Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-42787 State: PUBLISHED Published: 2023-10-10T16:48:46.963Z Last Updated: 2025-02-13T17:09:41.670Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:X) Vendors: Fortinet Products: FortiManager, FortiAnalyzer Problem Types: CWE-602 Description: A client-side enforcement of server-side security [CWE-602] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 may allow a remote attacker with low privileges to access a privileged web console via client side code execution. Additional Analyst Notes: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-187 - htt
cution. Additional Analyst Notes: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-187 - https://github.com/orangecertcc/security-research/security/advisories/GHSA-q5pq-8666-j8fr
CVE ID: CVE-2023-42788 State: PUBLISHED Published: 2023-10-10T16:48:56.210Z Last Updated: 2025-02-13T17:09:42.473Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiAnalyzer, FortiManager Problem Types: CWE-78 Description: An improper neutralization of special elements used in an os command ('OS Command Injection') vulnerability [CWE-78] in FortiManager & FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.8, version 6.4.0 through 6.4.12 and version 6.2.0 through 6.2.11 may allow a local attacker with low privileges to execute unauthorized code via specifically crafted arguments to a CLI comma
llow a local attacker with low privileges to execute unauthorized code via specifically crafted arguments to a CLI command Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-167 - https://github.com/orangecertcc/security-research/security/advisories/GHSA-qpv8-g6qv-rf8p
CVE ID: CVE-2023-42789 State: PUBLISHED Published: 2024-03-12T15:09:18.416Z Last Updated: 2024-08-12T18:00:28.370Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiOS, FortiPAM, FortiProxy Problem Types: CWE-787 Description: A out-of-bounds write in Fortinet FortiOS 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, FortiProxy 7.4.0, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 2.0.0 through 2.0.13 allows attacker to execute unauthorized code or commands via specially crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
mmands via specially crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-328
CVE ID: CVE-2023-42790 State: PUBLISHED Published: 2024-03-12T15:09:17.594Z Last Updated: 2024-09-17T14:08:06.101Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiProxy, FortiOS Problem Types: CWE-121 Description: A stack-based buffer overflow in Fortinet FortiOS 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, FortiProxy 7.4.0, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 2.0.0 through 2.0.13 allows attacker to execute unauthorized code or commands via specially crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
via specially crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-328
CVE ID: CVE-2023-42791 State: PUBLISHED Published: 2024-02-20T13:19:20.221Z Last Updated: 2024-08-02T19:30:24.297Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiManager, FortiAnalyzer Problem Types: CWE-23 Description: A relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0.0 through 7.0.8 and 6.4.0 through 6.4.12 and 6.2.0 through 6.2.11 allows attacker to execute unauthorized code or commands via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-189
CVE ID: CVE-2023-42792 State: PUBLISHED Published: 2023-10-14T09:47:07.741Z Last Updated: 2025-02-13T17:09:43.150Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-668 Description: Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't. Users of Apache Airflow are strongly advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability. Additional Analyst Notes:
to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/34366 - https://lists.apache.org/thread/1spbo9nkn49fc2hnxqm9tf6mgqwp9tjq - http://www.openwall.com/lists/oss-security/2023/12/21/1
CVE ID: CVE-2023-42793 State: PUBLISHED Published: 2023-09-19T16:57:29.245Z Last Updated: 2025-10-21T23:05:37.592Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: JetBrains Products: TeamCity Problem Types: CWE-288 Description: In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/ - https://blog.jetbrains.com/teamcity/2023/09/cve-2023-42793-vulnerability-post-mortem/ - http://packetstormsecurity.com/files/174860/JetBrains-TeamCity-Unauthenticated-Remote-Code-
vulnerability-post-mortem/ - http://packetstormsecurity.com/files/174860/JetBrains-TeamCity-Unauthenticated-Remote-Code-Execution.html - https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793 - https://www.securityweek.com/recently-patched-teamcity-vulnerability-exploited-to-hack-servers/ - https://www.rapid7.com/blog/post/2023/09/25/etr-cve-2023-42793-critical-authentication-bypass-in-jetbrains-teamcity-ci-cd-servers/ - https://www.sonarsource.com/blog/teamcity-vulnerability/
CVE ID: CVE-2023-42794 State: PUBLISHED Published: 2023-10-10T17:17:01.378Z Last Updated: 2025-10-29T12:04:10.367Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-459 Description: Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full. Ot
