Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-20895 State: PUBLISHED Published: 2023-06-22T11:57:15.954Z Last Updated: 2025-02-13T16:40:08.472Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: VMware Products: VMware vCenter Server (vCenter Server), VMware Cloud Foundation (vCenter Server) Description: The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger a memory corruption vulnerability which may bypass authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0
: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0014.html - https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1740
CVE ID: CVE-2023-20896 State: PUBLISHED Published: 2023-06-22T12:00:45.390Z Last Updated: 2025-02-13T16:40:09.061Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: VMware Products: VMware vCenter Server (vCenter Server), VMware Cloud Foundation (vCenter Server) Description: The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds read by sending a specially crafted packet leading to denial-of-service of certain services (vmcad, vmdird, and vmafdd). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnric
e of certain services (vmcad, vmdird, and vmafdd). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0014.html - https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1800
CVE ID: CVE-2023-20897 State: PUBLISHED Published: 2023-09-05T10:56:33.183Z Last Updated: 2025-02-13T16:40:09.607Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: Salt Problem Types: DOS in minion return. Description: Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://saltproject.io/security-announcements/2023-08-10-advisory/ - https://lists.fedoraproject.org/arc
: References: - https://saltproject.io/security-announcements/2023-08-10-advisory/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL/
CVE ID: CVE-2023-20898 State: PUBLISHED Published: 2023-09-05T10:59:10.439Z Last Updated: 2025-02-13T16:40:10.201Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: n/a Products: Salt Problem Types: Git Providers can read from the wrong environment because they get the same cache directory base name. Description: Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash. Additional A
wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://saltproject.io/security-announcements/2023-08-10-advisory/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL/
CVE ID: CVE-2023-20899 State: PUBLISHED Published: 2023-07-06T22:29:19.852Z Last Updated: 2024-11-14T20:51:48.993Z Vendors: n/a Products: VMware SD-WAN (Edge) Problem Types: Bypass Authentication Description: VMware SD-WAN (Edge) contains a bypass authentication vulnerability. An unauthenticated attacker can download the Diagnostic bundle of the application under VMware SD-WAN Management. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0015.html
CVE ID: CVE-2023-20900 State: PUBLISHED Published: 2023-08-31T09:45:43.130Z Last Updated: 2024-08-02T09:21:33.112Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: VMware Tools, VMware Tools (open-vm-tools) Problem Types: SAML Token Signature Bypass vulnerability Description: A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-pu
t virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html . Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2023-0019.html - http://www.openwall.com/lists/oss-security/2023/08/31/1 - https://www.debian.org/security/2023/dsa-5493 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y
KQBFH2XSZ52HEWH/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/ - https://lists.debian.org/debian-lts-announce/2023/10/msg00000.html - https://security.netapp.com/advisory/ntap-20231013-0002/ - http://www.openwall.com/lists/oss-security/2023/10/27/1
CVE ID: CVE-2023-20902 State: PUBLISHED Published: 2023-11-09T00:36:25.369Z Last Updated: 2024-09-04T13:18:17.730Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Harbor Products: Project Problem Types: In the Harbor jobservice container, the comparison of secrets in the authenticator type is prone to timing attacks. Description: A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.co
information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/goharbor/harbor/security/advisories/GHSA-mq6f-5xh5-hgcf
CVE ID: CVE-2023-20903 State: PUBLISHED Published: 2023-03-28T00:00:00.000Z Last Updated: 2025-02-19T18:38:21.215Z Vendors: n/a Products: Cloud Foundry Problem Types: Tokens for inactivated IDPs are not revoked and remain valid until expiration Description: This disclosure regards a vulnerability related to UAA refresh tokens and external identity providers.Assuming that an external identity provider is linked to the UAA, a refresh token is issued to a client on behalf of a user from that identity provider, the administrator of the UAA deactivates the identity provider from the UAA. It is expected that the UAA would reject a refresh token during a refresh token grant, but it does not (hence
the UAA. It is expected that the UAA would reject a refresh token during a refresh token grant, but it does not (hence the vulnerability). It will continue to issue access tokens to request presenting such refresh tokens, as if the identity provider was still active. As a result, clients with refresh tokens issued through the deactivated identity provider would still have access to Cloud Foundry resources until their refresh token expires (which defaults to 30 days). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cloudfoundry.org/blog/cve-2023-20903-tokens-for-inactivated-idps-are-not-revoked-and-remain-valid-until-expiration/
CVE ID: CVE-2023-20904 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-03T20:11:00.615Z Vendors: n/a Products: Android Problem Types: Elevation of privilege Description: In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity due to an Intent mismatch in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12L Android-13Android ID: A-246300272 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2023-01-01
CVE ID: CVE-2023-20905 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-03T20:11:31.837Z Vendors: n/a Products: Android Problem Types: Elevation of privilege Description: In Mfc_Transceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-241387741 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2023-01-01
CVE ID: CVE-2023-20906 State: PUBLISHED Published: 2023-03-24T00:00:00.000Z Last Updated: 2025-02-28T20:19:11.087Z Vendors: n/a Products: Android Problem Types: Elevation of privilege Description: In onPackageAddedInternal of PermissionManagerService.java, there is a possible way to silently grant a permission after a Target SDK update due to a permissions bypass. This could lead to local escalation of privilege after updating an app to a higher Target SDK with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-221040577 Additional Analyst Notes: - CVE Program Container
s: Android-11 Android-12 Android-12L Android-13Android ID: A-221040577 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2023-03-01
CVE ID: CVE-2023-20908 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-03T20:12:08.908Z Vendors: n/a Products: Android Problem Types: Denial of service Description: In several functions of SettingsState.java, there is a possible system crash loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-239415861 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2023-01-01
