Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rs to update player instances. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/77409977-6822-4d14-9842-cb6a5aff2162?source=cve - https://plugins.svn.wordpress.org/radio-player/tags/2.0.7/readme.txt - https://plugins.trac.wordpress.org/changeset/2942906/radio-player/trunk/includes/class-ajax.php - https://plugins.trac.wordpress.org/changeset/3048105
CVE ID: CVE-2023-4026 State: REJECTED Published: N/A Last Updated: 2023-07-31T16:43:23.443Z Description: No description available.
CVE ID: CVE-2023-4027 State: PUBLISHED Published: 2024-08-17T07:34:20.286Z Last Updated: 2024-08-20T19:25:14.446Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: princeahmed Products: Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress Problem Types: CWE-862 Description: The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_settings function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.c
kers to update plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2cc9f75d-f1a6-486b-b924-76ec618c5314?source=cve - https://plugins.svn.wordpress.org/radio-player/tags/2.0.7/readme.txt - https://plugins.trac.wordpress.org/changeset/2942906/radio-player/trunk/includes/class-ajax.php - https://plugins.trac.wordpress.org/changeset/3050056/radio-player/tags/2.0.74/includes/class-ajax.php?old=2986565&old_path=radio-player%2Ftags%2F2.0.73%2Fincludes%2Fclass-ajax.php
CVE ID: CVE-2023-4028 State: PUBLISHED Published: 2023-08-17T16:48:06.884Z Last Updated: 2024-10-08T13:50:36.650Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Lenovo Notebook Problem Types: CWE-120 Description: A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-134879
CVE ID: CVE-2023-4029 State: PUBLISHED Published: 2023-08-17T16:48:24.711Z Last Updated: 2024-10-08T13:16:40.566Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: ThinkPad Problem Types: CWE-120 Description: A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with local access and elevated privileges to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-134879
CVE ID: CVE-2023-4030 State: PUBLISHED Published: 2023-08-17T16:48:47.172Z Last Updated: 2024-10-08T13:11:13.980Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: ThinkPad Problem Types: CWE-636 Description: A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 that could cause the system to recover to insecure settings if the BIOS becomes corrupt. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-134879
CVE ID: CVE-2023-4033 State: PUBLISHED Published: 2023-08-01T00:00:20.302Z Last Updated: 2024-10-15T14:13:34.900Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: mlflow Products: mlflow/mlflow Problem Types: CWE-78 Description: OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/5312d6f8-67a5-4607-bd47-5e19966fa321 - https://github.com/mlflow/mlflow/commit/6dde93758d42455cb90ef324407919ed67668b9b
CVE ID: CVE-2023-4034 State: PUBLISHED Published: 2023-09-05T18:19:16.716Z Last Updated: 2024-09-27T13:28:18.739Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Digita Information Technology Products: Smartrise Document Management System Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digita Information Technology Smartrise Document Management System allows SQL Injection.This issue affects Smartrise Document Management System: before Hvl-2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-2
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0494
CVE ID: CVE-2023-4035 State: PUBLISHED Published: 2023-08-30T14:22:01.592Z Last Updated: 2025-04-23T16:19:06.592Z Vendors: Unknown Products: Simple Blog Card Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple Blog Card WordPress plugin before 1.31 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8fd9192a-2d08-4127-adcd-87fb1ea8d6fc
CVE ID: CVE-2023-4036 State: PUBLISHED Published: 2023-08-30T14:22:01.184Z Last Updated: 2025-05-02T15:47:12.758Z Vendors: Unknown Products: Simple Blog Card Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Simple Blog Card WordPress plugin before 1.32 does not ensure that posts to be displayed via a shortcode are public, allowing any authenticated users, such as subscriber, to retrieve arbitrary post title and their content such as draft, private and password protected ones Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/de3e1718-c358-4510-b142-32896ffeb03f
CVE ID: CVE-2023-4037 State: PUBLISHED Published: 2023-10-04T11:05:05.352Z Last Updated: 2024-09-19T19:21:21.060Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Setelsa Security Products: ConacWin Problem Types: CWE-89 Description: Blind SQL injection vulnerability in the Conacwin 3.7.1.2 web interface, the exploitation of which could allow a local attacker to obtain sensitive data stored in the database by sending a specially crafted SQL query to the xml parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-setelsa-security-conacwin
CVE ID: CVE-2023-4039 State: PUBLISHED Published: 2023-09-13T08:05:10.274Z Last Updated: 2025-02-13T17:07:49.159Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Arm Ltd, GNU Products: Arm GNU Toolchain, GCC Problem Types: CWE-693 Description: **DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-s
mically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself. Additional Analyst Notes: - CVE Program Container: References: - https://devel
