Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-32696 State: PUBLISHED Published: 2023-05-30T18:33:53.862Z Last Updated: 2025-01-09T21:20:26.614Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ckan Products: ckan-docker-base Problem Types: CWE-269 Description: CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the `ckan` user (equivalent to www-data) owned code and configuration files in the docker container and the `ckan` user had the permissions to use sudo. These issues allowed for code execution or privilege escalation if an arbitrary file write bug was available. Versions 2.9.9, 2.9.9-dev, 2.10.1, and 2.10.1-dev c
r privilege escalation if an arbitrary file write bug was available. Versions 2.9.9, 2.9.9-dev, 2.10.1, and 2.10.1-dev contain a patch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ckan/ckan-docker-base/security/advisories/GHSA-c74x-xfvr-x5wg - https://github.com/ckan/ckan-docker-base/commit/5483c46ce9b518a4e1b626ef7032cce2c1d75c7d
CVE ID: CVE-2023-32697 State: PUBLISHED Published: 2023-05-23T22:45:10.493Z Last Updated: 2025-03-05T18:59:08.873Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: xerial Products: sqlite-jdbc Problem Types: CWE-94 Description: SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xerial/sqlite-jdbc/security/advisories/GHSA-6phf-6h5g-97j2 - https://github.com
chment: References: - https://github.com/xerial/sqlite-jdbc/security/advisories/GHSA-6phf-6h5g-97j2 - https://github.com/xerial/sqlite-jdbc/releases/tag/3.41.2.2
CVE ID: CVE-2023-32698 State: PUBLISHED Published: 2023-05-30T03:56:30.807Z Last Updated: 2025-01-10T20:36:22.810Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: goreleaser Products: nfpm Problem Types: CWE-276 Description: nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files (without extra config for enforcing it’s own permissions) files could go out with bad permissions (chmod 666 or 777). Anyone using nfpm for creating packages without checking/setting file permissions before packaging could result in bad permissions for files/folders. Additional Analyst Notes: - CVE Program Co
rmissions before packaging could result in bad permissions for files/folders. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/goreleaser/nfpm/security/advisories/GHSA-w7jw-q4fg-qc4c - https://github.com/goreleaser/nfpm/commit/ed9abdf63d5012cc884f2a83b4ab2b42b3680d30 - https://github.com/goreleaser/nfpm/releases/tag/v2.29.0
CVE ID: CVE-2023-32699 State: PUBLISHED Published: 2023-05-30T18:59:26.174Z Last Updated: 2025-01-10T16:51:37.440Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: metersphere Products: metersphere Problem Types: CWE-770 Description: MeterSphere is an open source continuous testing platform. Version 2.9.1 and prior are vulnerable to denial of service. ​The `checkUserPassword` method is used to check whether the password provided by the user matches the password saved in the database, and the `CodingUtil.md5` method is used to encrypt the original password with MD5 to ensure that the password will not be saved in plain text when it is stored. If a user submits
ginal password with MD5 to ensure that the password will not be saved in plain text when it is stored. If a user submits a very long password when logging in, the system will be forced to execute the long password MD5 encryption process, causing the server CPU and memory to be exhausted, thereby causing a denial of service attack on the server. This issue is fixed in version 2.10.0-lts with a maximum password length. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/metersphere/metersphere/security/advisories/GHSA-qffq-8gf8-mhq7 - https://github.com/metersphere/metersphere/commit/c59e381d368990214813085a1a4877c5ef865411
CVE ID: CVE-2023-32700 State: PUBLISHED Published: 2023-05-20T00:00:00.000Z Last Updated: 2025-01-31T15:30:02.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tug.org/pipermail/tex-live/2023-May/049188.html - https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/tags/1.17.0 - https://github.com/TeX-Live/texlive-source
/049188.html - https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/tags/1.17.0 - https://github.com/TeX-Live/texlive-source/releases/tag/build-svn66984 - https://tug.org/~mseven/luatex.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLY43MIRONJSJVNBDFQHQ26MP3JIOB3H/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TF6YXUUFRGBIXIIIEV5SGBJXXT2SMUK5/
CVE ID: CVE-2023-32701 State: PUBLISHED Published: 2023-11-14T18:33:59.148Z Last Updated: 2025-09-09T15:06:29.621Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: BlackBerry Products: QNX Software Development Platform (SDP) Problem Types: CWE-1288 Description: Improper Input Validation in the Networking Stack of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to potentially cause Information Disclosure or a Denial-of-Service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.blackberry.com/kb/articleDetail?articleNumber=000112401
CVE ID: CVE-2023-32706 State: PUBLISHED Published: 2023-06-01T16:34:28.142Z Last Updated: 2025-02-28T11:03:44.652Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-611 Description: On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an unauthenticated attacker can send specially-crafted messages to the XML parser within SAML authentication to cause a denial of service in the Splunk daemon. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2023-0601
CVE ID: CVE-2023-32707 State: PUBLISHED Published: 2023-06-01T16:34:30.607Z Last Updated: 2025-03-11T15:02:44.575Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-285 Description: In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ad
afted web requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2023-0602 - https://research.splunk.com/application/39e1c326-67d7-4c0d-8584-8056354f6593/
