Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Nimbus: versions 10.6.0 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tibco.com/services/support/advisories
CVE ID: CVE-2023-26219 State: PUBLISHED Published: 2023-10-24T21:56:50.294Z Last Updated: 2024-09-11T17:07:46.968Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: TIBCO Software Inc. Products: TIBCO Hawk, TIBCO Hawk Distribution for TIBCO Silver Fabric, TIBCO Operational Intelligence Hawk RedTail, TIBCO Runtime Agent Problem Types: The impact of this vulnerability includes the theoretical possibility that an attacker could access the message stream of the EMS server, or in the worst case, gain administrative access to the server. Description: The Hawk Console and Hawk Agent components of TIBCO Software Inc.'s TIBCO Hawk, TIBCO Hawk Distribution for TIBCO Silve
The Hawk Console and Hawk Agent components of TIBCO Software Inc.'s TIBCO Hawk, TIBCO Hawk Distribution for TIBCO Silver Fabric, TIBCO Operational Intelligence Hawk RedTail, and TIBCO Runtime Agent contain a vulnerability that theoretically allows an attacker with access to the Hawk Console’s and Agent’s log to obtain credentials used to access associated EMS servers. Affected releases are TIBCO Software Inc.'s TIBCO Hawk: versions 6.2.2 and below, TIBCO Hawk Distribution for TIBCO Silver Fabric: versions 6.2.2 and below, TIBCO Operational Intelligence Hawk RedTail: versions 7.2.1 and below, and TIBCO Runtime Agent: versions 5.12.2 and below. Additional Analyst Notes: - CVE Program Containe
ns 7.2.1 and below, and TIBCO Runtime Agent: versions 5.12.2 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tibco.com/services/support/advisories
CVE ID: CVE-2023-26220 State: PUBLISHED Published: 2023-10-10T22:06:36.002Z Last Updated: 2024-09-18T16:14:49.914Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: TIBCO Software Inc. Products: Spotfire Analyst, Spotfire Server Problem Types: CWE-79 Description: The Spotfire Library component of TIBCO Software Inc.'s Spotfire Analyst and Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBC
ck using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s Spotfire Analyst: versions 11.4.7 and below, versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4, versions 12.1.0 and 12.1.1 and Spotfire Server: versions 11.4.11 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, and 12.0.5, versions 12.1.0 and 12.1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tibco.com/services/support/advisories
CVE ID: CVE-2023-26221 State: PUBLISHED Published: 2023-11-08T19:44:03.634Z Last Updated: 2024-09-04T15:46:47.013Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: TIBCO Software Inc. Products: Spotfire Analyst, Spotfire Server, Spotfire for AWS Marketplace Problem Types: CWE-522 Description: The Spotfire Connectors component of TIBCO Software Inc.'s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with read/write access to craft malicious Analyst files. A successful attack using this vulnerability requires human interaction from a person other than the attacke
lyst files. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s Spotfire Analyst: versions 12.3.0, 12.4.0, and 12.5.0, Spotfire Server: versions 12.3.0, 12.4.0, and 12.5.0, and Spotfire for AWS Marketplace: version 12.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tibco.com/services/support/advisories
CVE ID: CVE-2023-26222 State: PUBLISHED Published: 2023-11-14T19:29:09.766Z Last Updated: 2024-08-30T14:06:54.070Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: TIBCO Software Inc. Products: TIBCO EBX, TIBCO Product and Service Catalog powered by TIBCO EBX Problem Types: The impact of this vulnerability includes the theoretical possibility resulting in unauthorized ability to update, insert or delete TIBCO EBX® data. Description: The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to ex
y TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a stored XSS on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.9.22 and below, versions 6.0.13 and below and TIBCO Product and Service Catalog powered by TIBCO EBX: versions 5.0.0 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tibco.com/services/support/advisories
CVE ID: CVE-2023-26226 State: PUBLISHED Published: 2025-05-30T17:23:54.571Z Last Updated: 2025-05-30T17:48:16.518Z Vendors: Yandex Products: Browser Problem Types: CWE-416 Description: A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://yandex.com/bugbounty/i/hall-of-fame-browser/