CVE ID: CVE-2023-20909 State: PUBLISHED Published: 2023-04-19T00:00:00.000Z Last Updated: 2025-02-05T19:07:28.840Z Vendors: n/a Products: Android Problem Types: Information disclosure Description: In multiple functions of RunningTasks.java, there is a possible privilege escalation due to a missing privilege check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-243130512 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2023-04-01
CVE ID: CVE-2023-20910 State: PUBLISHED Published: 2023-03-24T00:00:00.000Z Last Updated: 2025-02-28T20:22:35.928Z Vendors: Google Products: Android Problem Types: Denial of service Description: In add of WifiNetworkSuggestionsManager.java, there is a possible way to trigger permanent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Wifi/+/d7df9d633c2726fa2bee8739c9ba274f300e1ea9 - https://android.googlesource.com/platform/p
/platform/packages/modules/Wifi/+/d7df9d633c2726fa2bee8739c9ba274f300e1ea9 - https://android.googlesource.com/platform/packages/modules/Wifi/+/8827591ae680c4d0bd0e373d4ca20cb35f53faa6 - https://source.android.com/security/bulletin/2023-07-01
CVE ID: CVE-2023-20911 State: PUBLISHED Published: 2023-03-24T00:00:00.000Z Last Updated: 2025-02-28T20:28:29.210Z Vendors: n/a Products: Android Problem Types: Elevation of privilege Description: In addPermission of PermissionManagerServiceImpl.java , there is a possible failure to persist permission settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-242537498 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/secu
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2023-03-01
CVE ID: CVE-2023-20912 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:52:42.754Z Vendors: n/a Products: Android Problem Types: Elevation of privilege Description: In onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-246301995 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2023-01-01
CVE ID: CVE-2023-20913 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:51:32.101Z Vendors: n/a Products: Android Problem Types: Elevation of privilege Description: In onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to mislead the user into enabling a malicious phone account due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-246933785 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
oid-12L Android-13Android ID: A-246933785 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2023-01-01
CVE ID: CVE-2023-20914 State: PUBLISHED Published: 2023-05-15T00:00:00.000Z Last Updated: 2025-01-24T18:09:30.849Z Vendors: n/a Products: Android Problem Types: Information disclosure Description: In onSetRuntimePermissionGrantStateByDeviceAdmin of AdminRestrictedPermissionsUtils.java, there is a possible way for the work profile to read SMS messages due to a permissions bypass. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-189942529 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/securi
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2023-05-01
CVE ID: CVE-2023-20915 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:50:53.244Z Vendors: n/a Products: Android Problem Types: Elevation of privilege Description: In addOrReplacePhoneAccount of PhoneAccountRegistrar.java, there is a possible way to enable a phone account without user interaction due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-246930197 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
Android-13Android ID: A-246930197 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2023-01-01
CVE ID: CVE-2023-20916 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:50:21.107Z Vendors: n/a Products: Android Problem Types: Elevation of privilege Description: In getMainActivityLaunchIntent of LauncherAppsService.java, there is a possible way to bypass the restrictions on starting activities from the background due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-229256049 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
ndroid ID: A-229256049 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2023-01-01
CVE ID: CVE-2023-20917 State: PUBLISHED Published: 2023-03-24T00:00:00.000Z Last Updated: 2025-02-28T20:30:31.234Z Vendors: n/a Products: Android Problem Types: Elevation of privilege Description: In onTargetSelected of ResolverActivity.java, there is a possible way to share a wrong file due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-242605257 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/202
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2023-03-01
CVE ID: CVE-2023-20918 State: PUBLISHED Published: 2023-07-12T23:18:00.205Z Last Updated: 2024-11-06T16:52:24.698Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused deputy with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/16c604aa7c253ce5cf075368a258c0b21386160d - https://android.googlesource.com/platform/frameworks/base/+/8418e3a017428683d173c0c82b
c253ce5cf075368a258c0b21386160d - https://android.googlesource.com/platform/frameworks/base/+/8418e3a017428683d173c0c82b0eb02d5b923a4e - https://android.googlesource.com/platform/frameworks/base/+/51051de4eb40bb502db448084a83fd6cbfb7d3cf - https://source.android.com/security/bulletin/2023-07-01
CVE ID: CVE-2023-20919 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:49:29.094Z Vendors: n/a Products: Android Problem Types: Elevation of privilege Description: In getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-252663068 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2023-01-01
CVE ID: CVE-2023-20920 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:48:14.827Z Vendors: n/a Products: Android Problem Types: Elevation of privilege Description: In queue of UsbRequest.java, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-204584366 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2023-01-01
CVE ID: CVE-2023-20921 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:47:18.438Z Vendors: n/a Products: Android Problem Types: Elevation of privilege Description: In onPackageRemoved of AccessibilityManagerService.java, there is a possibility to automatically grant accessibility services due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-243378132 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
ndroid ID: A-243378132 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2023-01-01
CVE ID: CVE-2023-20922 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:46:00.443Z Vendors: n/a Products: Android Problem Types: Denial of service Description: In setMimeGroup of PackageManagerService.java, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-237291548 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2023-01-01
CVE ID: CVE-2023-20923 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:44:50.720Z Vendors: n/a Products: Android Problem Types: Information disclosure Description: In exported content providers of ShannonRcs, there is a possible way to get access to protected content providers due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-246933910References: N/A Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pi
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2023-01-01