ould never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full. Other, EOL versions may also be affected. Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82
CVE ID: CVE-2023-42795 State: PUBLISHED Published: 2023-10-10T17:42:16.705Z Last Updated: 2025-10-29T12:02:59.708Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-459 Description: Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M12 onwards,
e to the next. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/065jfyo583490r9j2v73nhpyxdob56lw
CVE ID: CVE-2023-42796 State: PUBLISHED Published: 2023-10-10T10:21:26.106Z Last Updated: 2025-02-27T20:46:01.630Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: CP-8031 MASTER MODULE, CP-8050 MASTER MODULE Problem Types: CWE-22 Description: A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.11), CP-8050 MASTER MODULE (All versions < CPCI85 V05.11). The web server of affected devices fails to properly sanitize user input for the /sicweb-ajax/tmproot/ endpoint. This could allow an authenticated remote attacker to traverse directories on the system and download arbitrary files. By exploring ac
low an authenticated remote attacker to traverse directories on the system and download arbitrary files. By exploring active session IDs, the vulnerability could potentially be leveraged to escalate privileges to the administrator role. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-770890.pdf
CVE ID: CVE-2023-42797 State: PUBLISHED Published: 2024-01-09T09:59:43.539Z Last Updated: 2025-06-03T14:32:53.676Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: CP-8031 MASTER MODULE, CP-8050 MASTER MODULE Problem Types: CWE-908 Description: A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.20), CP-8050 MASTER MODULE (All versions < CPCI85 V05.20). The network configuration service of affected devices contains a flaw in the conversion of ipv4 addresses that could lead to an uninitialized variable being used in succeeding validation steps. By uploading specially crafted network configurat
o an uninitialized variable being used in succeeding validation steps. By uploading specially crafted network configuration, an authenticated remote attacker could be able to inject commands that are executed on the device with root privileges during device startup. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-583634.pdf
CVE ID: CVE-2023-42798 State: PUBLISHED Published: 2023-09-22T15:13:48.283Z Last Updated: 2024-09-24T14:29:01.589Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H) Vendors: ChewKeanHo Products: AutomataCI Problem Types: CWE-20 Description: AutomataCI is a template git repository equipped with a native built-in semi-autonomous CI tools. An issue in versions 1.4.1 and below can let a release job reset the git root repository to the first commit. Version 1.5.0 has a patch for this issue. As a workaround, make sure the `PROJECT_PATH_RELEASE` (e.g. `releases/`) directory is manually and actually `git cloned` properly, making it a different git repostiory from the root git re
s/`) directory is manually and actually `git cloned` properly, making it a different git repostiory from the root git repository. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ChewKeanHo/AutomataCI/security/advisories/GHSA-6q23-vhhg-8h89 - https://github.com/ChewKeanHo/AutomataCI/issues/93
CVE ID: CVE-2023-42799 State: PUBLISHED Published: 2023-12-14T16:47:00.932Z Last Updated: 2024-10-08T14:20:49.115Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: moonlight-stream Products: moonlight-common-c Problem Types: CWE-120 Description: Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit 50c0a51b10ecc5b3415ea78c21d96d679e2288f9 due to unmitigated usage of unsafe C functions and improper bounds checking. A malicious game streaming server could exploit a buffer overflow vulnerability to crash a moonlight client, or achieve remote code executio
eaming server could exploit a buffer overflow vulnerability to crash a moonlight client, or achieve remote code execution (RCE) on the client (with insufficient exploit mitigations or if mitigations can be bypassed). The bug was addressed in commit 02b7742f4d19631024bd766bd2bb76715780004e. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/moonlight-stream/moonlight-common-c/security/advisories/GHSA-r8cf-45f4-vf8m - https://github.com/moonlight-stream/moonlight-common-c/commit/02b7742f4d19631024bd766bd2bb76715780004e - https://github.com/moonlight-stream/moonlight-common-c/commit/50c0a51b10ecc5b3415ea78c21d96d679e2288f9
CVE ID: CVE-2023-42800 State: PUBLISHED Published: 2023-12-14T16:57:44.846Z Last Updated: 2024-11-27T15:50:13.246Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: moonlight-stream Products: moonlight-common-c Problem Types: CWE-120 Description: Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit 50c0a51b10ecc5b3415ea78c21d96d679e2288f9 due to unmitigated usage of unsafe C functions and improper bounds checking. A malicious game streaming server could exploit a buffer overflow vulnerability to crash a moonlight client, or achieve remote code executio
