Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-38647 State: PUBLISHED Published: 2023-07-26T07:52:29.741Z Last Updated: 2024-10-02T19:38:48.882Z Vendors: Apache Software Foundation Products: Apache Helix Problem Types: CWE-502 Description: An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run in Helix REST start and Workflow creation. Affect all the versions lower and include 1.2.0. Affected products: helix-core, helix-rest Mitigation: Short term, stop using any YAML based configur
and include 1.2.0. Affected products: helix-core, helix-rest Mitigation: Short term, stop using any YAML based configuration and workflow creation. Long term, all Helix version bumping up to 1.3.0 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/zyqxhv0lc2z9w3tgr8ttrdy2zfh5jvc4
CVE ID: CVE-2023-38648 State: PUBLISHED Published: 2024-01-08T14:47:47.382Z Last Updated: 2025-11-04T18:16:01.612Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-119 Description: Multiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_get_facname decompression functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write perfomed by the prefix copy loop. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
ite perfomed by the prefix copy loop. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1813 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-38649 State: PUBLISHED Published: 2024-01-08T14:47:47.471Z Last Updated: 2025-11-04T18:16:02.852Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-119 Description: Multiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_get_facname decompression functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write perfomed by the string copy loop. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
ite perfomed by the string copy loop. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1813 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-38650 State: PUBLISHED Published: 2024-01-08T14:47:46.758Z Last Updated: 2025-11-04T18:16:04.014Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-190 Description: Multiple integer overflow vulnerabilities exist in the VZT vzt_rd_block_vch_decode times parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when num_time_ticks is not zero. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
um_time_ticks is not zero. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1814 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-38651 State: PUBLISHED Published: 2024-01-08T14:47:46.837Z Last Updated: 2025-11-04T18:16:05.218Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-190 Description: Multiple integer overflow vulnerabilities exist in the VZT vzt_rd_block_vch_decode times parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when num_time_ticks is zero. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
um_time_ticks is zero. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1814 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-38652 State: PUBLISHED Published: 2024-01-08T14:47:46.181Z Last Updated: 2025-11-04T18:16:06.463Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-190 Description: Multiple integer overflow vulnerabilities exist in the VZT vzt_rd_block_vch_decode dict parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when num_time_ticks is not zero. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
m_time_ticks is not zero. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1815 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-38653 State: PUBLISHED Published: 2024-01-08T14:47:46.271Z Last Updated: 2025-11-04T18:16:07.663Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-190 Description: Multiple integer overflow vulnerabilities exist in the VZT vzt_rd_block_vch_decode dict parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when num_time_ticks is zero. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://
m_time_ticks is zero. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1815 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-38654 State: PUBLISHED Published: 2024-05-16T20:47:14.030Z Last Updated: 2024-08-02T17:46:56.715Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H) Vendors: n/a Products: some Intel(R) PROSet/Wireless WiFi software for Windows Problem Types: denial of service, CWE-20 Description: Improper input validation for some some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.20 may allow an unauthenticated user to potentially enable denial of service via adjacent access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01039.html
CVE ID: CVE-2023-38655 State: PUBLISHED Published: 2024-08-14T13:45:43.058Z Last Updated: 2024-08-16T19:03:30.192Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) AMT and Intel(R) Standard Manageability Problem Types: denial of service, CWE-92 Description: Improper buffer restrictions in firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentially enable denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00999.html
