Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
om/mastodon/mastodon/releases/tag/v3.5.8 - https://github.com/mastodon/mastodon/releases/tag/v4.0.4 - https://github.com/mastodon/mastodon/releases/tag/v4.1.2 - http://www.openwall.com/lists/oss-security/2023/07/06/6
CVE ID: CVE-2023-28854 State: PUBLISHED Published: 2023-04-03T17:55:56.789Z Last Updated: 2025-02-11T14:35:47.164Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: paijp Products: nophp Problem Types: CWE-77 Description: nophp is a PHP web framework. Prior to version 0.0.1, nophp is vulnerable to shell command injection on httpd user. A patch was made available at commit e5409aa2d441789cbb35f6b119bef97ecc3986aa on 2023-03-30. Users should update index.php to 2023-03-30 or later or, as a workaround, add a function such as `env_patchsample230330.php` to env.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github
hp` to env.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/paijp/nophp/security/advisories/GHSA-9858-q3c2-9wwm - https://github.com/paijp/nophp/commit/e5409aa2d441789cbb35f6b119bef97ecc3986aa - https://github.com/paijp/nophp/releases/tag/v0.0.1
CVE ID: CVE-2023-28855 State: PUBLISHED Published: 2023-04-05T17:48:22.384Z Last Updated: 2025-02-10T16:27:40.112Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: pluginsGLPI Products: fields Problem Types: CWE-269 Description: Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no configured access. Versions 1.13.1 and 1.20.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://githu
for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pluginsGLPI/fields/security/advisories/GHSA-52vv-hm4x-8584 - https://github.com/pluginsGLPI/fields/commit/784260be7db185bb1e7d66b299997238c4c0205d - https://github.com/pluginsGLPI/fields/releases/tag/1.13.1 - https://github.com/pluginsGLPI/fields/releases/tag/1.20.4
CVE ID: CVE-2023-28856 State: PUBLISHED Published: 2023-04-18T20:50:03.691Z Last Updated: 2025-02-13T16:48:56.936Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: redis Products: redis Problem Types: CWE-617, CWE-20 Description: Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Ref
are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/redis/redis/security/advisories/GHSA-hjv8-vjf6-wcr6 - https://github.com/redis/redis/pull/11149 - https://github.com/redis/redis/commit/bc7fe41e5857a0854d524e2a63a028e9394d2a5c - https://lists.debian.org/debian-lts-announce/2023/04/msg00023.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQGKMKSQE67L32HE6W5EI2I2YKW5VWHI/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LPUTH7NBQTZDVJWFNUD24ZCS6NDUFYS6/ - https://lists.fedoraproject.org/archives
ge-announce@lists.fedoraproject.org/message/LPUTH7NBQTZDVJWFNUD24ZCS6NDUFYS6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EQ4DJSO4DMR55AWK6OPVJH5UTEB35R2Z/ - https://security.netapp.com/advisory/ntap-20230601-0007/
CVE ID: CVE-2023-28857 State: PUBLISHED Published: 2023-06-27T17:10:47.930Z Last Updated: 2024-11-27T19:03:39.948Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Apereo Products: CAS Problem Types: CWE-200 Description: Apereo CAS is an open source multilingual single sign-on solution for the web. Apereo CAS can be configured to use authentication based on client X509 certificates. These certificates can be provided via TLS handshake or a special HTTP header, such as “ssl_client_cert”. When checking the validity of the provided client certificate, X509CredentialsAuthenticationHandler performs check that this certificate is not revoked. To do so, it fetches URL
cate, X509CredentialsAuthenticationHandler performs check that this certificate is not revoked. To do so, it fetches URLs provided in the “CRL Distribution Points” extension of the certificate, which are taken from the certificate itself and therefore can be controlled by a malicious user. If the CAS server is configured to use an LDAP server for x509 authentication with a password, for example by setting a “cas.authn.x509.ldap.ldap-url” and “cas.authn.x509.ldap.bind-credential” properties, X509CredentialsAuthenticationHandler fetches revocation URLs from the certificate, which can be LDAP urls. When making requests to this LDAP urls, Apereo CAS uses the same password as for initially config
