Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
itive information and limited ability to alter some information in ePO. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kcm.trellix.com/corporate/index?page=content&id=SB10402
CVE ID: CVE-2023-3947 State: PUBLISHED Published: 2023-07-26T03:34:28.251Z Last Updated: 2025-02-05T19:38:42.804Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: j_3rk Products: Video Conferencing with Zoom Problem Types: CWE-321 Use of Hard-coded Cryptographic Key Description: The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapi_encrypt_decrypt' function in versions up to, and including, 4.2.1. This makes it possible for unauthenticated attackers to decrypt and view the meeting id and password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
o decrypt and view the meeting id and password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ba2515d9-ced0-4b49-87c4-04c8391c2608?source=cve - https://plugins.trac.wordpress.org/browser/video-conferencing-with-zoom-api/tags/4.2.1/includes/helpers.php#L546 - https://plugins.trac.wordpress.org/browser/video-conferencing-with-zoom-api/trunk/includes/Helpers/Encryption.php?rev=2942302
CVE ID: CVE-2023-3948 State: REJECTED Published: N/A Last Updated: 2025-08-21T22:19:52.145Z Description: No description available.
CVE ID: CVE-2023-3949 State: PUBLISHED Published: 2023-12-01T07:02:13.130Z Last Updated: 2025-11-20T04:09:03.271Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-201 Description: An issue has been discovered in GitLab affecting all versions starting from 11.3 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for unauthorized users to view a public projects' release descriptions via an atom endpoint when release access on the public was set to only project members. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Ref
public was set to only project members. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/419664 - https://hackerone.com/reports/2079374
CVE ID: CVE-2023-3950 State: PUBLISHED Published: 2023-09-01T10:30:46.990Z Last Updated: 2025-11-20T04:09:08.266Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-312 Description: An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can now only write the key, not read it. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/419675 - https
SA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/419675 - https://hackerone.com/reports/2079154
CVE ID: CVE-2023-3953 State: PUBLISHED Published: 2023-08-09T14:02:44.472Z Last Updated: 2024-10-09T18:10:11.842Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Schneider Electric Products: GP-Pro EX WinGP for iPC, GP-Pro EX WinGP for PC/AT Problem Types: CWE-119 Description: A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause memory corruption when an authenticated user opens a tampered log file from GP-Pro EX. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-220-01&p_enDocType=Secur
P Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-220-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-220-01.pdf
CVE ID: CVE-2023-3954 State: PUBLISHED Published: 2023-08-21T12:29:48.909Z Last Updated: 2025-05-05T15:53:39.190Z Vendors: Unknown Products: MultiParcels Shipping For WooCommerce Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b463ccbb-2dc1-479f-bc88-becd204b2dc0
CVE ID: CVE-2023-3955 State: PUBLISHED Published: 2023-10-31T20:36:54.352Z Last Updated: 2025-02-13T17:03:13.470Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Kubernetes Products: kubelet Problem Types: CWE-20 Description: A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kubernetes/kubernetes/issues/119595 - https://groups.google.com/g/kubernetes-security-announce/c/JrX4bb7d83
//github.com/kubernetes/kubernetes/issues/119595 - https://groups.google.com/g/kubernetes-security-announce/c/JrX4bb7d83E - https://security.netapp.com/advisory/ntap-20231221-0002/
CVE ID: CVE-2023-3956 State: PUBLISHED Published: 2023-07-27T06:54:14.804Z Last Updated: 2025-02-05T19:38:35.811Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: instawp Products: InstaWP Connect – 1-click WP Staging & Migration (beta) Problem Types: CWE-862 Missing Authorization Description: The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data and loss of data due to a missing capability check on the 'events_receiver' function in versions up to, and including, 0.0.9.18. This makes it possible for unauthenticated attackers to add, modify or delete post and taxonomy, install, activate or deactivate plug
possible for unauthenticated attackers to add, modify or delete post and taxonomy, install, activate or deactivate plugin, change customizer settings, add or modify or delete user including administrator user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/48e7acf2-61d4-4762-8657-0701910ce69b?source=cve - https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.0.9.18/includes/class-instawp-rest-apis.php#L103 - https://plugins.trac.wordpress.org/changeset/2942363/instawp-connect#file5