eaming server could exploit a buffer overflow vulnerability to crash a moonlight client, or achieve remote code execution (RCE) on the client (with insufficient exploit mitigations or if mitigations can be bypassed). The bug was addressed in commit 24750d4b748fefa03d09fcfd6d45056faca354e0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/moonlight-stream/moonlight-common-c/security/advisories/GHSA-4927-23jw-rq62 - https://github.com/moonlight-stream/moonlight-common-c/commit/24750d4b748fefa03d09fcfd6d45056faca354e0 - https://github.com/moonlight-stream/moonlight-common-c/commit/50c0a51b10ecc5b3415ea78c21d96d679e2288f9 - https://gith
- https://github.com/moonlight-stream/moonlight-common-c/commit/50c0a51b10ecc5b3415ea78c21d96d679e2288f9 - https://github.com/moonlight-stream/moonlight-common-c/blob/2bb026c763fc18807d7e4a93f918054c488f84e1/src/RtspConnection.c#L796
CVE ID: CVE-2023-42801 State: PUBLISHED Published: 2023-12-14T17:02:04.647Z Last Updated: 2024-08-02T19:30:24.310Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H) Vendors: moonlight-stream Products: moonlight-common-c Problem Types: CWE-120 Description: Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit f57bd745b4cbed577ea654fad4701bea4d38b44c. A malicious game streaming server could exploit a buffer overflow vulnerability to crash a moonlight client. Achieving RCE is possible but unlikely, due to stack canaries in use by modern compiler toolchains. The pub
ight client. Achieving RCE is possible but unlikely, due to stack canaries in use by modern compiler toolchains. The published binaries for official clients Qt, Android, iOS/tvOS, and Embedded are built with stack canaries, but some unofficial clients may not use stack canaries. This vulnerability takes place after the pairing process, so it requires the client to be tricked into pairing to a malicious host. It is not possible to perform using a man-in-the-middle due to public key pinning that takes place during the pairing process. The bug was addressed in commit b2497a3918a6d79808d9fd0c04734786e70d5954. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/moo
8a6d79808d9fd0c04734786e70d5954. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/moonlight-stream/moonlight-common-c/security/advisories/GHSA-f3h8-j898-5h5v - https://github.com/moonlight-stream/moonlight-common-c/commit/b2497a3918a6d79808d9fd0c04734786e70d5954 - https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c - https://github.com/moonlight-stream/moonlight-common-c/blob/c1744de06938b5a5c8897a705be1bc6508dc7580/src/Misc.c#L82-L88
CVE ID: CVE-2023-42802 State: PUBLISHED Published: 2023-11-02T13:32:33.840Z Last Updated: 2024-09-05T15:16:42.339Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: glpi-project Products: glpi Problem Types: CWE-20 Description: GLPI is a free asset and IT management software package. Starting in version 10.0.7 and prior to version 10.0.10, an unverified object instantiation allows one to upload malicious PHP files to unwanted directories. Depending on web server configuration and available system libraries, malicious PHP files can then be executed through a web server request. Version 10.0.10 fixes this issue. As a workaround, remove write access on `/ajax` a
ecuted through a web server request. Version 10.0.10 fixes this issue. As a workaround, remove write access on `/ajax` and `/front` files to the web server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-rrh2-x4ch-pq3m - https://github.com/glpi-project/glpi/releases/tag/10.0.10
CVE ID: CVE-2023-42803 State: PUBLISHED Published: 2023-10-30T18:11:35.630Z Last Updated: 2024-09-06T20:12:00.883Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: bigbluebutton Products: bigbluebutton Problem Types: CWE-434 Description: BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the insertDocument API call does not validate the given file extension before saving the file, and does not remove it in case of validation failures. BigBlueButton 2.6.0-beta.2 contains a patch. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA
.6.0-beta.2 contains a patch. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-w98f-6x8w-xhjc - https://github.com/bigbluebutton/bigbluebutton/pull/15990
CVE ID: CVE-2023-42804 State: PUBLISHED Published: 2023-10-30T18:14:41.419Z Last Updated: 2024-09-05T20:23:14.540Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: bigbluebutton Products: bigbluebutton Problem Types: CWE-22 Description: BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.1 has a path traversal vulnerability that allows an attacker with a valid starting folder path, to traverse and read other files without authentication, assuming the files have certain extensions (txt, swf, svg, png). In version 2.6.0-beta.1, input validation was added on the parameters being passed and dangerous characters are stripped.
