Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-22938 State: PUBLISHED Published: 2023-02-14T17:24:46.893Z Last Updated: 2025-03-19T18:53:03.165Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-285 Description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘sendemail’ REST API endpoint lets any authenticated user send an email as the Splunk instance. The endpoint is now restricted to the ‘splunk-system-user’ account on the local instance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2023-0208
CVE ID: CVE-2023-22939 State: PUBLISHED Published: 2023-02-14T17:24:47.539Z Last Updated: 2025-02-28T11:03:47.779Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-20 Description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘map’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands. The vulnerability requires a higher privileged user to initiate a request within their browser and only affects instances with Splunk Web enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https
with Splunk Web enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2023-0209 - https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd
CVE ID: CVE-2023-22940 State: PUBLISHED Published: 2023-02-14T17:22:34.688Z Last Updated: 2025-02-28T11:03:47.020Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-20 Description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘meventcollect’, were not designated as safeguarded commands. The commands could potentially allow for the exposing of data to a summary index that unprivileged users could access. The vulnerability requires a higher
w for the exposing of data to a summary index that unprivileged users could access. The vulnerability requires a higher privileged user to initiate a request within their browser, and only affects instances with Splunk Web enabled. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0210 - https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/
CVE ID: CVE-2023-22941 State: PUBLISHED Published: 2023-02-14T17:22:37.444Z Last Updated: 2025-02-28T11:03:59.397Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-248 Description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a Field Transformation crashes the Splunk daemon (splunkd). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0211 - https://research.splunk.com/application/08978eca-caff-44c1-84dc-53f17def4e14/
CVE ID: CVE-2023-22942 State: PUBLISHED Published: 2023-02-14T17:22:39.330Z Last Updated: 2025-02-28T11:03:45.664Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Splunk Products: Splunk Enterprise Problem Types: CWE-352 Description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the ‘kvstore_client’ REST endpoint lets a potential attacker update SSG KV store collections using an HTTP GET request. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0212 - https://research.splunk.com/application/4742d5f7-ce00-45ce
ces: - https://advisory.splunk.com/advisories/SVD-2023-0212 - https://research.splunk.com/application/4742d5f7-ce00-45ce-9c79-5e98b43b4410/
CVE ID: CVE-2023-22943 State: PUBLISHED Published: 2023-02-14T17:22:40.690Z Last Updated: 2025-02-28T11:03:49.432Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Splunk Products: Splunk Add-on Builder, Splunk CloudConnect SDK Problem Types: CWE-636 Description: In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs through the REST API Modular Input incorrectly revert to using HTTP to connect after a failure to connect over HTTPS occurs. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0213
CVE ID: CVE-2023-22945 State: PUBLISHED Published: 2023-01-11T00:00:00.000Z Last Updated: 2025-04-07T18:32:19.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the GrowthExperiments extension for MediaWiki through 1.39, the growthmanagementorlist API allows blocked users (blocked in ApiManageMentorList) to enroll as mentors or edit any of their mentorship-related properties. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T321733 - https://gerrit.wikimedia.org/r/q/Id1b83fcd58eccb8b2dfea44a3ab2f72314860d88 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/messa
dfea44a3ab2f72314860d88 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AP65YEN762IBNQPOYGUVLTQIDLM5XD2A/
CVE ID: CVE-2023-22946 State: PUBLISHED Published: 2023-04-17T07:30:19.865Z Last Updated: 2024-10-21T15:06:58.145Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Apache Software Foundation Products: Apache Spark Problem Types: CWE-269 Description: In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications. Update t
ects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications. Update to Apache Spark 3.4.0 or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of "false", and is not overridden by submitted applications. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/yllfl25xh5tbotjmg93zrq4bzwhqc0gv
CVE ID: CVE-2023-22947 State: PUBLISHED Published: 2023-01-11T00:00:00.000Z Last Updated: 2025-04-07T18:39:34.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\opt (rather than C:\Program Files) by default. NOTE: the vendor disputes the significance of this report, stating that "We consider the ACLs a best effort thing" and "it was a documentation mistake." Additional Analyst Notes: - CVE Program Co
consider the ACLs a best effort thing" and "it was a documentation mistake." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://shibboleth.atlassian.net/browse/SSPCPP-961 - https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335545/Install+on+Windows#Restricting-ACLs
