Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ransfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as `none` (using the four ASCII letters, no quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course. Additional Analyst Notes: - CVE Program Container: - CISA ADP V
libcurl. And if using the correct file format of course. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://curl.se/docs/CVE-2023-38546.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/ - https://support.apple.com/kb/HT214036 - https://support.apple.com/kb/HT214063 - https://support.apple.com/kb/HT214057 - https://support.apple.com/kb/HT214058 - http://seclists.org/fulldisclosure/2024/Jan/34 - http://seclists.org/fulldisclosure/2024/Jan/37 - http://seclists.org/fulldisclosure/2024/Jan/38 - https://forum.vmssoftware.com/viewtopic.php?f=8&t=8868
CVE ID: CVE-2023-38547 State: PUBLISHED Published: 2023-11-07T06:17:31.617Z Last Updated: 2025-03-06T15:33:18.141Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Veeam Products: One Description: A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database. This may lead to remote code execution on the SQL server hosting the Veeam ONE configuration database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4508
CVE ID: CVE-2023-38548 State: PUBLISHED Published: 2023-11-07T06:17:31.637Z Last Updated: 2025-03-06T15:32:40.184Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Veeam Products: One Description: A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4508
CVE ID: CVE-2023-38549 State: PUBLISHED Published: 2023-11-07T06:17:31.636Z Last Updated: 2024-09-04T18:52:45.750Z Severity: MEDIUM (CVSS 4.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: Veeam Products: One Description: A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service. Note: The criticality of this vulnerability is reduced as it requires interaction by a user with the Veeam ONE Administrator role. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4508
CVE ID: CVE-2023-38551 State: PUBLISHED Published: 2024-05-31T17:38:31.360Z Last Updated: 2025-03-27T20:43:12.726Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H) Vendors: Ivanti Products: Connect Secure Description: A CRLF Injection vulnerability in Ivanti Connect Secure (9.x, 22.x) allows an authenticated high-privileged user to inject malicious code on a victim’s browser, thereby leading to cross-site scripting attack. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Advisory-May-2024
CVE ID: CVE-2023-38552 State: PUBLISHED Published: 2023-10-18T03:55:18.483Z Last Updated: 2025-11-03T21:49:14.670Z Vendors: NodeJS Products: Node Description: When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js. Additional Analyst Notes: - CVE Program Contain
was issued, the policy mechanism is an experimental feature of Node.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/2094235 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767
LIAQMVYCUGBG/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/ - https://security.netapp.com/advisory/ntap-20231116-0013/
CVE ID: CVE-2023-38553 State: PUBLISHED Published: 2023-09-04T01:16:11.214Z Last Updated: 2024-09-30T19:01:49.545Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 Description: In gnss service, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1698296481653522434
CVE ID: CVE-2023-38554 State: PUBLISHED Published: 2023-09-04T01:16:11.483Z Last Updated: 2024-09-30T18:56:02.133Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 Description: In wcn bsp driver, there is a possible out of bounds write due to a missing bounds check.This could lead to local denial of service with no additional execution privileges Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1698296481653522434
CVE ID: CVE-2023-38555 State: PUBLISHED Published: 2023-07-26T07:43:21.819Z Last Updated: 2024-11-14T15:00:48.965Z Vendors: Fujitsu Limited Products: Si-R 30B, Si-R 130B, Si-R 90brin, Si-R570B, Si-R370B, Si-R220D, Si-R G100, Si-R G200, Si-R G100B, Si-R G110B, Si-R G200B, Si-R G210, Si-R G211, Si-R G120, Si-R G121, SR-M 50AP1 Problem Types: Authentication bypass Description: Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent unauthenticated attacker to obtain, change, and/or reset configuration settings of the affected products. Affected products and versions are as follows: Si-R 30B all versions, Si-R 130B all versions, Si-R 9
affected products. Affected products and versions are as follows: Si-R 30B all versions, Si-R 130B all versions, Si-R 90brin all versions, Si-R570B all versions, Si-R370B all versions, Si-R220D all versions, Si-R G100 V02.54 and earlier, Si-R G200 V02.54 and earlier, Si-R G100B V04.12 and earlier, Si-R G110B V04.12 and earlier, Si-R G200B V04.12 and earlier, Si-R G210 V20.52 and earlier, Si-R G211 V20.52 and earlier, Si-R G120 V20.52 and earlier, Si-R G121 V20.52 and earlier, and SR-M 50AP1 all versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.fujitsu.com/jp/products/network/support/2023/fjlan-01/ - https://jvn.jp/en/vu/JVNVU9664
hment: References: - https://www.fujitsu.com/jp/products/network/support/2023/fjlan-01/ - https://jvn.jp/en/vu/JVNVU96643580/
CVE ID: CVE-2023-38556 State: PUBLISHED Published: 2023-08-02T07:19:26.549Z Last Updated: 2024-10-21T20:04:46.984Z Vendors: SEIKO EPSON CORPORATION Products: SEIKO EPSON printer Web Config Problem Types: Improper input validation Description: Improper input validation vulnerability in SEIKO EPSON printer Web Config allows a remote attacker to turned off the printer. [Note] Web Config is the software that allows users to check the status and change the settings of SEIKO EPSON printers via a web browser. Web Config is pre-installed in some printers provided by SEIKO EPSON CORPORATION. For the details of the affected product names/model numbers, refer to the information provided by the vendor.
