Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-45633 State: PUBLISHED Published: 2025-01-02T14:52:23.546Z Last Updated: 2025-01-03T18:57:39.108Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: IDX Products: IMPress Listings Problem Types: CWE-862 Description: Missing Authorization vulnerability in IDX IMPress Listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IMPress Listings: from n/a through 2.6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-listings/vulnerability/wordpress-impress-listings-plugin-2-6-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-45634 State: PUBLISHED Published: 2023-10-24T10:59:41.316Z Last Updated: 2024-09-10T18:00:08.310Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Biztechc Products: Copy or Move Comments Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Biztechc Copy or Move Comments plugin <= 5.0.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/copy-or-move-comments/wordpress-copy-or-move-comments-plugin-5-0-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-45635 State: PUBLISHED Published: 2024-06-04T09:16:47.382Z Last Updated: 2024-08-02T20:21:16.898Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: WP Darko Products: Responsive Tabs Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Darko Responsive Tabs allows Code Injection.This issue affects Responsive Tabs: from n/a before 4.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/responsive-tabs/wordpress-responsive-tabs-plugin-4-0-6-html-content-injection-vulnerability?_s_i
/database/vulnerability/responsive-tabs/wordpress-responsive-tabs-plugin-4-0-6-html-content-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-45636 State: PUBLISHED Published: 2025-01-02T11:59:52.682Z Last Updated: 2025-01-06T20:06:27.189Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: WebToffee Products: WordPress Backup & Migration Problem Types: CWE-862 Description: Missing Authorization vulnerability in WebToffee WordPress Backup & Migration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Backup & Migration: from n/a through 1.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-migration-duplicator/vulnerability/wordpress-wordpress-backup-migration-plugin
tchstack.com/database/wordpress/plugin/wp-migration-duplicator/vulnerability/wordpress-wordpress-backup-migration-plugin-1-4-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-45637 State: PUBLISHED Published: 2023-10-24T11:02:56.092Z Last Updated: 2024-09-10T17:59:35.364Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: EventPrime Products: EventPrime – Events Calendar, Bookings and Tickets Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in EventPrime EventPrime – Events Calendar, Bookings and Tickets plugin <= 3.1.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/eventprime-event-calendar-management/wordpress-eventprime-plugin-3-1-5-reflected-cross-site-scripting-xss-vulner
ability/eventprime-event-calendar-management/wordpress-eventprime-plugin-3-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-45638 State: PUBLISHED Published: 2023-10-16T08:59:06.346Z Last Updated: 2024-09-16T14:39:57.087Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: euPago Products: Eupago Gateway For Woocommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in euPago Eupago Gateway For Woocommerce plugin <= 3.1.9 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/eupago-gateway-for-woocommerce/wordpress-eupago-gateway-for-woocommerce-plugin-3-1-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45639 State: PUBLISHED Published: 2023-10-16T09:32:24.951Z Last Updated: 2024-09-16T15:55:01.580Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Codex-m Products: Sort SearchResult By Title Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Codex-m Sort SearchResult By Title plugin <= 10.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/sort-searchresult-by-title/wordpress-sort-searchresult-by-title-plugin-10-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45640 State: PUBLISHED Published: 2023-10-24T11:06:16.619Z Last Updated: 2024-08-02T20:21:16.778Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: TechnoWich Products: WP ULike – Most Advanced WordPress Marketing Toolkit Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in TechnoWich WP ULike – Most Advanced WordPress Marketing Toolkit plugin <= 4.6.8 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-ulike/wordpress-wp-ulike-plugin-4-6-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-45641 State: PUBLISHED Published: 2023-10-16T09:35:48.657Z Last Updated: 2024-09-16T15:54:38.917Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Caret Inc. Products: Caret Country Access Limit Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Caret Inc. Caret Country Access Limit plugin <= 1.0.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/caret-country-access-limit/wordpress-caret-country-access-limit-plugin-1-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45642 State: PUBLISHED Published: 2023-10-16T09:48:34.511Z Last Updated: 2024-09-16T14:40:38.796Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Hassan Ali Products: Snap Pixel Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Hassan Ali Snap Pixel plugin <= 1.5.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/snap-pixel/wordpress-snap-pixel-plugin-1-5-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45643 State: PUBLISHED Published: 2023-10-16T09:51:08.309Z Last Updated: 2024-09-16T14:47:58.595Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Anurag Deshmukh Products: CPT Shortcode Generator Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Anurag Deshmukh CPT Shortcode Generator plugin <= 1.