Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-45249 State: PUBLISHED Published: 2024-07-24T14:03:56.481Z Last Updated: 2025-10-21T22:55:49.110Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Acronis Products: Acronis Cyber Infrastructure Problem Types: CWE-1393 Description: Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5.2.1-69, Acronis Cyber Infrastructure (ACI) before build 5.3.1-53, Acronis Cyber Infrastructure (ACI) before build 5.4.4-132. Additional Analyst Notes: - CIS
(ACI) before build 5.3.1-53, Acronis Cyber Infrastructure (ACI) before build 5.4.4-132. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security-advisory.acronis.com/advisories/SEC-6452 - https://www.securityweek.com/acronis-product-vulnerability-exploited-in-the-wild/
CVE ID: CVE-2023-45251 State: REJECTED Published: N/A Last Updated: 2023-12-26T17:29:44.426812 Description: No description available.
CVE ID: CVE-2023-45252 State: PUBLISHED Published: 2023-12-01T00:00:00 Last Updated: 2024-08-02T20:14:19.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: DLL Hijacking vulnerability in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, due to the installation of the service in a directory that grants write privileges to standard users, allows attackers to manipulate files, execute arbitrary code, and escalate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.xlent.no/aktuelt/security-disclosure-of-vulnerabilities-cve-2023-45252-and-cve-2023-45253/
CVE ID: CVE-2023-45253 State: PUBLISHED Published: 2023-12-01T00:00:00 Last Updated: 2024-11-26T19:12:15.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, allows attackers to manipulate files and escalate privileges via RollingFileAppender.DeleteFile method performed by the log4net library. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.xlent.no/aktuelt/security-disclosure-of-vulnerabilities-cve-2023-45252-and-cve-2023-45253/
CVE ID: CVE-2023-45256 State: PUBLISHED Published: 2025-06-12T00:00:00.000Z Last Updated: 2025-06-17T19:07:14.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the EuroInformation MoneticoPaiement module before 1.1.1 for PrestaShop allow remote attackers to execute arbitrary SQL commands via the TPE, societe, MAC, reference, or aliascb parameter to transaction.php, validation.php, or callback.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.monetico-paiement.fr/fr/installer/telechargements/kit_telechargeable.aspx?_tabi=I0&_pid=ValidateLicencePage - https://security.friendsofpresta.org/modules/2025/06/10/
nts/kit_telechargeable.aspx?_tabi=I0&_pid=ValidateLicencePage - https://security.friendsofpresta.org/modules/2025/06/10/MoneticoPaiement.html
CVE ID: CVE-2023-45267 State: PUBLISHED Published: 2023-10-13T14:37:09.202Z Last Updated: 2024-09-16T18:58:46.983Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Zizou1988 Products: IRivYou Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Zizou1988 IRivYou plugin <= 2.2.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wooreviews-importer/wordpress-irivyou-add-reviews-from-aliexpress-and-amazon-to-woocommerce-plugin-2-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45268 State: PUBLISHED Published: 2023-10-13T14:53:59.010Z Last Updated: 2024-09-16T18:58:27.007Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Hitsteps Products: Hitsteps Web Analytics Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Hitsteps Hitsteps Web Analytics plugin <= 5.86 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/hitsteps-visitor-manager/wordpress-hitsteps-web-analytics-plugin-5-85-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45269 State: PUBLISHED Published: 2023-10-13T15:00:17.817Z Last Updated: 2024-08-02T20:14:19.865Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: David Cole Products: Simple SEO Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 2.0.25 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/cds-simple-seo/wordpress-simple-seo-plugin-2-0-23-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45270 State: PUBLISHED Published: 2023-10-13T15:13:34.082Z Last Updated: 2024-09-16T18:36:13.055Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: PINPOINT.WORLD Products: Pinpoint Booking System Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in PINPOINT.WORLD Pinpoint Booking System plugin <= 2.9.9.4.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/booking-system/wordpress-pinpoint-booking-system-plugin-2-9-9-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45271 State: PUBLISHED Published: 2025-01-02T11:59:50.933Z Last Updated: 2025-01-06T20:07:37.161Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WowStore Team Products: ProductX – Gutenberg WooCommerce Blocks Problem Types: CWE-862 Description: Missing Authorization vulnerability in WowStore Team ProductX – Gutenberg WooCommerce Blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProductX – Gutenberg WooCommerce Blocks: from n/a through 2.7.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/product-blocks/vulnerability/wordpress-p