CVE ID: CVE-2023-26234 State: PUBLISHED Published: 2023-02-20T00:00:00.000Z Last Updated: 2025-03-17T18:41:30.736Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: JD-GUI 1.6.6 allows deserialization via UIMainWindowPreferencesProvider.singleInstance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/java-decompiler/jd-gui/issues/415 - https://github.com/java-decompiler/jd-gui/pull/417
CVE ID: CVE-2023-26235 State: PUBLISHED Published: 2023-02-20T00:00:00.000Z Last Updated: 2025-03-17T18:40:39.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: JD-GUI 1.6.6 allows XSS via util/net/InterProcessCommunicationUtil.java. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/java-decompiler/jd-gui/pull/418
CVE ID: CVE-2023-26236 State: PUBLISHED Published: 2023-10-05T00:00:00 Last Updated: 2024-09-20T14:48:52.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of message handling between WatchGuard EPDR processes, it is possible to perform a Local Privilege Escalation on Windows by sending a crafted message to a named pipe. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2023-00004
CVE ID: CVE-2023-26237 State: PUBLISHED Published: 2023-10-05T00:00:00 Last Updated: 2024-09-19T20:43:09.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in WatchGuard EPDR 8.0.21.0002. It is possible to bypass the defensive capabilities by adding a registry key as SYSTEM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2023-00005
CVE ID: CVE-2023-26238 State: PUBLISHED Published: 2023-10-05T00:00:00 Last Updated: 2024-09-19T19:23:49.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in WatchGuard EPDR 8.0.21.0002. It is possible to enable or disable defensive capabilities by sending a crafted message to a named pipe. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2023-00006
CVE ID: CVE-2023-26239 State: PUBLISHED Published: 2023-10-05T00:00:00 Last Updated: 2024-09-19T19:23:16.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of a password check, it is possible to obtain credentials to access the management console as a non-privileged user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2023-00007
CVE ID: CVE-2023-26242 State: PUBLISHED Published: 2023-02-21T00:00:00.000Z Last Updated: 2025-05-05T16:04:37.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: afu_mmio_region_get_by_offset in drivers/fpga/dfl-afu-region.c in the Linux kernel through 6.1.12 has an integer overflow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchwork.kernel.org/project/linux-fpga/patch/20230206054326.89323-1-k1rh4.lee%40gmail.com - https://security.netapp.com/advisory/ntap-20230406-0002/ - https://bugzilla.suse.com/show_bug.cgi?id=1208518
CVE ID: CVE-2023-26243 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-31T19:01:53.745Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The decryption binary used to decrypt firmware files has an information leak that allows an attacker to read the AES key and initialization vector from memory. An attacker may exploit this to create custom firmware that may be installed in the IVI system. Then, an attacker may be able to install a backdoor in the IVI system that may allow him to control it, if it is connected to the Internet through Wi-Fi. Addit
l a backdoor in the IVI system that may allow him to control it, if it is connected to the Internet through Wi-Fi. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sowhat.iit.cnr.it - https://sowhat.iit.cnr.it:8443/can-work/chimaera/-/blob/main/Report/IIT-01-2023.pdf - https://sowhat.iit.cnr.it:8443/can-work/chimaera
CVE ID: CVE-2023-26244 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-31T19:00:16.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppDMClient binary file, which is used during the firmware installation process, can be modified by an attacker to bypass the digital signature check of AppUpgrade and .lge.upgrade.xml files, which are used during the firmware installation process. This indirectly allows an attacker to use a custom version of AppUpgrade and .lge.upgrade.xml files. Additional Analyst Notes: - CVE Program Container: - CISA ADP
a custom version of AppUpgrade and .lge.upgrade.xml files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sowhat.iit.cnr.it - https://sowhat.iit.cnr.it:8443/can-work/chimaera/-/blob/main/Report/IIT-01-2023.pdf - https://sowhat.iit.cnr.it:8443/can-work/chimaera
CVE ID: CVE-2023-26245 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-31T18:57:55.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, which is used during the firmware installation process, can be modified by an attacker to bypass the version check in order to install any firmware version (e.g., newer, older, or customized). This indirectly allows an attacker to install custom firmware in the IVI system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sowhat.iit.cnr.