ng bug and not a vulnerability by itself. Additional Analyst Notes: - CVE Program Container: References: - https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64 - https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf
CVE ID: CVE-2023-4040 State: PUBLISHED Published: 2023-08-18T06:46:50.887Z Last Updated: 2025-02-05T19:35:37.350Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: webtoffee Products: Stripe Payment Plugin for WooCommerce Problem Types: CWE-862 Missing Authorization Description: The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eh_callback_handler function in versions up to, and including, 3.7.9. This makes it possible for unauthenticated attackers to modify the order status of arbitrary WooCommerce orders. Additional Analyst Notes: - CVE Program Container:
attackers to modify the order status of arbitrary WooCommerce orders. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ef543c61-2acc-4b72-81ff-883960d4c7c3?source=cve - https://plugins.trac.wordpress.org/changeset/2954934/
CVE ID: CVE-2023-4041 State: PUBLISHED Published: 2023-08-23T04:09:12.180Z Last Updated: 2024-10-03T14:08:22.261Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Silicon Labs Products: Gecko Bootloader Problem Types: CWE-120, CWE-787, CWE-913 Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon Labs Gecko Bootloader on ARM (Firmware Update File Parser modules) allows Code Injection, Authentication Bypass.This issue affects "Standalone" and "Application" versions of Gecko Bootloader. Additional Analyst Notes: - CVE Program Container: - CISA
s "Standalone" and "Application" versions of Gecko Bootloader. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000XT8GsQAL?operationContext=S1
CVE ID: CVE-2023-4042 State: PUBLISHED Published: 2023-08-23T12:19:29.156Z Last Updated: 2025-11-21T07:05:10.400Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 Problem Types: CWE-125 Description: A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in RHSA-2021:1852-06 advisory as it was claimed to be. This issue only affects the ghostscript package as shipped with Red Hat Enterprise Linux 8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ac
Enterprise Linux 8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2023:7053 - https://access.redhat.com/security/cve/CVE-2023-4042 - https://bugzilla.redhat.com/show_bug.cgi?id=1870257 - https://bugzilla.redhat.com/show_bug.cgi?id=2228151
CVE ID: CVE-2023-4043 State: PUBLISHED Published: 2023-11-03T08:11:39.563Z Last Updated: 2024-09-05T14:31:17.127Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Eclipse Foundation Products: Parsson Problem Types: CWE-20, CWE-834 Description: In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect. To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.
e than one would expect. To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/eclipse-ee4j/parsson/pull/100 - https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/13
CVE ID: CVE-2023-4045 State: PUBLISHED Published: 2023-08-01T14:56:53.933Z Last Updated: 2025-02-13T17:08:19.650Z Vendors: Mozilla Products: Firefox, Firefox ESR Problem Types: Offscreen Canvas could have bypassed cross-origin restrictions Description: Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1833876 - https://www.mozilla.org/security/advisories/mfsa
t: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1833876 - https://www.mozilla.org/security/advisories/mfsa2023-29/ - https://www.mozilla.org/security/advisories/mfsa2023-30/ - https://www.mozilla.org/security/advisories/mfsa2023-31/ - https://www.debian.org/security/2023/dsa-5464 - https://www.debian.org/security/2023/dsa-5469 - https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html - https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
CVE ID: CVE-2023-4046 State: PUBLISHED Published: 2023-08-01T14:57:07.564Z Last Updated: 2025-02-13T17:08:24.214Z Vendors: Mozilla Products: Firefox, Firefox ESR Problem Types: Incorrect value used during WASM compilation Description: In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1837686 - https://www.mozilla.org/securi
SA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1837686 - https://www.mozilla.org/security/advisories/mfsa2023-29/ - https://www.mozilla.org/security/advisories/mfsa2023-30/ - https://www.mozilla.org/security/advisories/mfsa2023-31/ - https://www.debian.org/security/2023/dsa-5464 - https://www.debian.org/security/2023/dsa-5469 - https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html - https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
CVE ID: CVE-2023-4047 State: PUBLISHED Published: 2023-08-01T14:57:35.097Z Last Updated: 2025-02-13T17:08:25.654Z Vendors: Mozilla Products: Firefox, Firefox ESR Problem Types: Potential permissions request bypass via clickjacking Description: A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1839073 - https://www.mozilla.org/security/advisories/mfsa2023-29/ - https://www.mozilla.org/secur
a.org/show_bug.cgi?id=1839073 - https://www.mozilla.org/security/advisories/mfsa2023-29/ - https://www.mozilla.org/security/advisories/mfsa2023-30/ - https://www.mozilla.org/security/advisories/mfsa2023-31/ - https://www.debian.org/security/2023/dsa-5464 - https://www.debian.org/security/2023/dsa-5469 - https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html - https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
