: 2024-10-18T15:25:37.785Z Vendors: Bitdefender Products: Total Security Problem Types: CWE-295 Description: A vulnerability has been identified in the Bitdefender Total Security HTTPS scanning functionality where the product incorrectly checks the site's certificate, which allows an attacker to make MITM SSL connections to an arbitrary site. The product trusts certificates that are issued using the MD5 and SHA1 collision hash functions which allow attackers to create rogue certificates that appear legitimate. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.bitdefender.com/sup
that appear legitimate. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.bitdefender.com/support/security-advisories/insecure-trust-of-certificates-using-collision-hash-functions-in-bitdefender-total-security-https-scanning-va-11239/
CVE ID: CVE-2023-49568 State: PUBLISHED Published: 2024-01-12T10:36:12.727Z Last Updated: 2025-06-17T21:09:18.035Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: go-git Products: go-git Problem Types: CWE-20 Description: A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability. This is a go-git implementation issue and does not affect t
supported by go-git are not affected by this vulnerability. This is a go-git implementation issue and does not affect the upstream git cli. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/go-git/go-git/security/advisories/GHSA-mw99-9chc-xw7r
CVE ID: CVE-2023-49569 State: PUBLISHED Published: 2024-01-12T10:41:00.201Z Last Updated: 2024-11-14T14:34:02.845Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: go-git Products: go-git Problem Types: CWE-22 Description: A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only affected if they are using the ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using "Plain" versions of Open and Clone funcs (e.g.
ub.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS or in-memory filesystems are not affected by this issue. This is a go-git implementation issue and does not affect the upstream git cli. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/go-git/go-git/security/advisories/GHSA-449p-3h89-pw88
CVE ID: CVE-2023-49570 State: PUBLISHED Published: 2024-10-18T08:07:18.810Z Last Updated: 2024-10-18T14:55:36.752Z Vendors: Bitdefender Products: Total Security Problem Types: CWE-295 Description: A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that isn't authorized to issue certificates. This occurs when the "Basic Constraints" extension in the certificate indicates that it is meant to be an "End Entity”. This flaw could allow an attacker to perform a Man-in-the-Middle (MITM) attack, intercepting and potentially altering communications between the user and the website. Additional Analy