hich can be LDAP urls. When making requests to this LDAP urls, Apereo CAS uses the same password as for initially configured LDAP server, which can lead to a password leak. An unauthenticated user can leak the password used to LDAP connection configured on server. This issue has been addressed in version 6.6.6. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2023-009_Apereo_CAS/ - https://apereo.github.io/2023/02/20/x509-vuln/ - https://github.com/apereo/cas/releases/tag/v6.6.6
CVE ID: CVE-2023-28858 State: PUBLISHED Published: 2023-03-26T00:00:00.000Z Last Updated: 2025-02-20T15:35:34.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4.3, and 4.5.3 were released (changing the behavior for pipeline operations); however, please see CVE-2023-28859 about addressing data leakage across AsyncIO connections in general. Additional Analyst Notes: - CVE Program Container
9 about addressing data leakage across AsyncIO connections in general. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/redis/redis-py/pull/2641 - https://github.com/redis/redis-py/issues/2624 - https://github.com/redis/redis-py/compare/v4.5.2...v4.5.3 - https://github.com/redis/redis-py/compare/v4.4.2...v4.4.3 - https://github.com/redis/redis-py/compare/v4.3.5...v4.3.6 - https://openai.com/blog/march-20-chatgpt-outage
CVE ID: CVE-2023-28859 State: PUBLISHED Published: 2023-03-26T00:00:00.000Z Last Updated: 2025-02-20T15:34:03.848Z Vendors: n/a Products: n/a Problem Types: n/a Description: redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/redis/redis-py/pull/2641 - https://github.com/redis/red
ainer: - CISA ADP Vulnrichment: References: - https://github.com/redis/redis-py/pull/2641 - https://github.com/redis/redis-py/issues/2665 - https://github.com/redis/redis-py/releases/tag/v4.4.4 - https://github.com/redis/redis-py/releases/tag/v4.5.4 - https://github.com/redis/redis-py/pull/2666
CVE ID: CVE-2023-28862 State: PUBLISHED Published: 2023-03-31T00:00:00.000Z Last Updated: 2025-02-14T19:33:52.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a password check allow attackers to bypass 2FA verification. Any plugin that tries to deny session creation after the store step does not deny an AuthBasic session. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2896 - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/
://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2896 - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.16.1 - https://lists.debian.org/debian-lts-announce/2023/07/msg00018.html
CVE ID: CVE-2023-28863 State: PUBLISHED Published: 2023-04-18T00:00:00 Last Updated: 2024-08-02T13:51:38.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://ami.com - https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023003.pdf - https://www.kb.cert.org/vuls/id/163057
CVE ID: CVE-2023-28864 State: PUBLISHED Published: 2023-07-17T00:00:00 Last Updated: 2024-10-30T15:17:22.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: Progress Chef Infra Server before 15.7 allows a local attacker to exploit a /var/opt/opscode/local-mode-cache/backup world-readable temporary backup path to access sensitive information, resulting in the disclosure of all indexed node data, because OpenSearch credentials are exposed. (The data typically includes credentials for additional systems.) The attacker must wait for an admin to run the "chef-server-ctl reconfigure" command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
ctl reconfigure" command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/chef/chef-server/blob/8a2dc82148844767f7c7728633a03dcee812e56a/omnibus/files/server-ctl-cookbooks/infra-server/recipes/oc_bifrost.rb#L42 - https://docs.chef.io/release_notes_server/ - https://blog.mondoo.com/chef-infra-server-cve-2023-28864-impact-and-remediation
CVE ID: CVE-2023-28865 State: PUBLISHED Published: 2024-08-08T00:00:00 Last Updated: 2024-08-08T20:09:23.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR15, 4.0.0 SR05, 4.1.0 SR03, and 4.2.0 SR02 fails to validate the directory contents of certain directories (e.g., ensuring the expected hash sum) during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who is able to manipulate the contents of the system's hard disk. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dieboldnixdorf.com/en-us/banking/portfolio/software/security/ - https://media.defcon.org
ment: References: - https://www.dieboldnixdorf.com/en-us/banking/portfolio/software/security/ - https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Matt%20Burch%20-%20Where%E2%80%99s%20the%20Money%20-%20Defeating%20ATM%20Disk%20Encryption-white%20paper.pdf
