Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
m Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1753 - https://www.softether.org/9-about/News/904-SEVPN202301
CVE ID: CVE-2023-32276 State: PUBLISHED Published: 2023-06-19T00:00:00 Last Updated: 2024-12-23T21:29:55.420Z Vendors: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. Products: TELLUS and TELLUS Lite Problem Types: Stack-based Buffer Overflow Description: Stack-based buffer overflow vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. Opening a specially crafted V8 file may lead to information disclosure and/or arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php - https://jvn.jp/en/vu/JVNVU98818508/
CVE ID: CVE-2023-32277 State: PUBLISHED Published: 2025-02-12T21:18:43.309Z Last Updated: 2025-02-13T15:25:30.347Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: n/a Products: Intel(R) QAT software Problem Types: Information Disclosure, CWE-822 Description: Untrusted Pointer Dereference in I/O subsystem for some Intel(R) QAT software before version 2.0.5 may allow authenticated user to potentially enable information disclosure via local operating system access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01124.html
CVE ID: CVE-2023-32278 State: PUBLISHED Published: 2023-11-14T19:04:49.530Z Last Updated: 2024-08-30T16:10:07.345Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) NUC Uniwill Service Driver for Intel(R) NUC M15 Laptop Kits - LAPRC510 & LAPRC710 Uniwill Service Driver installation software Problem Types: escalation of privilege, CWE-249 Description: Path transversal in some Intel(R) NUC Uniwill Service Driver for Intel(R) NUC M15 Laptop Kits - LAPRC510 & LAPRC710 Uniwill Service Driver installation software before version 1.0.1.7 for Intel(R) NUC Software Studio may allow an authenticated user to potentially enable escalation of privile
ion 1.0.1.7 for Intel(R) NUC Software Studio may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00908.html
CVE ID: CVE-2023-32279 State: PUBLISHED Published: 2023-11-14T19:04:39.018Z Last Updated: 2024-08-30T17:41:42.128Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: Intel(R) Connectivity Performance Suite Problem Types: information disclosure, CWE-284 Description: Improper access control in user mode driver for some Intel(R) Connectivity Performance Suite before version 2.1123.214.2 may allow unauthenticated user to potentially enable information disclosure via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00944.html
CVE ID: CVE-2023-32280 State: PUBLISHED Published: 2024-02-14T13:37:51.570Z Last Updated: 2024-08-14T17:50:42.293Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Intel(R) Server Product OpenBMC firmware Problem Types: information disclosure, CWE-522 Description: Insufficiently protected credentials in some Intel(R) Server Product OpenBMC firmware before versions egs-1.05 may allow an unauthenticated user to enable information disclosure via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00922.html
CVE ID: CVE-2023-32281 State: PUBLISHED Published: 2023-06-06T15:15:17.540Z Last Updated: 2025-01-07T16:32:12.183Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Horner Automation Products: Cscape, Cscape EnvisionRV Problem Types: CWE-125 Description: The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This could lead to an out-of-bounds read in the FontManager. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advis
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04
CVE ID: CVE-2023-32282 State: PUBLISHED Published: 2024-03-14T16:45:47.270Z Last Updated: 2025-04-10T20:31:56.746Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H) Vendors: n/a Products: Intel(R) Processors Problem Types: escalation of privilege, CWE-367 Description: Race condition in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00929.html
CVE ID: CVE-2023-32283 State: PUBLISHED Published: 2023-11-14T19:04:40.842Z Last Updated: 2024-08-30T15:23:10.886Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: Intel(R) On Demand software Problem Types: information disclosure, CWE-532 Description: Insertion of sensitive information into log file in some Intel(R) On Demand software before versions 1.16.2, 2.1.1, 3.1.0 may allow an authenticated user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00914.html
CVE ID: CVE-2023-32284 State: PUBLISHED Published: 2023-09-25T15:22:34.524Z Last Updated: 2025-11-04T19:16:06.011Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Accusoft Products: ImageGear Problem Types: CWE-119 Description: An out-of-bounds write vulnerability exists in the tiff_planar_adobe functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1750
CVE ID: CVE-2023-32285 State: PUBLISHED Published: 2023-08-11T02:37:31.850Z Last Updated: 2024-10-01T20:48:23.927Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) NUC BIOS firmware Problem Types: denial of service, CWE-284 Description: Improper access control in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable denial of service via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00917.html
CVE ID: CVE-2023-32288 State: PUBLISHED Published: 2023-06-19T00:00:00 Last Updated: 2024-12-23T21:28:50.441Z Vendors: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. Products: TELLUS and TELLUS Lite Problem Types: Out-of-bounds read Description: Out-of-bounds read vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. Opening a specially crafted SIM file may lead to information disclosure and/or arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php - https://jvn.jp/en/vu/JVNVU98818508/
CVE ID: CVE-2023-32289 State: PUBLISHED Published: 2023-06-06T15:13:13.877Z Last Updated: 2025-01-07T16:33:27.970Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Horner Automation Products: Cscape, Cscape EnvisionRV Problem Types: CWE-125 Description: The affected application lacks proper validation of user-supplied data when parsing project files (e.g.., CSP). This could lead to an out-of-bounds read in IO_CFG. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/ic
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04
CVE ID: CVE-2023-32290 State: PUBLISHED Published: 2023-05-07T00:00:00.000Z Last Updated: 2025-01-29T15:48:34.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: The myMail app through 14.30 for iOS sends cleartext credentials in a situation where STARTTLS is expected by a server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://news.ycombinator.com/item?id=35845308 - https://apps.apple.com/fm/app/mymail-email-app-for-gmail/id722120997 - https://mailbox.org/en/post/mailbox-org-discovers-unencrypted-password-transmission-in-mymail