CVE ID: CVE-2023-4048 State: PUBLISHED Published: 2023-08-01T14:57:48.886Z Last Updated: 2025-02-13T17:08:26.207Z Vendors: Mozilla Products: Firefox, Firefox ESR Problem Types: Crash in DOMParser due to out-of-memory conditions Description: An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1841368 - https://www.mozilla.org/security/advisories/mfsa2023-29/ - https://www.mozilla.org/security/advisories/mf
i?id=1841368 - https://www.mozilla.org/security/advisories/mfsa2023-29/ - https://www.mozilla.org/security/advisories/mfsa2023-30/ - https://www.mozilla.org/security/advisories/mfsa2023-31/ - https://www.debian.org/security/2023/dsa-5464 - https://www.debian.org/security/2023/dsa-5469 - https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html - https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
CVE ID: CVE-2023-4049 State: PUBLISHED Published: 2023-08-01T14:58:07.699Z Last Updated: 2025-02-13T17:08:26.791Z Vendors: Mozilla Products: Firefox, Firefox ESR Problem Types: Fix potential race conditions when releasing platform objects Description: Race conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-after-free vulnerabilities. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1842658 - https://www.mozilla.org/security/advisories/mfsa20
References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1842658 - https://www.mozilla.org/security/advisories/mfsa2023-29/ - https://www.mozilla.org/security/advisories/mfsa2023-30/ - https://www.mozilla.org/security/advisories/mfsa2023-31/ - https://www.debian.org/security/2023/dsa-5464 - https://www.debian.org/security/2023/dsa-5469 - https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html - https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
CVE ID: CVE-2023-4050 State: PUBLISHED Published: 2023-08-01T14:58:31.812Z Last Updated: 2025-02-13T17:08:27.405Z Vendors: Mozilla Products: Firefox, Firefox ESR Problem Types: Stack buffer overflow in StorageManager Description: In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a potentially exploitable crash which could have led to a sandbox escape. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1843038 - https://www.mozilla.org/security/advisories/mfsa
t: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1843038 - https://www.mozilla.org/security/advisories/mfsa2023-29/ - https://www.mozilla.org/security/advisories/mfsa2023-30/ - https://www.mozilla.org/security/advisories/mfsa2023-31/ - https://www.debian.org/security/2023/dsa-5464 - https://www.debian.org/security/2023/dsa-5469 - https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html - https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
CVE ID: CVE-2023-4051 State: PUBLISHED Published: 2023-08-01T14:58:43.468Z Last Updated: 2024-10-22T14:45:28.146Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Full screen notification obscured by file open dialog Description: A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1821884 - https://www.mozilla.org/security/advisories/mfsa202
References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1821884 - https://www.mozilla.org/security/advisories/mfsa2023-29/ - https://www.mozilla.org/security/advisories/mfsa2023-36/ - https://www.mozilla.org/security/advisories/mfsa2023-38/
CVE ID: CVE-2023-4052 State: PUBLISHED Published: 2023-08-01T14:59:17.527Z Last Updated: 2024-10-22T14:39:12.886Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: File deletion and privilege escalation through Firefox uninstaller Description: The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be recursively deleted with the permissions of the uninstalling user account. This could be combined with creation of a junction (a form of symbolic link) to allow arbitrary file deletion controlled by the non-privileged user. *This bug only affects Firefox on Windows. Other operating systems a
ile deletion controlled by the non-privileged user. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and Thunderbird < 115.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1824420 - https://www.mozilla.org/security/advisories/mfsa2023-29/ - https://www.mozilla.org/security/advisories/mfsa2023-31/ - https://www.mozilla.org/security/advisories/mfsa2023-33/
CVE ID: CVE-2023-4053 State: PUBLISHED Published: 2023-08-01T14:59:54.291Z Last Updated: 2024-10-22T14:38:10.095Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Full screen notification obscured by external program Description: A website could have obscured the full screen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1839079 -
: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1839079 - https://www.mozilla.org/security/advisories/mfsa2023-29/ - https://www.mozilla.org/security/advisories/mfsa2023-36/ - https://www.mozilla.org/security/advisories/mfsa2023-38/
CVE ID: CVE-2023-4054 State: PUBLISHED Published: 2023-08-01T15:00:25.281Z Last Updated: 2024-10-22T14:37:12.198Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Lack of warning when opening appref-ms files Description: When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 116, Firefox ESR < 102.14, Firefox ESR < 115.1, Thunderbird < 102.14, and Thunderbird < 115.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1840777 - https://www.mozilla.org/security/advisories/mfsa2023-29/ - https://www.mozilla.org/security/advisories/mfsa2023-30/ - https://www.mozilla.org/security/advisories/mfsa2023-31/ - https://www.mozilla.org/security/advisories/mfsa2023-32/ - https://www.mozilla.org/security/advisories/mfsa2023-33/