CVE ID: CVE-2023-28866 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-05-05T16:02:01.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds access because amp_init1[] and amp_init2[] are supposed to have an intentionally invalid element, but do not. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchwork.kernel.org/project/bluetooth/patch/20230322232543.3079578-1-luiz.dentz%40gmail.com - https://lore.kernel.org/lkml/20230321015018.1759683-1-iam%40sung-woo.kim/ - https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetoot
g/lkml/20230321015018.1759683-1-iam%40sung-woo.kim/ - https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=95084403f8c070ccf5d7cbe72352519c1798a40a
CVE ID: CVE-2023-28867 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T15:25:51.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/graphql-java/graphql-java/pull/3112 - https://github.com/graphql-java/graphql-java/releases/tag/v17.5 - https://github.com/graphql-java/graphql-java/releases/tag/v18.4 - https://github.com/graphql-java/graph
ases/tag/v17.5 - https://github.com/graphql-java/graphql-java/releases/tag/v18.4 - https://github.com/graphql-java/graphql-java/releases/tag/v19.4 - https://github.com/graphql-java/graphql-java/releases/tag/v20.1
CVE ID: CVE-2023-28868 State: PUBLISHED Published: 2023-12-09T00:00:00 Last Updated: 2024-08-02T13:51:38.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to delete arbitrary files on the operating system by creating a symbolic link. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/en/security-advisories/usd-2022-0002/
CVE ID: CVE-2023-28869 State: PUBLISHED Published: 2023-12-09T00:00:00 Last Updated: 2024-11-26T17:59:39.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers read the contents of arbitrary files on the operating system by creating a symbolic link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://herolab.usd.de/en/security-advisories/usd-2022-0003/
CVE ID: CVE-2023-28870 State: PUBLISHED Published: 2023-12-09T00:00:00 Last Updated: 2024-08-02T13:51:38.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure File Permissions in Support Assistant in NCP Secure Enterprise Client before 12.22 allow attackers to write to configuration files from low-privileged user accounts. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/en/security-advisories/usd-2022-0004/
CVE ID: CVE-2023-28871 State: PUBLISHED Published: 2023-12-09T00:00:00 Last Updated: 2024-08-02T13:51:38.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to read registry information of the operating system by creating a symbolic link. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/en/security-advisories/usd-2022-0005/
CVE ID: CVE-2023-28872 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-27T20:03:32.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: Support Assistant in NCP Secure Enterprise Client before 13.10 allows attackers to execute DLL files with SYSTEM privileges by creating a symbolic link from a %LOCALAPPDATA%\Temp\NcpSupport* location. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://herolab.usd.de/en/security-advisories/usd-2022-0006/
CVE ID: CVE-2023-28873 State: PUBLISHED Published: 2023-12-09T00:00:00 Last Updated: 2024-08-02T13:51:38.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/en/security-advisories/usd-2022-0032/ - https://manual.seafile.com/changelog/server-changelog/#908-2022-09-07
CVE ID: CVE-2023-28874 State: PUBLISHED Published: 2023-12-09T00:00:00 Last Updated: 2024-08-02T13:51:38.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites. Additional Analyst Notes: - CVE Program Container: References: - https://manual.seafile.com/changelog/server-changelog/#908-2022-09-07 - https://herolab.usd.de/en/security-advisories/usd-2022-0033/
CVE ID: CVE-2023-28875 State: PUBLISHED Published: 2023-12-06T00:00:00 Last Updated: 2024-08-02T13:51:38.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored XSS issue in shared files download terms in Filerun Update 20220202 allows attackers to inject JavaScript code that is executed when a user follows the crafted share link. Additional Analyst Notes: - CVE Program Container: References: - https://filerun.com/changelog - https://herolab.usd.de/security-advisories/usd-2022-0009/
CVE ID: CVE-2023-28876 State: PUBLISHED Published: 2023-12-06T00:00:00 Last Updated: 2024-08-02T13:51:38.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other users. Additional Analyst Notes: - CVE Program Container: References: - https://filerun.com/changelog - https://herolab.usd.de/security-advisories/usd-2022-0010/