CVE ID: CVE-2023-32291 State: PUBLISHED Published: 2023-11-30T12:29:50.197Z Last Updated: 2024-08-02T15:10:24.353Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: MonsterInsights Products: MonsterInsights Pro Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MonsterInsights Pro allows Stored XSS.This issue affects MonsterInsights Pro: from n/a through 8.14.1. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/google-analytics-premium/wordpress-monsterinsights-pro-plugin-8-14-1-cross-site-scripting-xss-vulnerabilit
vulnerability/google-analytics-premium/wordpress-monsterinsights-pro-plugin-8-14-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-32292 State: PUBLISHED Published: 2023-08-08T12:55:27.284Z Last Updated: 2024-09-25T16:47:22.430Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: GetButton Products: Chat Button by GetButton.io Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GetButton Chat Button by GetButton.Io plugin <= 1.8.9.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/whatshelp-chat-button/wordpress-chat-button-plugin-1-8-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-32293 State: PUBLISHED Published: 2024-12-09T11:30:56.137Z Last Updated: 2024-12-09T16:48:59.299Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Realwebcare Products: WRC Pricing Tables Problem Types: CWE-862 Description: Missing Authorization vulnerability in Realwebcare WRC Pricing Tables allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WRC Pricing Tables: from n/a through 2.3.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wrc-pricing-tables/vulnerability/wordpress-wrc-pricing-tables-plugin-2-3-7-broken-access-control-vulnerabil
press/plugin/wrc-pricing-tables/vulnerability/wordpress-wrc-pricing-tables-plugin-2-3-7-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-32294 State: PUBLISHED Published: 2023-08-30T15:00:18.275Z Last Updated: 2024-09-24T19:09:12.468Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Radical Web Design Products: GDPR Cookie Consent Notice Box Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Radical Web Design GDPR Cookie Consent Notice Box plugin <= 1.1.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/cookie-consent-box/wordpress-gdpr-cookie-consent-notice-box-plugin-1-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-32295 State: PUBLISHED Published: 2024-04-11T11:54:45.773Z Last Updated: 2025-02-11T21:53:01.796Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: Alex Tselegidis Products: Easy!Appointments Problem Types: CWE-862 Description: Missing Authorization vulnerability in Alex Tselegidis Easy!Appointments.This issue affects Easy!Appointments: from n/a through 1.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/easyappointments/wordpress-easy-appointments-plugin-1-3-1-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2023-32296 State: PUBLISHED Published: 2023-09-04T11:12:07.409Z Last Updated: 2024-09-24T18:51:05.414Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Kangu Products: Kangu para WooCommerce Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kangu para WooCommerce plugin <= 2.2.9 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/kangu/wordpress-kangu-para-woocommerce-plugin-2-2-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-32297 State: PUBLISHED Published: 2024-05-17T06:44:37.724Z Last Updated: 2024-08-02T15:10:24.444Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: LWS Products: LWS Affiliation Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LWS LWS Affiliation allows PHP Local File Inclusion.This issue affects LWS Affiliation: from n/a through 2.2.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/lws-affiliation/wordpress-lws-affiliation-plugin-2-2-6-local-file-inclusion-vulnerability?_s_i
om/database/vulnerability/lws-affiliation/wordpress-lws-affiliation-plugin-2-2-6-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2023-32298 State: PUBLISHED Published: 2023-11-08T15:57:17.370Z Last Updated: 2024-09-04T14:05:40.541Z Vendors: Kathy Darling Products: Simple User Listing Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kathy Darling Simple User Listing plugin <= 1.9.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/simple-user-listing/wordpress-simple-user-listing-plugin-1-9-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-32299 State: PUBLISHED Published: 2024-12-09T11:30:55.236Z Last Updated: 2024-12-09T16:55:59.731Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: anzia Products: Ni WooCommerce Sales Report Problem Types: CWE-862 Description: Missing Authorization vulnerability in anzia Ni WooCommerce Sales Report allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ni WooCommerce Sales Report: from n/a through 3.7.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ni-woocommerce-sales-report/vulnerability/wordpress-ni-woocommerce-sales-report-plugin-3-7-2
m/database/wordpress/plugin/ni-woocommerce-sales-report/vulnerability/wordpress-ni-woocommerce-sales-report-plugin-3-7-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-32300 State: PUBLISHED Published: 2023-08-23T14:12:36.529Z Last Updated: 2024-09-25T14:37:17.423Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Yoast Products: Yoast SEO: Local Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.8 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wpseo-local/wordpress-yoast-seo-local-plugin-14-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-32301 State: PUBLISHED Published: 2023-06-13T21:35:38.188Z Last Updated: 2025-01-02T21:05:51.203Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: discourse Products: discourse Problem Types: CWE-116 Description: Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, multiple duplicate topics could be created if topic embedding is enabled. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches. As a workaround, disable topic embedding if it has been enabled. Additional
5 of the `beta` and `tests-passed` branches. As a workaround, disable topic embedding if it has been enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-p2jx-m2j5-hqh4
CVE ID: CVE-2023-32302 State: REJECTED Published: 2023-08-01T10:44:39.231Z Last Updated: 2023-10-04T17:08:00.239Z Description: No description available.