CVE ID: CVE-2023-3957 State: PUBLISHED Published: 2023-07-27T06:54:16.133Z Last Updated: 2025-02-05T19:38:28.320Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: navzme Products: ACF Photo Gallery Field Problem Types: CWE-285 Improper Authorization Description: The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on the 'apg_profile_update' function in versions up to, and including, 1.9. This makes it possible for authenticated attackers, with subscriber-level permissions or above, to update the user metas arbitrarily. The meta value can only be a string. Additional Analyst Not
permissions or above, to update the user metas arbitrarily. The meta value can only be a string. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/689511e0-1355-4fcb-8a72-d819abc8e9a3?source=cve - https://plugins.trac.wordpress.org/browser/navz-photo-gallery/tags/1.9/includes/acf_photo_gallery_save.php#L42 - https://plugins.trac.wordpress.org/changeset/2943404/navz-photo-gallery#file0
CVE ID: CVE-2023-3958 State: PUBLISHED Published: 2023-08-16T04:36:00.625Z Last Updated: 2025-02-05T19:35:54.745Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: frogerme Products: WP Remote Users Sync Problem Types: CWE-918 Server-Side Request Forgery (SSRF) Description: The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in versions up to, and including, 1.2.12. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from int
sts to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This was partially patched in version 1.2.12 and fully patched in version 1.2.13. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2e78c759-4a54-4ee4-8eff-df91fe9dad46?source=cve - https://plugins.trac.wordpress.org/browser/wp-remote-users-sync/trunk/inc/api/class-wprus-api-abstract.php#L674 - https://plugins.trac.wordpress.org/changeset/2946667/wp-remote-users-sync#file127 - https://plugins.trac.wordpress.org/changeset/2953845/wp-remote-users-sync#file0
CVE ID: CVE-2023-3959 State: PUBLISHED Published: 2023-11-08T23:02:55.581Z Last Updated: 2025-01-16T21:25:58.442Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Zavio Products: IP Camera CF7500, IP Camera CF7300, IP Camera CF7201, IP Camera CF7501, IP Camera CB3211, IP Camera CB3212, IP Camera CB5220, IP Camera CB6231, IP Camera B8520, IP Camera B8220, IP Camera CD321 Problem Types: CWE-121 Description: Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to multiple instances of stack-based overflows. While processing XML elements from incoming network requ
are vulnerable to multiple instances of stack-based overflows. While processing XML elements from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03
CVE ID: CVE-2023-3961 State: PUBLISHED Published: 2023-11-03T12:32:29.558Z Last Updated: 2025-11-20T19:51:41.372Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Storage 3 Problem Types: CWE-22 Description: A path traversal vulnerability was identified
Enterprise Linux 7, Red Hat Storage 3 Problem Types: CWE-22 Description: A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand. However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe name containing Unix directory traversal characters (../). This could result in SMB clients connecting as root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe
onnecting as root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe name resolving to an external service using an existing Unix domain socket, it could potentially lead to unauthorized access to the service and consequential adverse events, including compromise or service crashes. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:6209 - https://access.redhat.com/errata/RHSA-2023:6744 - https://access.redhat.com/errata/RHSA-2023:7371 - https://access.redhat.com/errata/RHSA-2023:7408 - https://access.redhat.com/errata/RHSA-2023:7464 - https://access.redhat.com/errata/RHSA-2023:7467 -
ta/RHSA-2023:7408 - https://access.redhat.com/errata/RHSA-2023:7464 - https://access.redhat.com/errata/RHSA-2023:7467 - https://access.redhat.com/security/cve/CVE-2023-3961 - https://bugzilla.redhat.com/show_bug.cgi?id=2241881 - https://bugzilla.samba.org/show_bug.cgi?id=15422 - https://www.samba.org/samba/security/CVE-2023-3961.html
CVE ID: CVE-2023-3962 State: PUBLISHED Published: 2023-10-20T15:06:22.488Z Last Updated: 2025-02-05T19:00:49.474Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: myshopkit Products: Winters - WordPress Blog Theme Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Winters theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successful
s it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6f8b75a1-f0f2-445b-a1c7-1628916470d3?source=cve - https://github.com/BlackFan/client-side-prototype-pollution
CVE ID: CVE-2023-3963 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:22.366Z Description: No description available.