CVE ID: CVE-2023-22948 State: PUBLISHED Published: 2023-04-13T00:00:00.000Z Last Updated: 2025-02-07T16:39:49.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is unsecured read access to an SSH private key. Any code that runs as the tigergraph user is able to read the SSH private key. With this, an attacker is granted password-less SSH access to all machines in the TigerGraph cluster. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://dev.tigergraph.com/forum/c/tg-community/announcements/35 - https://neo4j.com/security/cve-2023-22948/
CVE ID: CVE-2023-22949 State: PUBLISHED Published: 2023-04-14T00:00:00.000Z Last Updated: 2025-02-07T21:10:03.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is logging of user credentials. All authenticated GSQL access requests are logged by TigerGraph in multiple places. Each request includes both the username and password of the user in an easily decodable base64 form. That could allow a TigerGraph administrator to effectively harvest usernames/passwords. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://dev.tigergraph.com/forum/c/tg-community/announceme
CVE Program Container: - CISA ADP Vulnrichment: References: - https://dev.tigergraph.com/forum/c/tg-community/announcements/35 - https://neo4j.com/security/cve-2023-22949/
CVE ID: CVE-2023-22950 State: PUBLISHED Published: 2023-04-13T00:00:00.000Z Last Updated: 2025-02-07T16:37:42.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in TigerGraph Enterprise Free Edition 3.x. Data loading jobs in gsql_server, created by any user with designer permissions, can read sensitive data from arbitrary locations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://dev.tigergraph.com/forum/c/tg-community/announcements/35 - https://neo4j.com/security/cve-2023-22950/
CVE ID: CVE-2023-22951 State: PUBLISHED Published: 2023-04-13T00:00:00.000Z Last Updated: 2025-02-07T16:35:39.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in TigerGraph Enterprise Free Edition 3.x. It creates an authentication token for internal systems use. This token can be read from the configuration file. Using this token on the REST API provides an attacker with anonymous admin-level privileges on all REST API endpoints. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://dev.tigergraph.com/forum/c/tg-community/announcements/35 - https://neo4j.com/security/cve-2023-22951/
CVE ID: CVE-2023-22952 State: PUBLISHED Published: 2023-01-11T00:00:00.000Z Last Updated: 2025-10-21T23:15:28.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/ - http://packetstormsecurity.com/files/171320/SugarCRM-12.x-Remote-Code-Execution-Shell-Upload.html
CVE ID: CVE-2023-22953 State: PUBLISHED Published: 2023-02-09T00:00:00 Last Updated: 2024-08-02T10:20:31.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1820492 - https://docs.expressionengine.com/latest/installation/changelog.html - https://gist.github.com/ahmedsherif/7b8f18a54a80ae0ac5ff6307c35b7d43
CVE ID: CVE-2023-22955 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-10T14:32:58.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. The validation of firmware images only consists of simple checksum checks for different firmware components. Thus, by knowing how to calculate and where to store the required checksums for the flasher tool, an attacker is able to store malicious firmware. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://syss.de - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-055.txt - http://
rences: - https://syss.de - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-055.txt - http://seclists.org/fulldisclosure/2023/Aug/17 - http://packetstormsecurity.com/files/174214/AudioCodes-VoIP-Phones-Insufficient-Firmware-Validation.html
CVE ID: CVE-2023-22956 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-10T14:28:32.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of a hard-coded cryptographic key, an attacker is able to decrypt encrypted configuration files and retrieve sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://syss.de - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-054.txt - http://seclists.org/fulldisclosure/2023/Aug/16 - http://packetstormsecurity.com/files/174216/AudioCodes-VoIP-Phones-
t - http://seclists.org/fulldisclosure/2023/Aug/16 - http://packetstormsecurity.com/files/174216/AudioCodes-VoIP-Phones-Hardcoded-Key.html
CVE ID: CVE-2023-22957 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-10T15:48:38.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libac_des3.so on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of hard-coded cryptographic key, an attacker with access to backup or configuration files is able to decrypt encrypted values and retrieve sensitive information, e.g., the device root password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://syss.de - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-052.txt - http://seclists.org/fulldisclosure/20
tps://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-052.txt - http://seclists.org/fulldisclosure/2023/Aug/15 - http://packetstormsecurity.com/files/174215/AudioCodes-VoIP-Phones-Hardcoded-Key.html
CVE ID: CVE-2023-22958 State: PUBLISHED Published: 2023-01-11T00:00:00.000Z Last Updated: 2025-04-07T18:40:26.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Syracom Secure Login plugin before 3.1.1.0 for Jira may allow spoofing of 2FA PIN validation via the plugins/servlet/twofactor/public/pinvalidation target parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/piuppi/Proof-of-Concepts/blob/main/Syracom/SecureLogin2FA-OpenRedirect.md
CVE ID: CVE-2023-22959 State: PUBLISHED Published: 2023-01-11T00:00:00.000Z Last Updated: 2025-04-07T18:40:58.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebChess through 0.9.0 and 1.0.0.rc2 allows SQL injection: mainmenu.php, chess.php, and opponentspassword.php (txtFirstName, txtLastName). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/chenan224/webchess_sqli_poc - https://sourceforge.net/p/webchess/bugs/84/