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/cpt-shortcode/wordpress-cpt-shortcode-generator-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45644 State: PUBLISHED Published: 2023-10-24T11:10:03.498Z Last Updated: 2024-09-10T17:56:37.393Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Anurag Deshmukh Products: CPT Shortcode Generator Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Anurag Deshmukh CPT Shortcode Generator plugin <= 1.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/cpt-shortcode/wordpress-cpt-shortcode-generator-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-45645 State: PUBLISHED Published: 2023-10-16T09:53:35.938Z Last Updated: 2024-09-16T14:46:22.789Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: InfoD74 Products: WP Open Street Map Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in InfoD74 WP Open Street Map plugin <= 1.25 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-open-street-map/wordpress-wp-open-street-map-plugin-1-25-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45646 State: PUBLISHED Published: 2023-10-24T11:22:16.621Z Last Updated: 2024-09-10T17:56:20.769Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Henryholtgeerts Products: PDF Block Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Henryholtgeerts PDF Block plugin <= 1.1.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/pdf-block/wordpress-pdf-block-plugin-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-45647 State: PUBLISHED Published: 2023-10-16T09:58:02.307Z Last Updated: 2024-09-16T14:46:02.455Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: MailMunch Products: Constant Contact Forms by MailMunch Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in MailMunch Constant Contact Forms by MailMunch plugin <= 2.0.10 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/constant-contact-forms-by-mailmunch/wordpress-constant-contact-forms-by-mailmunch-plugin-2-0-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45648 State: PUBLISHED Published: 2023-10-10T18:38:34.097Z Last Updated: 2025-10-29T12:00:47.484Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to
ty of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp
CVE ID: CVE-2023-45649 State: PUBLISHED Published: 2025-01-02T11:59:53.263Z Last Updated: 2025-01-06T20:05:48.696Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: CodePeople Products: Appointment Hour Booking Problem Types: CWE-862 Description: Missing Authorization vulnerability in CodePeople Appointment Hour Booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Appointment Hour Booking: from n/a through 1.4.23. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/appointment-hour-booking/vulnerability/wordpress-appointment-hour-booking-plugin-1-4-23-br
com/database/wordpress/plugin/appointment-hour-booking/vulnerability/wordpress-appointment-hour-booking-plugin-1-4-23-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-45650 State: PUBLISHED Published: 2023-10-16T08:39:17.380Z Last Updated: 2024-09-16T15:39:33.147Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Fla-shop.com Products: HTML5 Maps Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Fla-shop.Com HTML5 Maps plugin <= 1.7.1.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/html5-maps/wordpress-html5-maps-plugin-1-7-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45651 State: PUBLISHED Published: 2023-10-16T08:41:39.143Z Last Updated: 2024-08-02T20:21:16.926Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Marco Milesi Products: WP Attachments Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi WP Attachments allows Cross Site Request Forgery.This issue affects WP Attachments: from n/a through 5.0.11. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-attachments/wordpress-wp-attachments-plugin-5-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45652 State: PUBLISHED Published: 2024-05-17T08:32:25.767Z Last Updated: 2024-08-02T20:21:16.817Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Justin Silver Products: Remote Content Shortcode Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Justin Silver Remote Content Shortcode allows PHP Local File Inclusion.This issue affects Remote Content Shortcode: from n/a through 1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/remote-content-shortcode/wordpress-remote-content
Container: References: - https://patchstack.com/database/vulnerability/remote-content-shortcode/wordpress-remote-content-shortcode-plugin-1-5-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2023-45653 State: PUBLISHED Published: 2023-10-16T08:43:54.081Z Last Updated: 2024-09-16T16:35:44.446Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Galaxy Weblinks Products: Video Playlist For YouTube Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Galaxy Weblinks Video Playlist For YouTube plugin <= 6.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/video-playlist-for-youtube/wordpress-video-playlist-for-youtube-plugin-6-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45654 State: PUBLISHED Published: 2023-10-16T08:46:13.568Z Last Updated: 2024-09-16T14:48:56.824Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Pixelgrade Products: Comments Ratings Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/comments-ratings/wordpress-comments-ratings-plugin-1-1-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45655 State: PUBLISHED Published: 2023-10-16T08:49:33.017Z Last Updated: 2024-09-16T14:48:38.641Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: PixelGrade Products: PixFields Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in PixelGrade PixFields plugin <= 0.7.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/pixfields/wordpress-pixfields-plugin-0-7-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve - https://github.com/pixelgrade/pixfields/releases/tag/0.7.1