CVE ID: CVE-2023-38657 State: PUBLISHED Published: 2024-01-08T14:47:41.596Z Last Updated: 2025-11-04T18:16:08.818Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-119 Description: An out-of-bounds write vulnerability exists in the LXT2 zlib block decompression functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1823 - https://lists.debian.or
ulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1823 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-38665 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-03T13:47:13.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: Null pointer dereference in ieee_write_file in nasm 2.16rc0 allows attackers to cause a denial of service (crash). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.nasm.us/show_bug.cgi?id=3392818
CVE ID: CVE-2023-38666 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-03T13:46:10.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4encrypt. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/axiomatic-systems/Bento4/issues/784
CVE ID: CVE-2023-38667 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-03T13:30:15.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer over-read in function disasm in nasm 2.16 allows attackers to cause a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.nasm.us/show_bug.cgi?id=3392812
CVE ID: CVE-2023-38668 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-03T19:05:31.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer over-read in disasm in nasm 2.16 allows attackers to cause a denial of service (crash). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.nasm.us/show_bug.cgi?id=3392811
CVE ID: CVE-2023-38669 State: PUBLISHED Published: 2023-07-26T09:29:39.869Z Last Updated: 2024-10-22T20:31:35.190Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: PaddlePaddle Products: PaddlePaddle Problem Types: CWE-416 Description: Use after free in paddle.diagonal in PaddlePaddle before 2.5.0. This resulted in a potentially exploitable condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-001.md
CVE ID: CVE-2023-38670 State: PUBLISHED Published: 2023-07-26T10:50:12.245Z Last Updated: 2024-10-23T14:26:06.624Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: PaddlePaddle Products: PaddlePaddle Problem Types: CWE-476 Description: Null pointer dereference in paddle.flip in PaddlePaddle before 2.5.0. This resulted in a runtime crash and denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-002.md
CVE ID: CVE-2023-38671 State: PUBLISHED Published: 2023-07-26T10:59:48.778Z Last Updated: 2024-10-23T14:18:50.862Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: PaddlePaddle Products: PaddlePaddle Problem Types: CWE-120 Description: Heap buffer overflow in paddle.trace in PaddlePaddle before 2.5.0. This flaw can lead to a denial of service, information disclosure, or more damage is possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-003.md
CVE ID: CVE-2023-38672 State: PUBLISHED Published: 2023-07-26T11:04:13.221Z Last Updated: 2024-10-23T14:17:02.964Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L) Vendors: PaddlePaddle Products: PaddlePaddle Problem Types: CWE-369 Description: FPE in paddle.trace in PaddlePaddle before 2.5.0. This flaw can cause a runtime crash and a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-004.md
CVE ID: CVE-2023-38673 State: PUBLISHED Published: 2023-07-26T11:10:34.410Z Last Updated: 2024-10-23T15:40:52.801Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: PaddlePaddle Products: PaddlePaddle Problem Types: CWE-78 Description: PaddlePaddle before 2.5.0 has a command injection in fs.py. This resulted in the ability to execute arbitrary commands on the operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-005.md
CVE ID: CVE-2023-38674 State: PUBLISHED Published: 2024-01-03T08:10:10.276Z Last Updated: 2025-06-06T20:05:09.016Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L) Vendors: PaddlePaddle Products: PaddlePaddle Problem Types: CWE-369 Description: FPE in paddle.nanmedian in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-006.md
CVE ID: CVE-2023-38675 State: PUBLISHED Published: 2024-01-03T08:10:48.838Z Last Updated: 2025-05-21T14:58:58.810Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L) Vendors: PaddlePaddle Products: PaddlePaddle Problem Types: CWE-369 Description: FPE in paddle.linalg.matrix_rank in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-007.md
CVE ID: CVE-2023-38676 State: PUBLISHED Published: 2024-01-03T08:11:05.336Z Last Updated: 2024-09-06T17:26:13.184Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L) Vendors: PaddlePaddle Products: PaddlePaddle Problem Types: CWE-476 Description: Nullptr in paddle.dot in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-008.md
CVE ID: CVE-2023-38677 State: PUBLISHED Published: 2024-01-03T08:11:39.268Z Last Updated: 2025-04-17T18:25:35.668Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L) Vendors: PaddlePaddle Products: PaddlePaddle Problem Types: CWE-369 Description: FPE in paddle.linalg.eig in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-009.md
