Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-28292 State: PUBLISHED Published: 2023-04-11T19:13:19.310Z Last Updated: 2025-01-23T01:04:44.616Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Raw Image Extension Problem Types: CWE-122 Description: Raw Image Extension Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28292
CVE ID: CVE-2023-28293 State: PUBLISHED Published: 2023-04-11T19:13:58.242Z Last Updated: 2025-01-23T01:05:19.525Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 20H2, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Serve
ation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-191 Description: Windows Kernel Elevation of Privilege Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28293
CVE ID: CVE-2023-28295 State: PUBLISHED Published: 2023-06-17T00:29:16.683Z Last Updated: 2025-02-28T21:08:23.683Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Office 2019, Microsoft Publisher 2016, Microsoft Office LTSC 2021, Microsoft Publisher 2013 Service Pack 1, Microsoft 365 Apps for Enterprise Problem Types: CWE-190 Description: Microsoft Publisher Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28295
CVE ID: CVE-2023-28296 State: PUBLISHED Published: 2023-04-11T19:13:58.852Z Last Updated: 2025-01-23T01:05:20.136Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8), Microsoft Visual Studio 2022 version 17.2, Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10), Microsoft Visual Studio 2022 version 17.0, Microsoft Visual Studio 2022 version 17.4, Microsoft Visual Studio 2022 version 17.5 Problem Types: CWE-415 Description: Visual Studio Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.mi
dio Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28296
CVE ID: CVE-2023-28297 State: PUBLISHED Published: 2023-04-11T19:13:20.338Z Last Updated: 2025-01-23T01:04:45.700Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 20H2, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012
ation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-416 Description: Windows Remote Procedure Call Service (RPCSS) Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28297
CVE ID: CVE-2023-28298 State: PUBLISHED Published: 2023-04-11T19:13:20.866Z Last Updated: 2025-01-23T01:04:46.268Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 20H2, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Ser
llation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Denial of Service Description: Windows Kernel Denial of Service Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28298
CVE ID: CVE-2023-28299 State: PUBLISHED Published: 2023-04-11T19:13:59.381Z Last Updated: 2025-01-23T01:05:20.556Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8), Microsoft Visual Studio 2022 version 17.2, Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10), Microsoft Visual Studio 2022 version 17.0, Microsoft Visual Studio 2022 version 17.4, Microsoft Visual Studio 2022 version 17.5 Problem Types: Spoofing Description: Visual Studio Spoofing Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.co
Studio Spoofing Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28299
CVE ID: CVE-2023-28300 State: PUBLISHED Published: 2023-04-11T19:13:21.392Z Last Updated: 2025-01-23T01:04:46.778Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Service Connector Problem Types: CWE-284 Description: Azure Service Connector Security Feature Bypass Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28300
CVE ID: CVE-2023-28301 State: PUBLISHED Published: 2023-04-11T19:13:00.864Z Last Updated: 2025-02-28T19:44:30.420Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Edge for Android Problem Types: Tampering Description: Microsoft Edge (Chromium-based) Tampering Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28301
CVE ID: CVE-2023-28302 State: PUBLISHED Published: 2023-04-11T19:14:00.461Z Last Updated: 2025-02-28T21:10:46.990Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 20H2, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Serve
ation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-20 Description: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28302
CVE ID: CVE-2023-28303 State: PUBLISHED Published: 2023-06-13T16:24:46.551Z Last Updated: 2025-01-01T00:47:47.401Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: Microsoft Products: Snipping Tool, Snip & Sketch for Windows 10 Problem Types: CWE-359 Description: Windows Snipping Tool Information Disclosure Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28303
CVE ID: CVE-2023-28304 State: PUBLISHED Published: 2023-04-11T19:14:01.071Z Last Updated: 2025-02-28T21:10:40.209Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Microsoft Products: Microsoft ODBC Driver 17 for SQL Server, Microsoft OLE DB Driver 18 for SQL Server, Microsoft OLE DB Driver 19 for SQL Server, Microsoft ODBC Driver 18 for SQL Server Problem Types: CWE-20 Description: Microsoft ODBC and OLE DB Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28304
CVE ID: CVE-2023-28305 State: PUBLISHED Published: 2023-04-11T19:13:21.918Z Last Updated: 2025-01-23T01:04:47.208Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), W
008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-416 Description: Windows DNS Server Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28305
CVE ID: CVE-2023-28306 State: PUBLISHED Published: 2023-04-11T19:14:01.637Z Last Updated: 2025-01-23T01:05:21.922Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), W
008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-416 Description: Windows DNS Server Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28306
