Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-28585 State: PUBLISHED Published: 2023-12-05T03:03:53.662Z Last Updated: 2024-08-02T13:43:23.208Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-680 Description: Memory corruption while loading an ELF segment in TEE Kernel. Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE ID: CVE-2023-28586 State: PUBLISHED Published: 2023-12-05T03:03:55.223Z Last Updated: 2024-12-02T17:11:28.311Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-119 Description: Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE ID: CVE-2023-28587 State: PUBLISHED Published: 2023-12-05T03:03:56.759Z Last Updated: 2024-08-02T13:43:23.596Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-119 Description: Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level. Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE ID: CVE-2023-28588 State: PUBLISHED Published: 2023-12-05T03:03:58.097Z Last Updated: 2024-08-02T13:43:23.180Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-190 Description: Transient DOS in Bluetooth Host while rfc slot allocation. Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE ID: CVE-2023-28596 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T15:29:58.261Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Zoom Video Communications Inc Products: Zoom Client for Meetings for IT Admin macOS installers Problem Types: CWE-427 Description: Zoom Client for IT Admin macOS installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges to privileges to root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
es to privileges to root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2023-28597 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T15:27:48.810Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Zoom Video Communications Inc Products: Zoom (for Android, iOS, Linux, macOS, and Windows), Zoom Rooms (for Android, iOS, Linux, macOS, and Windows), Zoom VDI for Windows Problem Types: CWE-501 Description: Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later opens it using a link from Zoom’s web portal, an attacker positioned on an adjacent network to the victim client could set up a malicious S
nk from Zoom’s web portal, an attacker positioned on an adjacent network to the victim client could set up a malicious SMB server to respond to client requests, causing the client to execute attacker controlled executables. This could result in an attacker gaining access to a user's device and data, and remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2023-28598 State: PUBLISHED Published: 2023-06-13T16:49:29.971Z Last Updated: 2025-01-02T20:03:12.036Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Zoom Video Communications, Inc. Products: Zoom for Linux clients Problem Types: CWE-79 Description: Zoom for Linux clients prior to 5.13.10 contain an HTML injection vulnerability. If a victim starts a chat with a malicious user it could result in a Zoom application crash. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2023-28599 State: PUBLISHED Published: 2023-06-13T16:55:46.889Z Last Updated: 2025-01-02T20:02:33.519Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Zoom Video Communications, Inc. Products: Zoom for Android, Zoom for iOS, Zoom for Linux, Zoom for macOS, Zoom for Windows Problem Types: CWE-79 Description: Zoom clients prior to 5.13.10 contain an HTML injection vulnerability. A malicious user could inject HTML into their display name potentially leading a victim to a malicious website during meeting creation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/securi
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2023-28600 State: PUBLISHED Published: 2023-06-13T17:00:53.178Z Last Updated: 2025-01-02T20:01:49.568Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Zoom Video Communications, Inc. Products: Zoom for macOS Client Problem Types: CWE-378 Description: Zoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability. A malicious user may be able to delete/replace Zoom Client files potentially causing a loss of integrity and availability to the Zoom Client. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2023-28601 State: PUBLISHED Published: 2023-06-13T17:05:58.289Z Last Updated: 2025-01-02T20:01:16.684Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Zoom Video Communications, Inc. Products: Zoom for Windows Client Problem Types: CWE-358 Description: Zoom for Windows clients prior to 5.14.0 contain an improper restriction of operations within the bounds of a memory buffer vulnerability. A malicious user may alter protected Zoom Client memory buffer potentially causing integrity issues within the Zoom Client. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2023-28602 State: PUBLISHED Published: 2023-06-13T17:30:07.510Z Last Updated: 2025-01-02T20:11:44.583Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: Zoom Video Communications, Inc. Products: Zoom for Windows Client Problem Types: CWE-347 Description: Zoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability. A malicious user may potentially downgrade Zoom Client components to previous versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2023-28603 State: PUBLISHED Published: 2023-06-13T17:34:55.364Z Last Updated: 2025-01-02T20:11:09.928Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: Zoom Video Communications, Inc. Products: Zoom VDI Windows Meeting Client Problem Types: CWE-73 Description: Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local files without proper permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2023-28604 State: PUBLISHED Published: 2023-12-12T00:00:00 Last Updated: 2024-10-28T21:03:13.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: The fluid_components (aka Fluid Components) extension before 3.5.0 for TYPO3 allows XSS via a component argument parameter, for certain {content} use cases that may be edge cases. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-ext-sa-2023-003 - https://github.com/sitegeist/fluid-components/blob/master/Documentation/XssIssue.md
