Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ith a single Map argument in any Java class available in the IdentityIQ application classpath. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sailpoint.com/security-advisories/sailpoint-identityiq-unsafe-use-of-reflection-vulnerability-cve-2023-32217/
CVE ID: CVE-2023-32218 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-10T21:18:54.961Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Avaya Products: IX Workforce Engagement Problem Types: CWE-601 Description: Avaya IX Workforce Engagement v15.2.7.1195 - CWE-601: URL Redirection to Untrusted Site ('Open Redirect') Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2023-32219 State: PUBLISHED Published: 2023-06-12T00:00:00 Last Updated: 2025-01-06T17:11:43.473Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Mazda Products: Mazda (2015-2016) Problem Types: Mazda cars unlocking Description: A Mazda model (2015-2016) can be unlocked via an unspecified method. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2023-32220 State: PUBLISHED Published: 2023-06-12T00:00:00 Last Updated: 2025-01-06T17:10:10.654Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) Vendors: Milesight Products: NCR/camera Problem Types: Authentication Bypass Description: Milesight NCR/camera version 71.8.0.6-r5 allows authentication bypass through an unspecified method. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2023-32221 State: PUBLISHED Published: 2023-06-12T00:00:00 Last Updated: 2025-01-03T23:46:12.395Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: EaseUS Products: Todo Backup Problem Types: may allow local privilege escalation Description: EaseUS Todo Backup version 20220111.390 - An omission during installation may allow a local attacker to perform privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2023-32222 State: PUBLISHED Published: 2023-06-28T00:00:00 Last Updated: 2024-11-27T16:40:19.924Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DSL-G256DG firmware version vBZ_1.00.27 Problem Types: Authorization Bypass Description: D-Link DSL-G256DG version vBZ_1.00.27 web management interface allows authentication bypass via an unspecified method. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2023-32223 State: PUBLISHED Published: 2023-06-28T00:00:00 Last Updated: 2024-11-27T16:38:40.441Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DSL-224 firmware version 3.0.10 Problem Types: authentication command execution Description: D-Link DSL-224 firmware version 3.0.10 allows post authentication command execution via an unspecified method. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2023-32224 State: PUBLISHED Published: 2023-06-28T00:00:00 Last Updated: 2024-11-27T16:36:27.016Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DSL-224 firmware version 3.0.10 Problem Types: CWE-307 Description: D-Link DSL-224 firmware version 3.0.10 CWE-307: Improper Restriction of Excessive Authentication Attempts Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2023-32225 State: PUBLISHED Published: 2023-07-30T07:16:24.730Z Last Updated: 2024-10-21T17:53:17.063Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sysaid Products: Sysaid Problem Types: CWE-434 Description: Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2023-32226 State: PUBLISHED Published: 2023-07-30T07:53:21.574Z Last Updated: 2024-10-11T14:07:55.756Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: Sysaid Products: Sysaid Problem Types: CWE-552 Description: Sysaid - CWE-552: Files or Directories Accessible to External Parties - Authenticated users may exfiltrate files from the server via an unspecified method. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2023-32227 State: PUBLISHED Published: 2023-07-30T08:03:01.673Z Last Updated: 2024-10-21T17:53:56.765Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Synel Products: SYnergy Fingerprint Terminals Problem Types: CWE-798 Description: Synel SYnergy Fingerprint Terminals - CWE-798: Use of Hard-coded Credentials Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2023-32228 State: PUBLISHED Published: 2024-04-11T09:05:08.892Z Last Updated: 2024-08-02T15:10:25.010Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Bosch Products: AMS, BIS Problem Types: CWE-115 Description: A firmware bug which may lead to misinterpretation of data in the AMC2-4WCF and AMC2-2WCF allowing an adversary to grant access to the last authorized user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-391095-BT.html