CVE ID: CVE-2023-28307 State: PUBLISHED Published: 2023-04-11T19:14:02.191Z Last Updated: 2025-01-23T01:05:22.490Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), W
008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-416 Description: Windows DNS Server Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28307
CVE ID: CVE-2023-28308 State: PUBLISHED Published: 2023-04-11T19:14:02.734Z Last Updated: 2025-01-23T01:05:22.923Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), W
008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-416 Description: Windows DNS Server Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28308
CVE ID: CVE-2023-28309 State: PUBLISHED Published: 2023-04-11T19:13:22.437Z Last Updated: 2025-02-28T20:03:23.856Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Dynamics 365 (on-premises) version 9.0, Microsoft Dynamics 365 (on-premises) version 9.1 Problem Types: CWE-79 Description: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28309
CVE ID: CVE-2023-28310 State: PUBLISHED Published: 2023-06-14T14:52:08.662Z Last Updated: 2025-02-28T21:09:21.216Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 12, Microsoft Exchange Server 2019 Cumulative Update 13 Problem Types: CWE-502 Description: Microsoft Exchange Server Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28310
CVE ID: CVE-2023-28311 State: PUBLISHED Published: 2023-04-11T19:14:03.296Z Last Updated: 2025-02-28T21:10:34.756Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Office 2019 for Mac, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021 Problem Types: CWE-122 Description: Microsoft Word Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28311
CVE ID: CVE-2023-28312 State: PUBLISHED Published: 2023-04-11T19:14:03.834Z Last Updated: 2025-01-23T01:05:24.094Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Machine Learning Problem Types: CWE-284 Description: Azure Machine Learning Information Disclosure Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28312
CVE ID: CVE-2023-28313 State: PUBLISHED Published: 2023-04-11T19:13:22.961Z Last Updated: 2025-02-28T20:03:17.230Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Send Customer Voice survey from Dynamics 365 Problem Types: CWE-79 Description: Microsoft Dynamics 365 Customer Voice Cross-Site Scripting Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28313
CVE ID: CVE-2023-28314 State: PUBLISHED Published: 2023-04-11T19:13:23.485Z Last Updated: 2025-02-28T20:03:11.297Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Dynamics 365 (on-premises) version 9.0, Microsoft Dynamics 365 (on-premises) version 9.1 Problem Types: CWE-79 Description: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28314
CVE ID: CVE-2023-28316 State: PUBLISHED Published: 2023-05-09T00:00:00.000Z Last Updated: 2025-01-28T20:38:20.621Z Vendors: n/a Products: Rocket.Chat Problem Types: CWE-384 Description: A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/992280
CVE ID: CVE-2023-28317 State: PUBLISHED Published: 2023-05-09T00:00:00.000Z Last Updated: 2025-01-28T20:33:33.813Z Vendors: n/a Products: Rocket.Chat Problem Types: CWE-285 Description: A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display messages in an incorrect order. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1379635
CVE ID: CVE-2023-28318 State: PUBLISHED Published: 2023-05-09T00:00:00.000Z Last Updated: 2025-01-28T20:28:02.478Z Vendors: n/a Products: Rocket.Chat Problem Types: CWE-285 Description: A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the Message_KeepHistory or Message_ShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1379451
CVE ID: CVE-2023-28319 State: PUBLISHED Published: 2023-05-26T00:00:00 Last Updated: 2025-01-15T16:00:16.843Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-416 Description: A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
wn to users or otherwise get leaked and revealed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1913733 - https://security.netapp.com/advisory/ntap-20230609-0009/ - https://support.apple.com/kb/HT213843 - https://support.apple.com/kb/HT213844 - https://support.apple.com/kb/HT213845 - http://seclists.org/fulldisclosure/2023/Jul/52 - http://seclists.org/fulldisclosure/2023/Jul/48 - http://seclists.org/fulldisclosure/2023/Jul/47 - https://security.gentoo.org/glsa/202310-12
CVE ID: CVE-2023-28320 State: PUBLISHED Published: 2023-05-26T00:00:00 Last Updated: 2025-01-15T15:59:07.016Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-400 Description: A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave. Additional Analyst Notes: - CVE Program Container:
ti-threaded application might therefore crash or otherwise misbehave. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1929597 - https://security.netapp.com/advisory/ntap-20230609-0009/ - https://support.apple.com/kb/HT213843 - https://support.apple.com/kb/HT213844 - https://support.apple.com/kb/HT213845 - http://seclists.org/fulldisclosure/2023/Jul/52 - http://seclists.org/fulldisclosure/2023/Jul/48 - http://seclists.org/fulldisclosure/2023/Jul/47 - https://security.gentoo.org/glsa/202310-12
CVE ID: CVE-2023-28321 State: PUBLISHED Published: 2023-05-26T00:00:00 Last Updated: 2025-01-15T15:54:33.745Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-295 Description: An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted
me) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1950627 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/ - https://lists.fedoraprojec