CVE ID: CVE-2023-22960 State: PUBLISHED Published: 2023-01-23T00:00:00.000Z Last Updated: 2025-04-02T15:37:56.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://publications.lexmark.com/publications/security-alerts/CVE-2023-22960.pdf
CVE ID: CVE-2023-22963 State: PUBLISHED Published: 2023-01-11T00:00:00.000Z Last Updated: 2025-04-07T18:41:36.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: The personnummer implementation before 3.0.3 for Dart mishandles numbers in which the last four digits match the ^000[0-9]$ regular expression. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/personnummer/dart/security/advisories/GHSA-4xh4-v2pq-jvhm - https://github.com/advisories/GHSA-4xh4-v2pq-jvhm
CVE ID: CVE-2023-22964 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-03T15:07:12.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://manageengine.com - https://www.manageengine.com/products/service-desk-msp/cve-2023-22964.html
CVE ID: CVE-2023-22970 State: PUBLISHED Published: 2023-05-26T00:00:00 Last Updated: 2025-01-15T16:06:38.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bottlesdevs/Bottles/issues/2463 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZJZEE4RAAK7OPVQNE4BOWUVQDVSZU6NJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N24KI3O3FWGKJSLATY35ZM3CHSABJ6WE/
CVE ID: CVE-2023-22971 State: PUBLISHED Published: 2023-01-26T00:00:00.000Z Last Updated: 2025-03-28T16:22:41.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Hughes Network Systems Router Terminal for HX200 v8.3.1.14, HX90 v6.11.0.5, HX50L v6.10.0.18, HN9460 v8.2.0.48, and HN7000S v6.9.0.37, allows unauthenticated attackers to misuse frames, include JS/HTML code and steal sensitive information from legitimate users of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5743.php - https://www.hughes.com
CVE ID: CVE-2023-22972 State: PUBLISHED Published: 2023-02-22T00:00:00.000Z Last Updated: 2025-03-12T14:53:54.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross-site scripting (XSS) vulnerability in interface/forms/eye_mag/php/eye_mag_functions.php in OpenEMR < 7.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the REQUEST_URI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.open-emr.org/wiki/index.php/OpenEMR_Patches#7.0.0_Patch_.2811.2F30.2F22.29
CVE ID: CVE-2023-22973 State: PUBLISHED Published: 2023-02-22T00:00:00.000Z Last Updated: 2025-03-12T14:52:47.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Local File Inclusion (LFI) vulnerability in interface/forms/LBF/new.php in OpenEMR < 7.0.0 allows remote authenticated users to execute code via the formname parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.open-emr.org/wiki/index.php/OpenEMR_Patches#7.0.0_Patch_.2811.2F30.2F22.29 - https://www.sonarsource.com/blog/openemr-remote-code-execution-in-your-healthcare-system/
CVE ID: CVE-2023-22974 State: PUBLISHED Published: 2023-02-22T00:00:00.000Z Last Updated: 2025-03-12T14:50:14.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.open-emr.org/wiki/index.php/OpenEMR_Patches#7.0.0_Patch_.2811.2F30.2F22.29 - https://www.sonarsource.com/blog/openemr-remote-code-execution-in-your-healthcare-system/
CVE ID: CVE-2023-22975 State: PUBLISHED Published: 2023-02-03T00:00:00 Last Updated: 2024-08-02T10:20:31.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person/profile.html. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jflyfox/jfinal_cms/issues/53
CVE ID: CVE-2023-22984 State: PUBLISHED Published: 2023-02-21T00:00:00 Last Updated: 2024-08-02T10:20:31.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Vulnerability was discovered in Axis 207W network camera. There is a reflected XSS vulnerability in the web administration portal, which allows an attacker to execute arbitrary JavaScript via URL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://d0ub1e-d.github.io/2022/12/30/exploit-db-1/
CVE ID: CVE-2023-22985 State: PUBLISHED Published: 2023-04-06T00:00:00.000Z Last Updated: 2025-02-13T21:01:12.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Simple Guestbook Management System version 1 is vulnerable to Cross Site Scripting (XSS) via Name, Referrer, Location, and Comments. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://sourcecodester.com - https://medium.com/%40ivirajjadhav/cve-2023-22985-8869852685b
CVE ID: CVE-2023-22995 State: PUBLISHED Published: 2023-02-28T00:00:00.000Z Last Updated: 2025-05-05T16:05:37.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17 - https://github.com/torvalds/linux/commit/fa0ef93868a6062babe1144df2807a8b1d4924d2 - https://security.netapp.com/advisory/ntap-20230331-0004/
CVE ID: CVE-2023-22996 State: PUBLISHED Published: 2023-02-28T00:00:00.000Z Last Updated: 2025-03-20T19:45:15.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 5.17.2, drivers/soc/qcom/qcom_aoss.c does not release an of_find_device_by_node reference after use, e.g., with put_device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.2 - https://github.com/torvalds/linux/commit/4b41a9d0fe3db5f91078a380f62f0572c3ecf2dd
CVE ID: CVE-2023-22997 State: PUBLISHED Published: 2023-02-28T00:00:00.000Z Last Updated: 2025-03-20T19:44:36.617Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 6.1.2, kernel/module/decompress.c misinterprets the module_get_next_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/torvalds/linux/commit/45af1d7aae7d5520d2858f8517a1342646f015db - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.2
CVE ID: CVE-2023-22998 State: PUBLISHED Published: 2023-02-28T00:00:00.000Z Last Updated: 2025-03-19T16:06:48.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/torvalds/linux/commit/c24968734abfed81c8f93dc5f44a7b7a9aecadfa - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.3 - https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html