CVE ID: CVE-2023-38678 State: PUBLISHED Published: 2024-01-03T08:11:55.859Z Last Updated: 2025-06-03T14:44:00.892Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L) Vendors: PaddlePaddle Products: PaddlePaddle Problem Types: CWE-125 Description: OOB access in paddle.mode in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-010.md
CVE ID: CVE-2023-38679 State: PUBLISHED Published: 2023-08-08T09:20:44.162Z Last Updated: 2024-10-11T13:51:47.510Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Tecnomatix Plant Simulation V2201, Tecnomatix Plant Simulation V2302 Problem Types: CWE-787 Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant Simulation V2302 (All versions < V2302.0002). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the
ed buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21106) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-764801.pdf
CVE ID: CVE-2023-38680 State: PUBLISHED Published: 2023-08-08T09:20:45.202Z Last Updated: 2024-10-11T13:18:43.701Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Tecnomatix Plant Simulation V2201, Tecnomatix Plant Simulation V2302 Problem Types: CWE-787 Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant Simulation V2302 (All versions < V2302.0002). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the
ed buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21132) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-764801.pdf
CVE ID: CVE-2023-38681 State: PUBLISHED Published: 2023-08-08T09:20:46.256Z Last Updated: 2024-10-11T13:18:14.715Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Tecnomatix Plant Simulation V2201, Tecnomatix Plant Simulation V2302 Problem Types: CWE-787 Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant Simulation V2302 (All versions < V2302.0002). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted IGS file. This could allow an attacker to execute code in the context of the
ed buffer while parsing a specially crafted IGS file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21270) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-764801.pdf
CVE ID: CVE-2023-38682 State: PUBLISHED Published: 2023-08-08T09:20:47.299Z Last Updated: 2024-10-11T13:17:25.296Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: JT2Go, Teamcenter Visualization V13.2, Teamcenter Visualization V14.1, Teamcenter Visualization V14.2 Problem Types: CWE-125 Description: A vulnerability has been identified in JT2Go (All versions < V14.2.0.5), Teamcenter Visualization V13.2 (All versions < V13.2.0.14), Teamcenter Visualization V14.1 (All versions < V14.1.0.10), Teamcenter Visualization V14.2 (All versions < V14.2.0.5). The affected applications contain an out of bounds read past the end of an allocate
on V14.2 (All versions < V14.2.0.5). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted TIFF files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-131450.pdf
CVE ID: CVE-2023-38683 State: PUBLISHED Published: 2023-08-08T09:20:48.395Z Last Updated: 2024-10-11T13:16:08.622Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: JT2Go, Teamcenter Visualization V13.2, Teamcenter Visualization V14.1, Teamcenter Visualization V14.2 Problem Types: CWE-787 Description: A vulnerability has been identified in JT2Go (All versions < V14.2.0.5), Teamcenter Visualization V13.2 (All versions < V13.2.0.14), Teamcenter Visualization V14.1 (All versions < V14.1.0.10), Teamcenter Visualization V14.2 (All versions < V14.2.0.5). The affected application contains an out of bounds write past the end of an allocat
on V14.2 (All versions < V14.2.0.5). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted TIFF file. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-131450.pdf
CVE ID: CVE-2023-38684 State: PUBLISHED Published: 2023-07-28T15:25:41.132Z Last Updated: 2024-10-10T16:03:56.849Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: discourse Products: discourse Problem Types: CWE-770 Description: Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, in multiple controller actions, Discourse accepts limit params but does not impose any upper bound on the values being accepted. Without an upper bound, the software may allow arbitrary users to generate DB queries which may end up exhausting the resources on the server. The
e software may allow arbitrary users to generate DB queries which may end up exhausting the resources on the server. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-ff7g-xv79-hgmf - https://github.com/discourse/discourse/commit/bfc3132bb22bd5b7e86f428746b89c4d3d7f5a70
CVE ID: CVE-2023-38685 State: PUBLISHED Published: 2023-07-28T15:27:19.780Z Last Updated: 2024-10-10T16:01:52.863Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-200 Description: Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, information about restricted-visibility topic tags could be obtained by unauthorized users. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. Additional Analyst Notes: - CVE Program Container: - CI
d version 3.1.0.beta7 of the `beta` and `tests-passed` branches. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-wx6x-q4gp-mgv5 - https://github.com/discourse/discourse/commit/073661142369a0a66c25775cc3870582a679ef8b