ystem. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sowhat.iit.cnr.it - https://sowhat.iit.cnr.it:8443/can-work/chimaera/-/blob/main/Report/IIT-01-2023.pdf - https://sowhat.iit.cnr.it:8443/can-work/chimaera
CVE ID: CVE-2023-26246 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-31T18:56:20.737Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, which is used during the firmware installation process, can be modified by an attacker to bypass the digital signature check. This indirectly allows an attacker to install custom firmware in the IVI system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sowhat.iit.cnr.it - https://sowhat.iit.cnr.it:8443/can-work/chimaera/-/blob/main/R
P Vulnrichment: References: - https://sowhat.iit.cnr.it - https://sowhat.iit.cnr.it:8443/can-work/chimaera/-/blob/main/Report/IIT-01-2023.pdf - https://sowhat.iit.cnr.it:8443/can-work/chimaera
CVE ID: CVE-2023-26248 State: PUBLISHED Published: 2024-10-25T00:00:00 Last Updated: 2024-10-25T19:56:54.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Kademlia DHT (go-libp2p-kad-dht 0.20.0 and earlier) used in IPFS (0.18.1 and earlier) assigns routing information for content (i.e., information about who holds the content) to be stored by peers whose peer IDs have a small DHT distance from the content ID. This allows an attacker to censor content by generating many Sybil peers whose peer IDs have a small distance from the content ID, thus hijacking the content resolution process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/libp2p/
content resolution process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/libp2p/go-libp2p-kad-dht - https://arxiv.org/abs/2307.12212
CVE ID: CVE-2023-26249 State: PUBLISHED Published: 2023-02-21T00:00:00.000Z Last Updated: 2025-03-14T18:32:24.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: Knot Resolver before 5.6.0 enables attackers to consume its resources, launching amplification attacks and potentially causing a denial of service. Specifically, a single client query may lead to a hundred TCP connection attempts if a DNS server closes connections without providing a response. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.knot-resolver.cz/2023-01-26-knot-resolver-5.6.0.html
CVE ID: CVE-2023-26253 State: PUBLISHED Published: 2023-02-21T00:00:00.000Z Last Updated: 2025-03-14T18:30:55.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Gluster GlusterFS 11.0, there is an xlators/mount/fuse/src/fuse-bridge.c notify stack-based buffer over-read. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gluster/glusterfs/issues/3954 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UE6K2DXP4QZVKP32Z7BSYDSRBL4H7JSE/
CVE ID: CVE-2023-26255 State: PUBLISHED Published: 2023-02-28T00:00:00.000Z Last Updated: 2025-03-18T15:51:59.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By modifying the fileName parameter to the snjCustomDesignConfig endpoint, it is possible to traverse and read the file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://marketplace.atlassian.com/apps/1216090/stagil-navigation-for-jira-menus-themes?tab=overview&hosting=cloud - https://github.com/1nters3ct/CVEs/blob/main/CVE-2023-262
l-navigation-for-jira-menus-themes?tab=overview&hosting=cloud - https://github.com/1nters3ct/CVEs/blob/main/CVE-2023-26255.md
CVE ID: CVE-2023-26256 State: PUBLISHED Published: 2023-02-28T00:00:00.000Z Last Updated: 2025-03-21T20:08:22.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By modifying the fileName parameter to the snjFooterNavigationConfig endpoint, it is possible to traverse and read the file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://marketplace.atlassian.com/apps/1216090/stagil-navigation-for-jira-menus-themes?tab=overview&hosting=cloud - https://github.com/1nters3ct/CVEs/blob/main/CVE-2023
tagil-navigation-for-jira-menus-themes?tab=overview&hosting=cloud - https://github.com/1nters3ct/CVEs/blob/main/CVE-2023-26256.md
CVE ID: CVE-2023-26257 State: PUBLISHED Published: 2023-02-27T00:00:00 Last Updated: 2024-08-02T11:46:23.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Connected Vehicle Systems Alliance (COVESA; formerly GENIVI) dlt-daemon through 2.18.8. Dynamic memory is not released after it is allocated in dlt-control-common.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/COVESA/dlt-daemon/issues/440 - https://github.com/COVESA/dlt-daemon/pull/441/commits/b6149e203f919c899fefc702a17fbb78bdec3700 - https://lists.debian.org/debian-lts-announce/2024/06/msg00021.html