CVE ID: CVE-2023-45656 State: PUBLISHED Published: 2023-10-16T08:54:09.308Z Last Updated: 2024-09-16T14:39:07.763Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Kevin Weber Products: Lazy Load for Videos Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Kevin Weber Lazy Load for Videos plugin <= 2.18.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/lazy-load-for-videos/wordpress-lazy-load-for-videos-plugin-2-18-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45657 State: PUBLISHED Published: 2023-11-06T08:52:50.826Z Last Updated: 2024-09-05T15:36:25.792Z Vendors: POSIMYTH Products: Nexter Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSIMYTH Nexter allows SQL Injection.This issue affects Nexter: from n/a through 2.0.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/nexter/wordpress-nexter-theme-2-0-3-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-45658 State: PUBLISHED Published: 2024-06-19T11:47:52.618Z Last Updated: 2024-08-02T20:21:16.845Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: POSIMYTH Products: Nexter Problem Types: CWE-862 Description: Missing Authorization vulnerability in POSIMYTH Nexter.This issue affects Nexter: from n/a through 2.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/nexter/wordpress-nexter-theme-2-0-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-45659 State: PUBLISHED Published: 2023-10-16T23:32:57.929Z Last Updated: 2024-09-13T20:08:55.102Z Severity: LOW (CVSS 3.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: engelsystem Products: engelsystem Problem Types: CWE-613 Description: Engelsystem is a shift planning system for chaos events. If a users' password is compromised and an attacker gained access to a users' account, i.e., logged in and obtained a session, an attackers' session is not terminated if the users' account password is reset. This vulnerability has been fixed in the commit `dbb089315ff3d`. Users are advised to update their installations. There are no known workarounds for this vulnerability. Ad
b089315ff3d`. Users are advised to update their installations. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/engelsystem/engelsystem/security/advisories/GHSA-f6mm-3v2h-jm6x - https://github.com/engelsystem/engelsystem/commit/dbb089315ff3d8aabc11445e78fb50765208b27d
CVE ID: CVE-2023-45660 State: PUBLISHED Published: 2023-10-16T18:32:00.486Z Last Updated: 2024-09-13T19:36:36.050Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: nextcloud Products: security-advisories Problem Types: CWE-918 Description: Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcloud Mail is upgraded to 2.2.8 or 3.3.0. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichmen
e no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8j9x-fmww-qr37 - https://github.com/nextcloud/mail/pull/8459 - https://hackerone.com/reports/1895874
CVE ID: CVE-2023-45661 State: PUBLISHED Published: 2023-10-20T23:26:08.605Z Last Updated: 2025-02-13T17:14:04.182Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: nothings Products: stb Problem Types: CWE-125 Description: stb_image is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in `stbi__gif_load_next`. This happens because two_back points to a memory address lower than the start of the buffer out. This issue may be used to leak internal memory allocation information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/ - https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_image.h#L6817 - https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_image.h#L7021-L7022 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVQ7ONFH5GWLMXYEAJG32A3EUKUCEVCR/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVABVF4GEM6BYD5L4L64RCRSXUHY6LGN/ - https://lists.fedoraproject.org/archives/list/package-announc
oraproject.org/message/QVABVF4GEM6BYD5L4L64RCRSXUHY6LGN/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NMXKOKPP4BKTNUTF5KSRDQAWOUILQZNO/
CVE ID: CVE-2023-45662 State: PUBLISHED Published: 2023-10-20T23:26:11.578Z Last Updated: 2025-02-13T17:14:04.772Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: nothings Products: stb Problem Types: CWE-125 Description: stb_image is a single file MIT licensed library for processing images. When `stbi_set_flip_vertically_on_load` is set to `TRUE` and `req_comp` is set to a number that doesn’t match the real number of components per pixel, the library attempts to flip the image vertically. A crafted image file can trigger `memcpy` out-of-bounds read because `bytes_per_pixel` used to calculate `bytes_per_row` doesn’t match the real image array dimensions. Add
unds read because `bytes_per_pixel` used to calculate `bytes_per_row` doesn’t match the real image array dimensions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/ - https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_image.h#L1235 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVQ7ONFH5GWLMXYEAJG32A3EUKUCEVCR/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVABVF4GEM6BYD5L4L64RCRSXUHY6LGN/ - https://lists.fedoraproject.org/archives/list/pa
nce@lists.fedoraproject.org/message/QVABVF4GEM6BYD5L4L64RCRSXUHY6LGN/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NMXKOKPP4BKTNUTF5KSRDQAWOUILQZNO/
CVE ID: CVE-2023-45663 State: PUBLISHED Published: 2023-10-20T23:26:13.834Z Last Updated: 2025-02-13T17:14:05.330Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: nothings Products: stb Problem Types: CWE-908 Description: stb_image is a single file MIT licensed library for processing images. The stbi__getn function reads a specified number of bytes from context (typically a file) into the specified buffer. In case the file stream points to the end, it returns zero. There are two places where its return value is not checked: In the `stbi__hdr_load` function and in the `stbi__tga_load` function. The latter of the two is likely more exploitable as an attacker m