CVE ID: CVE-2023-3964 State: PUBLISHED Published: 2023-12-01T07:02:18.158Z Last Updated: 2025-11-20T04:09:13.257Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in GitLab affecting all versions starting from 13.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for users to access composer packages on public projects that have package registry disabled in the project settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/419857 - https://hackerone.com/reports/2037316
CVE ID: CVE-2023-3965 State: PUBLISHED Published: 2023-10-20T15:06:11.641Z Last Updated: 2025-02-05T19:02:23.759Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: National Show Centre Products: NSC WordPress Theme Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The nsc theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully tri
ossible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5909513d-8877-40ff-bee9-d565141b7ed2?source=cve - https://github.com/BlackFan/client-side-prototype-pollution
CVE ID: CVE-2023-3966 State: PUBLISHED Published: 2024-02-22T12:15:53.128Z Last Updated: 2025-02-13T17:03:14.623Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a, Red Hat, RDO, Fedora Products: openvswitch, Fast Datapath for RHEL 7, Fast Datapath for RHEL 8, Fast Datapath for RHEL 9, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 3.11, OpenStack RDO, Fedora Problem Types: CWE-248 Description: A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is en
service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-3966 - https://bugzilla.redhat.com/show_bug.cgi?id=2178363 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VYYUBF6OW2JG7VOFEOROHXGSJCTES3QO/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LFZADABUDOFI2KZIRQBYFZCIKH55RGY3/
CVE ID: CVE-2023-3967 State: PUBLISHED Published: 2023-10-03T01:04:00.870Z Last Updated: 2024-09-20T14:18:07.774Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Hitachi Products: Hitachi Ops Center Common Services Problem Types: CWE-770 Description: Allocation of Resources Without Limits or Throttling vulnerability in Hitachi Ops Center Common Services on Linux allows DoS.This issue affects Hitachi Ops Center Common Services: before 10.9.3-00. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-142/index.html
CVE ID: CVE-2023-3969 State: PUBLISHED Published: 2023-07-27T11:31:03.531Z Last Updated: 2024-08-02T07:08:50.715Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: GZ Scripts Products: Availability Booking Calendar PHP Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in GZ Scripts Availability Booking Calendar PHP 1.0. Affected by this issue is some unknown functionality of the file index.php of the component HTTP POST Request Handler. The manipulation of the argument promo_code leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this
he attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235568. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.235568 - https://vuldb.com/?ctiid.235568 - https://seclists.org/fulldisclosure/2023/Jul/51
CVE ID: CVE-2023-3970 State: PUBLISHED Published: 2023-07-27T12:00:06.063Z Last Updated: 2024-08-02T07:08:50.824Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: GZ Scripts Products: Availability Booking Calendar PHP Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in GZ Scripts Availability Booking Calendar PHP 1.0. This affects an unknown part of the file /index.php?controller=GzUser&action=edit&id=1 of the component Image Handler. The manipulation of the argument img leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-2355
e to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235569 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.235569 - https://vuldb.com/?ctiid.235569 - https://seclists.org/fulldisclosure/2023/Jul/51
CVE ID: CVE-2023-3971 State: PUBLISHED Published: 2023-10-04T14:26:01.621Z Last Updated: 2025-11-20T19:51:46.690Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Red Hat Ansible Automation Platform 2.3 for RHEL 8, Red Hat Ansible Automation Platform 2.3 for RHEL 9, Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9 Problem Types: CWE-80 Description: An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise. Additional Analyst Notes: -
ials by creating a custom login page by injecting HTML, resulting in a complete compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:4340 - https://access.redhat.com/errata/RHSA-2023:4590 - https://access.redhat.com/security/cve/CVE-2023-3971 - https://bugzilla.redhat.com/show_bug.cgi?id=2226965
CVE ID: CVE-2023-3972 State: PUBLISHED Published: 2023-11-01T15:54:52.093Z Last Updated: 2025-11-20T07:23:35.681Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SA
ort, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 6 Problem Types: CWE-379 Description: A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local user or attacker could create the /var/tmp/insights-client directory (ow
ed on the system by root, an unprivileged local user or attacker could create the /var/tmp/insights-client directory (owning the directory with read, write, and execute permissions) on the system. After the insights-client is registered by root, an attacker could then control the directory content that insights are using by putting malicious scripts into it and executing arbitrary code as root (trivially bypassing SELinux protections because insights processes are allowed to disable SELinux system-wide). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:6264 - https://access.redhat.com/errata/RHSA-2023:6282 -
iner: References: - https://access.redhat.com/errata/RHSA-2023:6264 - https://access.redhat.com/errata/RHSA-2023:6282 - https://access.redhat.com/errata/RHSA-2023:6283 - https://access.redhat.com/errata/RHSA-2023:6284 - https://access.redhat.com/errata/RHSA-2023:6795 - https://access.redhat.com/errata/RHSA-2023:6796 - https://access.redhat.com/errata/RHSA-2023:6798 - https://access.redhat.com/errata/RHSA-2023:6811 - https://access.redhat.com/security/cve/CVE-2023-3972 - https://bugzilla.redhat.com/show_bug.cgi?id=2227027 - https://github.com/RedHatInsights/insights-core/pull/3878