CVE ID: CVE-2023-28606 State: PUBLISHED Published: 2023-03-18T00:00:00.000Z Last Updated: 2025-02-26T19:04:59.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MISP/MISP/commit/30255b8d683df4ec54f856282b3bde9106d5ae1a - https://github.com/MISP/MISP/compare/v2.4.168...v2.4.169
CVE ID: CVE-2023-28607 State: PUBLISHED Published: 2023-03-18T00:00:00.000Z Last Updated: 2025-02-26T20:45:23.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MISP/MISP/compare/v2.4.168...v2.4.169 - https://github.com/MISP/MISP/commit/78f423451a4c795991e739ee970bc5215c061591
CVE ID: CVE-2023-28609 State: PUBLISHED Published: 2023-03-18T00:00:00.000Z Last Updated: 2025-02-26T20:45:58.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: api/auth.go in Ansible Semaphore before 2.8.89 mishandles authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ansible-semaphore/semaphore/releases/tag/v2.8.89 - https://github.com/ansible-semaphore/semaphore/commit/3e4a62b7f2b1ef0660c9fb839818a53c80a5a8b1
CVE ID: CVE-2023-28610 State: PUBLISHED Published: 2023-03-23T00:00:00.000Z Last Updated: 2025-02-26T14:36:41.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: The update process in OMICRON StationGuard and OMICRON StationScout before 2.21 can be exploited by providing a modified firmware update image. This allows a remote attacker to gain root access to the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.omicronenergy.com/en/support/product-security/ - https://www.omicronenergy.com/fileadmin/user_upload/website/files/product-security/osa-5.txt
CVE ID: CVE-2023-28611 State: PUBLISHED Published: 2023-03-23T00:00:00.000Z Last Updated: 2025-02-25T19:57:56.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect authorization in OMICRON StationGuard 1.10 through 2.20 and StationScout 1.30 through 2.20 allows an attacker to bypass intended access restrictions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.omicronenergy.com/en/support/product-security/ - https://www.omicronenergy.com/fileadmin/user_upload/website/files/product-security/osa-6.txt
CVE ID: CVE-2023-28613 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-13T16:33:38.886Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AC:H/AV:N/A:H/C:N/I:N/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Exynos Mobile Processor and Baseband Modem Processor for Exynos 1280, Exynos 2200, and Exynos Modem 5300. An integer overflow in IPv4 fragment handling can occur due to insufficient parameter validation when reassembling these fragments. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/processor/modem/ - https://semiconductor.samsung.com/pro
P Vulnrichment: References: - https://semiconductor.samsung.com/processor/modem/ - https://semiconductor.samsung.com/processor/mobile-processor/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - http://packetstormsecurity.com/files/172177/Shannon-Baseband-Integer-Overflow.html
CVE ID: CVE-2023-28614 State: PUBLISHED Published: 2023-09-15T00:00:00 Last Updated: 2024-09-25T19:00:15.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: Freewill iFIS (aka SMART Trade) 20.01.01.04 allows OS Command Injection via shell metacharacters to a report page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.freewillsolutions.com/smart-trade-ifis - https://www.kb.cert.org/vuls/id/947701 - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0012.md
CVE ID: CVE-2023-28616 State: PUBLISHED Published: 2023-12-26T00:00:00 Last Updated: 2024-08-02T13:43:22.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user accounts for which the password has an equals sign or space character. The serverd process logs such passwords in cleartext, and potentially sends these logs to the Syslog component. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.stormshield.eu/2023-006
CVE ID: CVE-2023-28617 State: PUBLISHED Published: 2023-03-19T00:00:00.000Z Last Updated: 2025-11-03T20:35:28.705Z Vendors: n/a Products: n/a Problem Types: n/a Description: org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://list.orgmode.org/tencent_04CF842704737012CCBCD63CD654DD41CA0A%40qq.com/T/#m6ef8e7d34b25fe17b4cbb655b161edce18c6655e - https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=8f8ec2ccf3f5ef8f38d68ec84a7e4739c45db485 - https:/
55e - https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=8f8ec2ccf3f5ef8f38d68ec84a7e4739c45db485 - https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=a8006ea580ed74f27f974d60b598143b04ad1741 - https://lists.debian.org/debian-lts-announce/2023/05/msg00008.html - https://lists.debian.org/debian-lts-announce/2023/10/msg00019.html
CVE ID: CVE-2023-28618 State: PUBLISHED Published: 2023-11-12T21:51:19.994Z Last Updated: 2024-08-30T19:28:30.988Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Marios Alexandrou Products: Enhanced Plugin Admin Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Enhanced Plugin Admin plugin <= 1.16 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/enhanced-plugin-admin/wordpress-enhanced-plugin-admin-plugin-1-16-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-28620 State: PUBLISHED Published: 2023-06-13T14:28:34.245Z Last Updated: 2024-10-10T18:56:28.212Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Cyberus Labs Products: Cyberus Key Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Cyberus Labs Cyberus Key plugin <= 1.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/cyberus-key/wordpress-cyberus-key-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28621 State: PUBLISHED Published: 2023-11-16T19:17:24.812Z Last Updated: 2024-08-02T13:43:23.539Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Wishfulthemes Products: Raise Mag, Wishful Blog Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wishfulthemes Raise Mag, Wishfulthemes Wishful Blog themes allows Reflected XSS.This issue affects Raise Mag: from n/a through 1.0.7; Wishful Blog: from n/a through 2.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wishful-blog/wordpress-wishful-blog-t