DP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/product-blocks/vulnerability/wordpress-productx-gutenberg-woocommerce-blocks-plugin-2-7-8-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-45272 State: PUBLISHED Published: 2025-01-02T14:53:25.291Z Last Updated: 2025-01-03T18:57:29.244Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: 10Web Products: 10Web Map Builder for Google Maps Problem Types: CWE-862 Description: Missing Authorization vulnerability in 10Web 10Web Map Builder for Google Maps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 10Web Map Builder for Google Maps: from n/a through 1.0.73. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wd-google-maps/vulnerability/wordpress-10web-map-builder-for-google-maps-
tps://patchstack.com/database/wordpress/plugin/wd-google-maps/vulnerability/wordpress-10web-map-builder-for-google-maps-plugin-1-0-73-notice-dismissal-vulnerability?_s_id=cve
CVE ID: CVE-2023-45273 State: PUBLISHED Published: 2023-10-16T08:18:48.457Z Last Updated: 2024-09-16T16:51:51.079Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Matt McKenny Products: Stout Google Calendar Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Matt McKenny Stout Google Calendar plugin <= 1.2.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/stout-google-calendar/wordpress-stout-google-calendar-plugin-1-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45274 State: PUBLISHED Published: 2023-10-16T08:21:37.194Z Last Updated: 2024-09-16T16:49:57.547Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: SendPulse Products: SendPulse Free Web Push Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in SendPulse SendPulse Free Web Push plugin <= 1.3.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/sendpulse-web-push/wordpress-sendpulse-free-web-push-plugin-1-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45275 State: PUBLISHED Published: 2025-01-02T11:59:51.535Z Last Updated: 2025-01-06T20:07:12.638Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Kali Forms Products: Contact Form builder with drag & drop - Kali Forms Problem Types: CWE-862 Description: Missing Authorization vulnerability in Kali Forms Contact Form builder with drag & drop - Kali Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form builder with drag & drop - Kali Forms: from n/a through 2.3.28. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/kali-forms/v
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/kali-forms/vulnerability/wordpress-contact-form-builder-with-drag-drop-plugin-2-3-27-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-45276 State: PUBLISHED Published: 2023-10-13T15:10:15.357Z Last Updated: 2024-09-16T18:36:40.492Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: automatededitor.com Products: Automated Editor Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in automatededitor.Com Automated Editor plugin <= 1.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/automated-editor/wordpress-automated-editor-plugin-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45277 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-08-02T20:14:19.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yamcs 5.8.6 is vulnerable to directory traversal (issue 1 of 2). The vulnerability is in the storage functionality of the API and allows one to escape the base directory of the buckets, freely navigate system directories, and read arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7 - https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies
CVE ID: CVE-2023-45278 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-08-02T20:21:15.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in the storage functionality of the API in Yamcs 5.8.6 allows attackers to delete arbitrary files via crafted HTTP DELETE request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7 - https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies
CVE ID: CVE-2023-45279 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-08-02T20:21:15.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yamcs 5.8.6 allows XSS (issue 1 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload a display referencing a malicious JavaScript file to the bucket. The user can then open the uploaded display by selecting Telemetry from the menu and navigating to the display. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7 - https://www.linkedin.com/pulse/yamcs-vulnerability-assessmen
/github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7 - https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies
CVE ID: CVE-2023-45280 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-08-02T20:21:15.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yamcs 5.8.6 allows XSS (issue 2 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload an HTML file containing arbitrary JavaScript and then navigate to it. Once the user opens the file, the browser will execute the arbitrary JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7 - https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies
CVE ID: CVE-2023-45281 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-08-02T20:21:15.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Yamcs 5.8.6 allows attackers to obtain the session cookie via upload of crafted HTML file. Additional Analyst Notes: - CVE Program Container: References: - https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies
CVE ID: CVE-2023-45282 State: PUBLISHED Published: 2023-10-06T00:00:00 Last Updated: 2024-09-19T18:51:56.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nasa.github.io/openmct/ - https://github.com/nasa/openmct/pull/7094/commits/545a1770c523ecc3410dca884c6809d5ff0f9d52 - https://www.linkedin.com/pulse/prototype-pollution-nasas-open-mct-cve-2023-45282 - https://github.com/nasa/openmct/compare/v3.0.2...v3.1.0