CVE ID: CVE-2023-32229 State: PUBLISHED Published: 2023-06-15T10:03:22.868Z Last Updated: 2024-12-12T16:32:51.994Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Bosch Products: Camera Firmware Problem Types: CWE-1246 Description: Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanently damaged when enabling the Stream security option (signing of the video stream) with option MD5, SHA-1 or SHA-256. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-435698-BT.html
CVE ID: CVE-2023-32230 State: PUBLISHED Published: 2023-12-18T12:58:08.690Z Last Updated: 2024-08-02T15:10:24.221Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Bosch Products: Video Recording Manager, Video Streaming Gateway, Monitorwall, VJD-7513, VJD-7523 Problem Types: CWE-703 Description: An improper handling of a malformed API request to an API server in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-092656-BT.html
CVE ID: CVE-2023-32231 State: PUBLISHED Published: 2023-07-25T00:00:00 Last Updated: 2024-10-23T20:06:56.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Vasion PrinterLogic Client for Windows before 25.0.0.818. During installation, binaries gets executed out of a subfolder in C:\Windows\Temp. A standard user can create the folder and path file ahead of time and obtain elevated code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.printercloud.com/1-Printerlogic/Release_Notes/Client_Release_Notes.htm - https://www.vasion.com/press-releases/printerlogic-rebrands - https://docs.printerclo
e_Notes/Client_Release_Notes.htm - https://www.vasion.com/press-releases/printerlogic-rebrands - https://docs.printercloud.com/1-Printerlogic/Release_Notes/Security_Bulletin_CVE.htm
CVE ID: CVE-2023-32232 State: PUBLISHED Published: 2023-07-25T00:00:00 Last Updated: 2024-10-24T14:38:38.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Vasion PrinterLogic Client for Windows before 25.0.0.836. During client installation and repair, a PrinterLogic binary is called by the installer to configure the device. This window is not hidden, and is running with elevated privileges. A standard user can break out of this window, obtaining a full SYSTEM command prompt window. This results in complete compromise via arbitrary SYSTEM code execution (elevation of privileges). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichmen
STEM code execution (elevation of privileges). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.printercloud.com/1-Printerlogic/Release_Notes/Client_Release_Notes.htm - https://www.vasion.com/press-releases/printerlogic-rebrands - https://docs.printercloud.com/1-Printerlogic/Release_Notes/Security_Bulletin_CVE.htm
CVE ID: CVE-2023-32233 State: PUBLISHED Published: 2023-05-08T00:00:00.000Z Last Updated: 2025-05-05T15:58:00.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openwall.com/lists/oss-security/2023/05/08/4 - https://github.com/torvalds/linux/commit/c1592a89942e9678f7d9c8030efa777c0d57edab - http
sts/oss-security/2023/05/08/4 - https://github.com/torvalds/linux/commit/c1592a89942e9678f7d9c8030efa777c0d57edab - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c1592a89942e9678f7d9c8030efa777c0d57edab - https://news.ycombinator.com/item?id=35879660 - https://bugzilla.redhat.com/show_bug.cgi?id=2196105 - https://www.debian.org/security/2023/dsa-5402 - http://www.openwall.com/lists/oss-security/2023/05/15/5 - https://lists.debian.org/debian-lts-announce/2023/06/msg00008.html - https://security.netapp.com/advisory/ntap-20230616-0002/ - http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html - https://lists.debian.org/debian-lt
ketstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html - https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html
CVE ID: CVE-2023-32235 State: PUBLISHED Published: 2023-05-05T00:00:00.000Z Last Updated: 2025-01-29T16:29:07.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TryGhost/Ghost/commit/378dd913aa8d0fd0da29b0ffced8884579598b0f - https://github.com/TryGhost/Ghost/compare/v5.42.0...v5.42.1
CVE ID: CVE-2023-32236 State: PUBLISHED Published: 2023-08-23T13:04:56.402Z Last Updated: 2024-09-25T14:38:02.491Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Booking Ultra Pro Products: Booking Ultra Pro Appointments Booking Calendar Plugin Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Booking Ultra Pro Booking Ultra Pro Appointments Booking Calendar Plugin <= 1.1.8 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/booking-ultra-pro/wordpress-booking-ultra-pro-appointments-booking-calendar-plugin-plugin-1-1-4-c