CVE Program Container: References: - https://patchstack.com/database/vulnerability/wishful-blog/wordpress-wishful-blog-theme-2-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve - https://patchstack.com/database/vulnerability/raise-mag/wordpress-raise-mag-theme-1-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28622 State: PUBLISHED Published: 2023-08-17T08:00:54.202Z Last Updated: 2024-09-25T16:43:38.035Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Trident Technolabs Products: Easy Slider Revolution Problem Types: CWE-79 Description: Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in Trident Technolabs Easy Slider Revolution plugin <= 1.0.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/easy-slider-revolution/wordpress-easy-slider-revolution-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28623 State: PUBLISHED Published: 2023-05-19T21:04:51.624Z Last Updated: 2025-02-12T17:01:30.806Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: zulip Products: zulip Problem Types: CWE-285, CWE-862 Description: Zulip is an open-source team collaboration tool with unique topic-based threading. In the event that 1: `ZulipLDAPAuthBackend` and an external authentication backend (any aside of `ZulipLDAPAuthBackend` and `EmailAuthBackend`) are the only ones enabled in `AUTHENTICATION_BACKENDS` in `/etc/zulip/settings.py` and 2: The organization permissions don't require invitations to join. An attacker can create a new account in the organizatio
The organization permissions don't require invitations to join. An attacker can create a new account in the organization with an arbitrary email address in their control that's not in the organization's LDAP directory. The impact is limited to installations which have this specific combination of authentication backends as described above in addition to having `Invitations are required for joining this organization` organization permission disabled. This issue has been addressed in version 6.2. Users are advised to upgrade. Users unable to upgrade may enable the `Invitations are required for joining this organization` organization permission to prevent this issue. Additional Analyst Notes:
ns are required for joining this organization` organization permission to prevent this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zulip/zulip/security/advisories/GHSA-7p62-pjwg-56rv - https://github.com/zulip/zulip/commit/3df1b4dd7c210c21deb6f829df19412b74573f8d
CVE ID: CVE-2023-28625 State: PUBLISHED Published: 2023-04-03T13:19:40.422Z Last Updated: 2025-02-13T16:48:46.211Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OpenIDC Products: mod_auth_openidc Problem Types: CWE-476 Description: mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13
mentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using `OIDCStripCookies`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-f5xw-rvfr-24qr - https://github.com/OpenIDC/mod_auth_openidc/commit/c0e1edac3c4c19988ccdc7713d7aebfce6ff916a - https://github.com/OpenIDC/mod_auth_openidc/blame/3f11976dab56af0a46a7dddb7a275cc16d6eb726/src/mod_auth_openidc.c#L178-L179 - https://github.com/OpenIDC/mod_auth_openidc/releases/tag/v2.4.13.2 - https://lists.debian.org/debia
penidc.c#L178-L179 - https://github.com/OpenIDC/mod_auth_openidc/releases/tag/v2.4.13.2 - https://lists.debian.org/debian-lts-announce/2023/04/msg00034.html - https://www.debian.org/security/2023/dsa-5405 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WIBKFC22PDH6UXMSZ23PHTD7736ZC7BB/
CVE ID: CVE-2023-28626 State: PUBLISHED Published: 2023-03-28T20:14:27.217Z Last Updated: 2025-02-18T19:03:27.555Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: kivikakk Products: comrak Problem Types: CWE-400 Description: comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A range of quadratic parsing issues are present in Comrak. These can be used to craft denial-of-service attacks on services that use Comrak to parse Markdown. This issue has been addressed in version 0.17.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-047` Additional Analy
e. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-047` Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kivikakk/comrak/security/advisories/GHSA-8hqf-xjwp-p67v - https://github.com/kivikakk/comrak/commit/ce795b7f471b01589f842dc09af38b025701178d - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PTWZWCT7KCX2KTXTLPUYZ3EHOONG4X46/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUYME2VA555X6567H7ORIJQFN4BVGT6N/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject
e/OUYME2VA555X6567H7ORIJQFN4BVGT6N/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VQ3UBC7LE4VPCMZBTADIBL353CH7CPVV/
CVE ID: CVE-2023-28627 State: PUBLISHED Published: 2023-03-27T20:13:02.302Z Last Updated: 2025-02-19T15:20:21.946Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: pymedusa Products: Medusa Problem Types: CWE-78 Description: pymedusa is an automatic video library manager for TV Shows. In versions prior 1.0.12 an attacker with access to the web interface can update the git executable path in /config/general/ > advanced settings with arbitrary OS commands. An attacker may exploit this vulnerability to take execute arbitrary OS commands as the user running the pymedusa program. Users are advised to upgrade. There are no known workarounds for this vulnerability. Ad
er running the pymedusa program. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pymedusa/Medusa/security/advisories/GHSA-6589-x6f5-cgg9 - https://github.com/pymedusa/Medusa/commit/66d4be8f0872bd5ddcdc5c5a58cb014d22834a45