CVE ID: CVE-2023-45283 State: PUBLISHED Published: 2023-11-09T16:30:12.395Z Last Updated: 2025-02-13T17:13:59.471Z Vendors: Go standard library Products: path/filepath, internal/safefilepath Problem Types: CWE-41: Improper Resolution of Path Equivalence Description: The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local devic
to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \?, resulting in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among othe
ame in Windows paths starting with \?, resulting in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other effects). The previous behavior has been restored. Additional Analyst Notes: - CVE Program Container: References: - https://go.dev/issue/63713 - https://go.dev/cl/540277 - https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY - https://go.dev/issue/64028 - https://go.dev/cl/541175 - https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ - https://pkg.go.dev/vuln/GO-2023-2185 - http://www.openwall.com/lists/oss-security/2023/12/05/2 - https://security.netapp.com/advisory/ntap-20231214-0008/
CVE ID: CVE-2023-45284 State: PUBLISHED Published: 2023-11-09T16:30:15.250Z Last Updated: 2024-09-03T19:00:47.531Z Vendors: Go standard library Products: path/filepath Problem Types: CWE-41: Improper Resolution of Path Equivalence Description: On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/63713 - https://go.dev/cl
st Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/63713 - https://go.dev/cl/540277 - https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY - https://pkg.go.dev/vuln/GO-2023-2186
CVE ID: CVE-2023-45285 State: PUBLISHED Published: 2023-12-06T16:27:55.521Z Last Updated: 2025-02-13T17:14:00.033Z Vendors: Go toolchain Products: cmd/go Problem Types: CWE-636: Not Failing Securely ('Failing Open') Description: Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off). Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/golang-dev/c/6ypN5Eji
off). Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ - https://go.dev/issue/63845 - https://go.dev/cl/540257 - https://pkg.go.dev/vuln/GO-2023-2383 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UIU6HOGV6RRIKWM57LOXQA75BGZSIH6G/
CVE ID: CVE-2023-45286 State: PUBLISHED Published: 2023-11-28T16:31:21.078Z Last Updated: 2024-08-28T20:01:23.626Z Vendors: github.com/go-resty/resty/v2 Products: github.com/go-resty/resty/v2 Problem Types: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Description: A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an u
s.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request. The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/go-resty/resty/issues/743 - https://github.com/go-resty/resty/issues/739 - https://github.com/go-resty/resty/pull/745 - https://github.com/go-resty/resty/commit/577fed8730d79f583eb48dfc81674164e1fc471e - https://pkg.go.dev/vuln/GO
ull/745 - https://github.com/go-resty/resty/commit/577fed8730d79f583eb48dfc81674164e1fc471e - https://pkg.go.dev/vuln/GO-2023-2328
CVE ID: CVE-2023-45287 State: PUBLISHED Published: 2023-12-05T16:18:06.104Z Last Updated: 2025-02-13T17:14:00.588Z Vendors: Go standard library Products: crypto/tls Problem Types: CWE-208: Observable Timing Discrepancy Description: Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant time RSA implementation, which we do not be
on key bits. In Go 1.20, the crypto/tls library switched to a fully constant time RSA implementation, which we do not believe exhibits any timing side channels. Additional Analyst Notes: - CVE Program Container: References: - https://go.dev/issue/20654 - https://go.dev/cl/326012/26 - https://groups.google.com/g/golang-announce/c/QMK8IQALDvA - https://people.redhat.com/~hkario/marvin/ - https://pkg.go.dev/vuln/GO-2023-2375 - https://security.netapp.com/advisory/ntap-20240112-0005/
CVE ID: CVE-2023-45288 State: PUBLISHED Published: 2024-04-04T20:37:30.714Z Last Updated: 2025-11-04T18:17:43.583Z Vendors: Go standard library, golang.org/x/net Products: net/http, golang.org/x/net/http2 Problem Types: CWE-400: Uncontrolled Resource Consumption Description: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoin
is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/65051 - https://go.dev/cl/576155 - https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M - https://pkg.go.dev/vuln
e/65051 - https://go.dev/cl/576155 - https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M - https://pkg.go.dev/vuln/GO-2024-2687 - https://security.netapp.com/advisory/ntap-20240419-0009/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/ - http://www.openwall.com/lists/oss-security/2024/04/05/4 - http://www.openwall.com/lists/oss-security/2024/04/03/16
CVE ID: CVE-2023-45289 State: PUBLISHED Published: 2024-03-05T22:22:30.306Z Last Updated: 2025-02-13T17:14:01.755Z Vendors: Go standard library Products: net/http, net/http/cookiejar Problem Types: CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer Description: When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly
but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/issue/65065 - https://go.dev/cl/569340 - https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg - https://pkg.go.dev/vuln/GO-2024-2600 - https://security.netapp.com/advisory/ntap-20240329-0006/ - http://www.openwall.com/lists/oss-security/2024/03/08/4