database/vulnerability/booking-ultra-pro/wordpress-booking-ultra-pro-appointments-booking-calendar-plugin-plugin-1-1-4-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-32237 State: PUBLISHED Published: 2024-03-26T08:53:36.874Z Last Updated: 2024-08-06T14:35:24.222Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: CodexThemes Products: TheGem (Elementor), TheGem (WPBakery) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem (Elementor), CodexThemes TheGem (WPBakery) allows Stored XSS.This issue affects TheGem (Elementor): from n/a before 5.8.1.1; TheGem (WPBakery): from n/a before 5.8.1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/datab
. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/thegem-elementor/wordpress-thegem-elementor-theme-5-7-2-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve - https://patchstack.com/database/vulnerability/thegem/wordpress-thegem-wpbakery-theme-5-7-2-authenticated-cross-site-scripting-vulnerability?_s_id=cve
CVE ID: CVE-2023-32239 State: PUBLISHED Published: 2023-06-22T12:11:21.717Z Last Updated: 2024-10-10T17:21:38.489Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: xtemos Products: WoodMart Problem Types: CWE-79 Description: Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in xtemos WoodMart theme <= 7.2.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woodmart/wordpress-woodmart-theme-7-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-32240 State: PUBLISHED Published: 2025-01-02T15:05:19.181Z Last Updated: 2025-01-03T18:56:41.932Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Xtemos Products: WoodMart Problem Types: CWE-862 Description: Missing Authorization vulnerability in Xtemos WoodMart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WoodMart: from n/a through 7.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/woodmart/vulnerability/wordpress-woodmart-theme-7-2-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-32241 State: PUBLISHED Published: 2023-08-29T20:11:55.422Z Last Updated: 2024-09-24T19:24:41.692Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: WPDeveloper Products: Essential Addons for Elementor Pro Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPDeveloper Essential Addons for Elementor Pro plugin <= 5.4.8 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/essential-addons-elementor/wordpress-essential-addons-for-elementor-pro-plugin-5-4-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cv
ntor/wordpress-essential-addons-for-elementor-pro-plugin-5-4-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-32242 State: PUBLISHED Published: 2023-12-21T13:03:00.672Z Last Updated: 2025-08-27T03:30:59.746Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: xTemos Products: WoodMart - Multipurpose WooCommerce Theme Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme.This issue affects WoodMart - Multipurpose WooCommerce Theme: from n/a through 1.0.36. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woodmart-core/wordpress-woodmart-core-plugin-1-0-36-php-object-injection?_s_id=cve
CVE ID: CVE-2023-32243 State: PUBLISHED Published: 2023-05-12T07:23:22.657Z Last Updated: 2025-02-13T16:50:27.371Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WPDeveloper Products: Essential Addons for Elementor Problem Types: CWE-287 Description: Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/essential-addons-for-elementor-lite/wordpress-essential-addons-for-elementor-plugin-5-
hstack.com/database/vulnerability/essential-addons-for-elementor-lite/wordpress-essential-addons-for-elementor-plugin-5-4-0-5-7-1-unauthenticated-privilege-escalation-vulnerability?_s_id=cve - https://patchstack.com/articles/critical-privilege-escalation-in-essential-addons-for-elementor-plugin-affecting-1-million-sites?_s_id=cve - http://packetstormsecurity.com/files/172457/WordPress-Elementor-Lite-5.7.1-Arbitrary-Password-Reset.html
CVE ID: CVE-2023-32244 State: PUBLISHED Published: 2024-05-17T06:43:13.814Z Last Updated: 2025-08-27T03:32:26.079Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: xtemos Products: Woodmart Core Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in xtemos Woodmart Core allows Privilege Escalation.This issue affects Woodmart Core: from n/a through 1.0.36. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woodmart-core/wordpress-woodmart-core-plugin-1-0-36-privilege-escalation?_s_id=cve