PORATION. For the details of the affected product names/model numbers, refer to the information provided by the vendor. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.epson.jp/support/misc_t/230802_oshirase.htm - https://jvn.jp/en/jp/JVN61337171/
CVE ID: CVE-2023-38557 State: PUBLISHED Published: 2023-09-14T10:39:28.689Z Last Updated: 2025-02-27T20:50:26.366Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Spectrum Power 7 Problem Types: CWE-732 Description: A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q3). The affected product assigns improper access rights to the update script. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-357182.pdf
CVE ID: CVE-2023-38558 State: PUBLISHED Published: 2023-09-14T10:39:29.769Z Last Updated: 2025-02-27T20:50:18.770Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC PCS neo (Administration Console) V4.0, SIMATIC PCS neo (Administration Console) V4.0 Update 1 Problem Types: CWE-538 Description: A vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4.0 (All versions), SIMATIC PCS neo (Administration Console) V4.0 Update 1 (All versions). The affected application leaks Windows admin credentials. An attacker with local access to the Administration Console could get the credentials, and impersonate
min credentials. An attacker with local access to the Administration Console could get the credentials, and impersonate the admin user, thereby gaining admin access to other Windows systems. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-646240.pdf
CVE ID: CVE-2023-38559 State: PUBLISHED Published: 2023-08-01T16:49:47.537Z Last Updated: 2025-11-20T17:41:41.428Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-125 Description: A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN device with gs. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:6544
th gs. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:6544 - https://access.redhat.com/errata/RHSA-2023:7053 - https://access.redhat.com/security/cve/CVE-2023-38559 - https://bugs.ghostscript.com/show_bug.cgi?id=706897 - https://bugzilla.redhat.com/show_bug.cgi?id=2224367 - https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=d81b82c70bc1
CVE ID: CVE-2023-38560 State: PUBLISHED Published: 2023-08-01T16:49:48.327Z Last Updated: 2025-11-20T17:41:39.589Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-190 Description: An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/
l Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-38560 - https://bugs.ghostscript.com/show_bug.cgi?id=706898 - https://bugzilla.redhat.com/show_bug.cgi?id=2224368 - https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=b7eb1d0174c
CVE ID: CVE-2023-38561 State: PUBLISHED Published: 2024-02-14T13:38:05.477Z Last Updated: 2024-08-21T15:10:52.136Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: n/a Products: Intel(R) XTU software Problem Types: escalation of privilege, CWE-284 Description: Improper access control in some Intel(R) XTU software before version 7.12.0.29 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00955.html
CVE ID: CVE-2023-38562 State: PUBLISHED Published: 2024-02-20T14:45:02.733Z Last Updated: 2025-11-04T18:15:51.871Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H) Vendors: Weston Embedded Products: uC-TCP-IP Problem Types: CWE-415 Description: A double-free vulnerability exists in the IP header loopback parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted set of network packets can lead to memory corruption, potentially resulting in code execution. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosint
ulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1829
CVE ID: CVE-2023-38563 State: PUBLISHED Published: 2023-09-06T09:24:08.253Z Last Updated: 2024-09-26T20:09:38.552Z Vendors: TP-LINK Products: Archer C1200, Archer C9 Problem Types: OS command injection Description: Archer C1200 firmware versions prior to 'Archer C1200(JP)_V2_230508' and Archer C9 firmware versions prior to 'Archer C9(JP)_V3_230508' allow a network-adjacent unauthenticated attacker to execute arbitrary OS commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tp-link.com/jp/support/download/archer-c1200/#Firmware - https://www.tp-link.com/jp/support/download/archer-c9/v3/#Firmware - https://jvn.jp/en/vu/JVNVU99392903/
CVE ID: CVE-2023-38564 State: PUBLISHED Published: 2023-07-27T00:22:32.074Z Last Updated: 2024-10-22T20:41:19.365Z Vendors: Apple Products: macOS Problem Types: An app may be able to modify protected parts of the file system Description: The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.5. An app may be able to modify protected parts of the file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213843
CVE ID: CVE-2023-38565 State: PUBLISHED Published: 2023-07-27T00:30:39.809Z Last Updated: 2025-02-13T17:01:54.666Z Vendors: Apple Products: iOS and iPadOS, macOS, watchOS Problem Types: An app may be able to gain root privileges Description: A path handling issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.6.8, iOS 16.6 and iPadOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to gain root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213841 - https://support.apple.com/en-us/HT213843 - https://support.apple.com/en-us/HT213845 - https:
.apple.com/en-us/HT213841 - https://support.apple.com/en-us/HT213843 - https://support.apple.com/en-us/HT213845 - https://support.apple.com/en-us/HT213844 - https://support.apple.com/en-us/HT213848 - https://support.apple.com/kb/HT213846 - https://support.apple.com/kb/HT213842
CVE ID: CVE-2023-38566 State: PUBLISHED Published: 2024-02-14T13:38:15.974Z Last Updated: 2024-08-15T13:55:38.525Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) ISPC software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path in some Intel(R) ISPC software before version 1.21.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00994.html
CVE ID: CVE-2023-38568 State: PUBLISHED Published: 2023-09-06T09:23:44.187Z Last Updated: 2024-09-26T20:10:45.450Z Vendors: TP-LINK Products: Archer A10 Problem Types: OS command injection Description: Archer A10 firmware versions prior to 'Archer A10(JP)_V2_230504' allows a network-adjacent unauthenticated attacker to execute arbitrary OS commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tp-link.com/jp/support/download/archer-a10/#Firmware - https://jvn.jp/en/vu/JVNVU99392903/
CVE ID: CVE-2023-38569 State: PUBLISHED Published: 2023-09-05T09:10:17.838Z Last Updated: 2024-09-30T17:26:17.223Z Vendors: SHIRASAGI Project Products: SHIRASAGI Problem Types: Cross-site scripting (XSS) Description: Stored cross-site scripting vulnerability in SHIRASAGI prior to v1.18.0 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ss-proj.org/support/954.html - https://jvn.jp/en/jp/JVN82758000/
CVE ID: CVE-2023-38570 State: PUBLISHED Published: 2023-11-14T19:04:31.663Z Last Updated: 2024-08-30T17:46:23.305Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: Intel Unison software Problem Types: escalation of privilege, CWE-788 Description: Access of memory location after end of buffer for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00963.html
CVE ID: CVE-2023-38571 State: PUBLISHED Published: 2023-07-28T04:30:41.447Z Last Updated: 2025-02-13T17:01:55.202Z Vendors: Apple Products: macOS Problem Types: An app may be able to bypass Privacy preferences Description: This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to bypass Privacy preferences. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213843 - https://support.apple.com/en-us/HT213845 - https://support.apple.com/en-us/HT213844 - https://support.apple.com/kb/HT213843 - https://support.a
om/en-us/HT213845 - https://support.apple.com/en-us/HT213844 - https://support.apple.com/kb/HT213843 - https://support.apple.com/kb/HT213844 - https://support.apple.com/kb/HT213845
CVE ID: CVE-2023-38572 State: PUBLISHED Published: 2023-07-27T00:22:27.903Z Last Updated: 2025-02-13T17:01:55.750Z Vendors: Apple Products: Safari, tvOS, iOS and iPadOS, macOS, watchOS Problem Types: A website may be able to bypass Same Origin Policy Description: The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, watchOS 9.6. A website may be able to bypass Same Origin Policy. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/en-us/HT213847 - https://support.apple.com/en-us/HT213846 - https://support.apple.com/en-us/HT213841 - https://
pple.com/en-us/HT213847 - https://support.apple.com/en-us/HT213846 - https://support.apple.com/en-us/HT213841 - https://support.apple.com/en-us/HT213843 - https://support.apple.com/en-us/HT213842 - https://support.apple.com/en-us/HT213848 - http://www.openwall.com/lists/oss-security/2023/08/02/1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJ4DG5LHWG2INDOTPB7MO4JVJN6LKL3M/ - https://www.debian.org/security/2023/dsa-5468 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQXJYKTGLKI6TJEFJCKPHCNY7PS72OER/ - https://security.gentoo.org/glsa/202401-04
CVE ID: CVE-2023-38573 State: PUBLISHED Published: 2023-11-27T15:25:08.575Z Last Updated: 2025-11-04T19:17:19.224Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: Foxit Reader Problem Types: CWE-416 Description: A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15356 handles a signature field. A specially crafted Javascript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits
the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1839
CVE ID: CVE-2023-38574 State: PUBLISHED Published: 2023-09-05T08:37:35.942Z Last Updated: 2024-09-30T17:16:19.091Z Vendors: i-PRO Co., Ltd. Products: VI Web Client Problem Types: Open Redirect Description: Open redirect vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf - https://jvn.jp/en/jp/JVN60140221/
CVE ID: CVE-2023-38575 State: PUBLISHED Published: 2024-03-14T16:45:45.360Z Last Updated: 2025-02-13T17:01:56.273Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: Intel(R) Processors Problem Types: information disclosure, CWE-1303 Description: Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00982.html - https://security.netapp.com/advisory/ntap-
ww.intel.com/content/www/us/en/security-center/advisory/intel-sa-00982.html - https://security.netapp.com/advisory/ntap-20240405-0008/ - https://lists.debian.org/debian-lts-announce/2024/05/msg00003.html