version 2.6.0-beta.1, input validation was added on the parameters being passed and dangerous characters are stripped. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3qjg-229m-vq84 - https://github.com/bigbluebutton/bigbluebutton/pull/15960
CVE ID: CVE-2023-42805 State: PUBLISHED Published: 2023-09-21T16:39:56.350Z Last Updated: 2024-09-24T15:03:39.325Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: quinn-rs Products: quinn Problem Types: CWE-20 Description: quinn-proto is a state machine for the QUIC transport protocol. Prior to versions 0.9.5 and 0.10.5, receiving unknown QUIC frames in a QUIC packet could result in a panic. The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/quinn-rs/quinn/security/advisories/GHSA-q8wc-j5m9-27w3 - https://github.com/quinn-rs/quinn/pull
es: - https://github.com/quinn-rs/quinn/security/advisories/GHSA-q8wc-j5m9-27w3 - https://github.com/quinn-rs/quinn/pull/1667 - https://github.com/quinn-rs/quinn/pull/1668 - https://github.com/quinn-rs/quinn/pull/1669
CVE ID: CVE-2023-42806 State: PUBLISHED Published: 2023-09-21T16:45:34.742Z Last Updated: 2024-09-24T14:50:38.940Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: input-output-hk Products: hydra Problem Types: CWE-347 Description: Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, not signing and verifying `$\mathsf{cid}$` allows an attacker (which must be a participant of this head) to use a snapshot from an old head instance with the same participants to close the head or contest the state with it. This can lead to an incorrect distribution of value (= value extraction attack; hard, but possible) or prevent the head to finali
lead to an incorrect distribution of value (= value extraction attack; hard, but possible) or prevent the head to finalize because the value available is not consistent with the closed utxo state (= denial of service; easy). A patch is planned for version 0.13.0. As a workaround, rotate keys between heads so not to re-use keys and not result in the same multi-signature participants. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/input-output-hk/hydra/security/advisories/GHSA-gr36-mc6v-72qq - https://github.com/input-output-hk/hydra/blob/ec6c7a2ab651462228475d0b34264e9a182c22bb/hydra-node/src/Hydra/HeadLogic.hs#L357 - https://githu
put-output-hk/hydra/blob/ec6c7a2ab651462228475d0b34264e9a182c22bb/hydra-node/src/Hydra/HeadLogic.hs#L357 - https://github.com/input-output-hk/hydra/blob/ec6c7a2ab651462228475d0b34264e9a182c22bb/hydra-node/src/Hydra/Snapshot.hs#L50-L54 - https://github.com/input-output-hk/hydra/blob/ec6c7a2ab651462228475d0b34264e9a182c22bb/hydra-plutus/src/Hydra/Contract/Head.hs#L583-L599
CVE ID: CVE-2023-42807 State: PUBLISHED Published: 2023-09-21T16:37:49.041Z Last Updated: 2024-09-24T14:50:49.075Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: frappe Products: lms Problem Types: CWE-89 Description: Frappe LMS is an open source learning management system. In versions 1.0.0 and prior, on the People Page of LMS, there was an SQL Injection vulnerability. The issue has been fixed in the `main` branch. Users won't face this issue if they are using the latest main branch of the app. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/frappe/lms/security/advisories/GHSA-wvq3-3wvp-6x63
CVE ID: CVE-2023-42808 State: PUBLISHED Published: 2023-10-04T19:11:22.906Z Last Updated: 2024-09-19T19:17:23.395Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Mozilla Products: common-voice Problem Types: CWE-79 Description: Common Voice is the web app for Mozilla Common Voice, a platform for collecting speech donations in order to create public domain datasets for training voice recognition-related tools. Version 1.88.2 is vulnerable to reflected Cross-Site Scripting given that user-controlled data flows to a path expression (path of a network request). This issue may lead to reflected Cross-Site Scripting (XSS) in the context of Common Voice’s server o