CVE ID: CVE-2023-26258 State: PUBLISHED Published: 2023-07-03T00:00:00 Last Updated: 2024-11-25T18:13:36.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the AuthUUID token. This token can be used at /WebServiceImpl/services/VirtualStandbyServiceImpl to obtain a valid session. This session can be used to execute any task as administrator. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arcserve.com/products/arcserve-udp - https://www.mdsec.co.uk/2023/06/cve-2023-26258-remote-code-execution-
- https://www.arcserve.com/products/arcserve-udp - https://www.mdsec.co.uk/2023/06/cve-2023-26258-remote-code-execution-in-arcserve-udp-backup/ - https://support.arcserve.com/s/article/KB000015720?language=en_US
CVE ID: CVE-2023-26260 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-11T15:36:27.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: OXID eShop 6.2.x before 6.4.4 and 6.5.x before 6.5.2 allows session hijacking, leading to partial access of a customer's account by an attacker, due to an improper check of the user agent. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.oxid-esales.com/de/security/security-bulletins.html#security-bulletin-2023-001
CVE ID: CVE-2023-26261 State: PUBLISHED Published: 2023-03-08T00:00:00.000Z Last Updated: 2025-03-05T18:36:13.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: In UBIKA WAAP Gateway/Cloud through 6.10, a blind XPath injection leads to an authentication bypass by stealing the session of another connected user. The fixed versions are WAAP Gateway & Cloud 6.11.0 and 6.5.6-patch15. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.ubikasec.com/x/CQDAAw - https://gist.github.com/Jakick/7d1635b886654ddd0e476b3c79a7ba9f
CVE ID: CVE-2023-26262 State: PUBLISHED Published: 2023-03-14T00:00:00.000Z Last Updated: 2025-02-27T20:17:51.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted language file upload vulnerability exists the can lead to direct code execution on the content management (CM) server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sitecore.com/trust - https://github.com/istern/CVE-2023-26262
CVE ID: CVE-2023-26263 State: PUBLISHED Published: 2023-04-13T00:00:00.000Z Last Updated: 2025-02-07T16:28:48.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: All versions of Talend Data Catalog before 8.0-20230110 are potentially vulnerable to XML External Entity (XXE) attacks in the /MIMBWebServices/license endpoint of the remote harvesting server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talend.com - https://www.talend.com/security/incident-response/#CVE-2023-26264
CVE ID: CVE-2023-26264 State: PUBLISHED Published: 2023-04-13T00:00:00.000Z Last Updated: 2025-02-07T15:57:16.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: All versions of Talend Data Catalog before 8.0-20220907 are potentially vulnerable to XML External Entity (XXE) attacks in the license parsing code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talend.com - https://www.talend.com/security/incident-response/#CVE-2023-26264
CVE ID: CVE-2023-26265 State: PUBLISHED Published: 2023-02-21T00:00:00.000Z Last Updated: 2025-03-14T18:29:44.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Borg theme before 1.1.19 for Backdrop CMS does not sufficiently sanitize path arguments that are passed in via a URL. The function borg_preprocess_page in the file template.php does not properly sanitize incoming path arguments before using them. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://backdropcms.org/project/borg - https://github.com/backdrop-contrib/borg/compare/1.x-1.1.18...1.x-1.1.19
CVE ID: CVE-2023-26266 State: PUBLISHED Published: 2023-02-21T00:00:00.000Z Last Updated: 2025-03-14T18:24:00.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: In AFL++ 4.05c, the CmpLog component uses the current working directory to resolve and execute unprefixed fuzzing targets, allowing code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/AFLplusplus/AFLplusplus/pull/1643
CVE ID: CVE-2023-26267 State: PUBLISHED Published: 2023-02-21T00:00:00.000Z Last Updated: 2025-03-14T18:22:26.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XML external entities was silently enabled via \LIBXML_DTDLOAD | \LIBXML_DTDATTR. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.sr.ht/~fkooman/php-saml-sp/commit/851f75b298a77e62d9022f1b170f662f5f7716d6 - https://git.sr.ht/~fkooman/php-saml-sp/log
CVE ID: CVE-2023-26268 State: PUBLISHED Published: 2023-05-02T20:06:09.352Z Last Updated: 2024-10-15T18:11:19.560Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Apache Software Foundation Products: Apache CouchDB, IBM Cloudant Problem Types: CWE-200 Description: Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions: * validate_doc_update * list * filter * filter views (using view functions as filters) * rewrite * update This doesn't affect map/reduce or search (Dreyfus) index functions. Users are recommended to upgrade to a version that is no lo