CVE ID: CVE-2023-32245 State: PUBLISHED Published: 2023-11-18T22:32:56.251Z Last Updated: 2024-10-01T15:49:26.632Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: WPDeveloper Products: Essential Addons for Elementor Pro Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WPDeveloper Essential Addons for Elementor Pro.This issue affects Essential Addons for Elementor Pro: from n/a through 5.4.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/essential-addons-elementor/wordpress-essential-addons-for-elementor-pro-plugin-5-4-8-unauthentica
database/vulnerability/essential-addons-elementor/wordpress-essential-addons-for-elementor-pro-plugin-5-4-8-unauthenticated-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-32246 State: PUBLISHED Published: 2025-08-16T13:22:09.212Z Last Updated: 2025-09-03T12:31:51.521Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: call rcu_barrier() in ksmbd_server_exit() racy issue is triggered the bug by racing between closing a connection and rmmod. In ksmbd, rcu_barrier() is not called at module unload time, so nothing prevents ksmbd from getting unloaded while it still has RCU callbacks pending. It leads to trigger unintended execution of kernel code locally and use to defeat protections such as Kernel Lockdown References: - https://git.kernel.org/stable/c/c053e389db0d892e2ff5a60ec5e
to defeat protections such as Kernel Lockdown References: - https://git.kernel.org/stable/c/c053e389db0d892e2ff5a60ec5e533b976503795 - https://git.kernel.org/stable/c/b80422474ffe44cb5e813cd6da1f1c6bc50fd9d2 - https://git.kernel.org/stable/c/d4174505016a3b2996eb7ff1530dcabbf15d47b6 - https://git.kernel.org/stable/c/5a7090ccc242ab009ee7769e9d7fad6644dbe9bd - https://git.kernel.org/stable/c/eb307d09fe15844fdaebeb8cc8c9b9e925430aa5
CVE ID: CVE-2023-32247 State: PUBLISHED Published: 2023-07-24T15:19:23.840Z Last Updated: 2024-08-02T15:10:23.979Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a, Red Hat, Fedora Products: kernel, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Fedora Problem Types: CWE-401 Description: A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condi
lack of control of resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-32247 - https://bugzilla.redhat.com/show_bug.cgi?id=2219803 - https://security.netapp.com/advisory/ntap-20230915-0011/ - https://www.zerodayinitiative.com/advisories/ZDI-CAN-20478/
CVE ID: CVE-2023-32248 State: PUBLISHED Published: 2023-07-24T15:19:27.342Z Last Updated: 2024-08-02T15:10:24.244Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a, Red Hat, Fedora Products: kernel, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Fedora Problem Types: CWE-476 Description: A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_TREE_CONNECT and SMB2_QUERY_INFO commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerabi
e results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-32248 - https://bugzilla.redhat.com/show_bug.cgi?id=2219818 - https://security.netapp.com/advisory/ntap-20230915-0006/ - https://www.zerodayinitiative.com/advisories/ZDI-CAN-20479/
CVE ID: CVE-2023-32249 State: PUBLISHED Published: 2025-08-16T13:25:49.645Z Last Updated: 2025-09-03T12:31:53.065Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: not allow guest user on multichannel This patch return STATUS_NOT_SUPPORTED if binding session is guest. References: - https://git.kernel.org/stable/c/ed76d3a8910be06cd4e4ba63bf6075bf903945a1 - https://git.kernel.org/stable/c/1f0490586544455e5be698be2e6c30077b4ec461 - https://git.kernel.org/stable/c/4a98e859c4673013385a54084e0cd865695ca072 - https://git.kernel.org/stable/c/088131b7b01099720a528a72005ff17868705d40 - https://git.kernel.org/stable/c/3353ab2df5f68da
tps://git.kernel.org/stable/c/088131b7b01099720a528a72005ff17868705d40 - https://git.kernel.org/stable/c/3353ab2df5f68dab7da8d5ebb427a2d265a1f2b2
CVE ID: CVE-2023-32250 State: PUBLISHED Published: 2023-07-10T15:09:37.474Z Last Updated: 2025-02-13T16:50:28.282Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a, Red Hat, Fedora Products: kernel, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Fedora Problem Types: CWE-362 Description: A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execu