CVE ID: CVE-2023-32303 State: PUBLISHED Published: 2023-05-12T20:55:07.601Z Last Updated: 2025-01-23T20:24:55.121Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: planetlabs Products: planet-client-python Problem Types: CWE-732 Description: Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but before version 2.0.1, its permissions allowed the user's group and non-group to read the file as well. This issue was patched in version 2.0.1. As a workaround, set the secret file permissions to only user read/write by hand. Additional Analyst Notes: - CVE
2.0.1. As a workaround, set the secret file permissions to only user read/write by hand. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/planetlabs/planet-client-python/security/advisories/GHSA-j5fj-rfh6-qj85 - https://github.com/planetlabs/planet-client-python/commit/d71415a83119c5e89d7b80d5f940d162376ee3b7 - https://github.com/planetlabs/planet-client-python/releases/tag/2.0.1
CVE ID: CVE-2023-32305 State: PUBLISHED Published: 2023-05-12T18:46:55.995Z Last Updated: 2025-02-13T16:50:30.580Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: aiven Products: aiven-extras Problem Types: CWE-20, CWE-1321 Description: aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages missing schema qualifiers on privileged functions called by the aiven-extras extension. A low privileged user can create objects that collide with existing function names, which will then be execute
xtension. A low privileged user can create objects that collide with existing function names, which will then be executed instead. Exploiting this vulnerability could allow a low privileged user to acquire `superuser` privileges, which would allow full, unrestricted access to all data and database functions. And could lead to arbitrary code execution or data access on the underlying host as the `postgres` user. The issue has been patched as of version 1.1.9. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aiven/aiven-extras/security/advisories/GHSA-7r4w-fw4h-67gp - https://github.com/aiven/aiven-extras/commit/8682ae01bec0791708bf25791786d776e2fb0250 - http
ories/GHSA-7r4w-fw4h-67gp - https://github.com/aiven/aiven-extras/commit/8682ae01bec0791708bf25791786d776e2fb0250 - https://security.netapp.com/advisory/ntap-20230616-0006/
CVE ID: CVE-2023-32306 State: PUBLISHED Published: 2023-05-12T18:52:59.374Z Last Updated: 2025-01-23T20:27:39.713Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: anuko Products: timetracker Problem Types: CWE-89 Description: Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. This was happening because the `reports.php` page was not validating all parameters in POST requests. Because some parameters were not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue is fixed in version 1.22.13.5792. As a
to craft POST requests with malicious SQL for Time Tracker database. This issue is fixed in version 1.22.13.5792. As a workaround, use the fixed code in `ttReportHelper.class.php` from version 1.22.13.5792. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/anuko/timetracker/security/advisories/GHSA-758x-vg7g-j9j3
CVE ID: CVE-2023-32307 State: PUBLISHED Published: 2023-05-26T22:11:16.875Z Last Updated: 2025-02-13T16:50:31.155Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: freeswitch Products: sofia-sip Problem Types: CWE-190, CWE-122 Description: Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. Referring to [GHSA-8599-x7rq-fr54](https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-8599-x7rq-fr54), several other potential heap-over-flow and integer-overflow in stun_parse_attr_error_code and stun_parse_attr_uint32 were found because the lack of attributes length check when Sofia-SIP handles STUN packets. The
stun_parse_attr_uint32 were found because the lack of attributes length check when Sofia-SIP handles STUN packets. The previous patch of [GHSA-8599-x7rq-fr54](https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-8599-x7rq-fr54) fixed the vulnerability when attr_type did not match the enum value, but there are also vulnerabilities in the handling of other valid cases. The OOB read and integer-overflow made by attacker may lead to crash, high consumption of memory or even other more serious consequences. These issue have been addressed in version 1.13.15. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
re advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-rm4c-ccvf-ff9c - https://lists.debian.org/debian-lts-announce/2023/06/msg00002.html - https://www.debian.org/security/2023/dsa-5431 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OY66DOQ3B7GULJTI66X5HNX5FU3P65CX/
CVE ID: CVE-2023-32308 State: PUBLISHED Published: 2023-05-15T20:47:06.537Z Last Updated: 2025-01-22T21:40:50.490Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) Vendors: anuko Products: timetracker Problem Types: CWE-89 Description: anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. This was happening because of a coding error after validating parameters in POST requests. There was no check for errors before adjusting invoice sorting order. Because of this, it was possible to craft a POST request with malicious SQL for Time Tracker database.