CVE ID: CVE-2023-28877 State: PUBLISHED Published: 2023-03-31T00:00:00.000Z Last Updated: 2025-02-14T19:31:54.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: The VTEX apps-graphql@2.x GraphQL API module does not properly restrict unauthorized access to private configuration data. (apps-graphql@3.x is unaffected by this issue.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developers.vtex.com/updates/release-notes/deprecation-of-apps-graphql%402.x
CVE ID: CVE-2023-28879 State: PUBLISHED Published: 2023-03-31T00:00:00.000Z Last Updated: 2025-02-14T19:29:52.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.ghostscript.com/show_bug.cgi?id=706494 - https://git.ghostscript.c
: - CISA ADP Vulnrichment: References: - https://bugs.ghostscript.com/show_bug.cgi?id=706494 - https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=37ed5022cecd584de868933b5b60da2e995b3179 - https://ghostscript.readthedocs.io/en/latest/News.html - https://lists.debian.org/debian-lts-announce/2023/04/msg00003.html - https://www.debian.org/security/2023/dsa-5383 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CI6UCKM3XMK7PYNIRGAVDJ5VKN6XYZOE/ - http://www.openwall.com/lists/oss-security/2023/04/12/4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHJX62KSRIOBZA6FKONMJP7MEFY7LTH2/ - https
raproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHJX62KSRIOBZA6FKONMJP7MEFY7LTH2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MADLP3GWJFLLFVNZGEDNPMDQR6CCXAHN/ - https://security.gentoo.org/glsa/202309-03
CVE ID: CVE-2023-28882 State: PUBLISHED Published: 2023-04-28T00:00:00.000Z Last Updated: 2025-01-30T20:42:27.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.trustwave.com/en-us/resources/security-resources/software-updates/announcing-modsecurity-version-309/
CVE ID: CVE-2023-28883 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T17:07:13.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Cerebrate 1.13, a blind SQL injection exists in the searchAll API endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cerebrate-project/cerebrate/commit/5f1c99cd534442ec40c2129769608e3e61ff8be3 - https://zigrin.com/advisories/cerebrate-blind-sql-injection/
CVE ID: CVE-2023-28884 State: PUBLISHED Published: 2023-03-27T00:00:00 Last Updated: 2024-08-02T13:51:38.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MISP 2.4.169, app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/commit/b94c7978e5e6b1db369abeedbbf00bca975b08b7 - https://zigrin.com/advisories/misp-dom-based-xss/
CVE ID: CVE-2023-28885 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T17:03:41.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MyLink infotainment system (build 2021.3.26) in General Motors Chevrolet Equinox 2021 vehicles allows attackers to cause a denial of service (temporary failure of Media Player functionality) via a crafted MP3 file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zj3t/GM_Vulnerability - https://github.com/zj3t/Automotive-vulnerabilities/tree/main/GM/Chevrolet_Equinox2021
CVE ID: CVE-2023-28892 State: PUBLISHED Published: 2023-03-29T00:00:00 Last Updated: 2024-08-02T13:51:38.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: Malwarebytes AdwCleaner 8.4.0 runs as Administrator and performs an insecure file delete operation on C:\AdwCleaner\Logs\AdwCleaner_Debug.log in which the target location is user-controllable, allowing a non-admin user to escalate privileges to SYSTEM via a symbolic link. Additional Analyst Notes: - CVE Program Container: References: - https://malwarebytes.com - https://www.malwarebytes.com/secure/cves/cve-2023-28892 - https://forums.malwarebytes.com/topic/307429-release-adwcleaner-841/
CVE ID: CVE-2023-28895 State: PUBLISHED Published: 2023-12-01T13:41:16.581Z Last Updated: 2024-12-02T17:48:05.077Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: JOYNEXT Products: MIB3 Infotainment Unit Problem Types: CWE-259 Description: The password for access to the debugging console of the PoWer Controller chip (PWC) of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip. Vulnerability found on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://asrg.i
ctured in 2022. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://asrg.io/security-advisories/hard-coded-password-for-access-to-power-controller-chip-memory/