CVE ID: CVE-2023-32708 State: PUBLISHED Published: 2023-06-01T16:34:27.126Z Last Updated: 2025-02-28T11:03:58.212Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-113 Description: In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can trigger an HTTP response splitting vulnerability with the ‘rest’ SPL command that lets them potentially access other REST endpoints in the system arbitrarily. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-
rbitrarily. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0603 - https://research.splunk.com/application/e615a0e1-a1b2-4196-9865-8aa646e1708c/
CVE ID: CVE-2023-32709 State: PUBLISHED Published: 2023-06-01T16:34:30.933Z Last Updated: 2025-02-28T11:03:52.521Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-285 Description: In Splunk Enterprise versions below 9.0.5, 8.2.11. and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user who holds the ‘user’ role can see the hashed version of the initial user name and password for the Splunk instance by using the ‘rest’ SPL command against the ‘conf-user-seed’ REST endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
ainst the ‘conf-user-seed’ REST endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2023-0604 - https://research.splunk.com/application/a1be424d-e59c-4583-b6f9-2dcc23be4875/
CVE ID: CVE-2023-32710 State: PUBLISHED Published: 2023-06-01T16:34:28.796Z Last Updated: 2025-02-28T11:03:51.327Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-200 Description: In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can perform an unauthorized transfer of data from a search using the ‘copyresults’ command if they know the search ID (SID) of a search job that has recently run. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/advisories
as recently run. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0609
CVE ID: CVE-2023-32711 State: PUBLISHED Published: 2023-06-01T16:34:27.478Z Last Updated: 2025-02-28T11:03:51.579Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Splunk Products: Splunk Enterprise Problem Types: CWE-79 Description: In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a Splunk dashboard view lets a low-privileged user exploit a vulnerability in the Bootstrap web framework (CVE-2019-8331) and build a stored cross-site scripting (XSS) payload. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0605 - https://research.splunk.com/application/8a43558f-a53c-4ee4-86c1-30b1e8ef3
advisory.splunk.com/advisories/SVD-2023-0605 - https://research.splunk.com/application/8a43558f-a53c-4ee4-86c1-30b1e8ef3606/
CVE ID: CVE-2023-32712 State: PUBLISHED Published: 2023-06-01T16:34:29.862Z Last Updated: 2025-02-28T11:03:57.287Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Enterprise, Universal Forwarder Problem Types: CWE-117 Description: In Splunk Enterprise versions below 9.1.0.2, 9.0.5.1, and 8.2.11.2, an attacker can inject American National Standards Institute (ANSI) escape codes into Splunk log files that, when a vulnerable terminal application reads them, can potentially, at worst, result in possible code execution in the vulnerable application. This attack requires a user to use a terminal application that supports the translation of AN
he vulnerable application. This attack requires a user to use a terminal application that supports the translation of ANSI escape codes to read the malicious log file locally in the vulnerable terminal, and to perform additional user interaction to exploit. Universal Forwarder versions 9.1.0.1, 9.0.5, 8.2.11, and lower can be vulnerable in situations where they have management services active and accessible over the network. Universal Forwarder versions 9.0.x and 9.1.x bind management services to the local machine and are not vulnerable in this specific configuration. See SVD-2022-0605 for more information. Universal Forwarder versions 9.1 use Unix Domain Sockets (UDS) for communication, whi
VD-2022-0605 for more information. Universal Forwarder versions 9.1 use Unix Domain Sockets (UDS) for communication, which further reduces the potential attack surface. The vulnerability does not directly affect Splunk Enterprise or Universal Forwarder. The indirect impact on Splunk Enterprise and Universal Forwarder can vary significantly depending on the permissions in the vulnerable terminal application and where and how the user reads the malicious log file. For example, users can copy the malicious file from the Splunk Enterprise instance and read it on their local machine. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisory.splunk.
hine. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0606 - https://research.splunk.com/application/de3908dc-1298-446d-84b9-fa81d37e959b
CVE ID: CVE-2023-32713 State: PUBLISHED Published: 2023-06-01T16:34:30.265Z Last Updated: 2025-02-28T11:03:54.632Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Splunk Products: Splunk App for Stream Problem Types: CWE-269 Description: In Splunk App for Stream versions below 8.1.1, a low-privileged user could use a vulnerability in the streamfwd process within the Splunk App for Stream to escalate their privileges on the machine that runs the Splunk Enterprise instance, up to and including the root user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0607
CVE ID: CVE-2023-32714 State: PUBLISHED Published: 2023-06-01T16:34:29.504Z Last Updated: 2025-02-28T11:03:42.218Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Splunk Products: Splunk App for Lookup File Editing Problem Types: CWE-35 Description: In the Splunk App for Lookup File Editing versions below 4.0.1, a low-privileged user can, with a specially crafted web request, trigger a path traversal exploit that can then be used to read and write to restricted areas of the Splunk installation directory. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0608 - https://research.splunk.com/applicatio
m Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0608 - https://research.splunk.com/application/8ed58987-738d-4917-9e44-b8ef6ab948a6/
CVE ID: CVE-2023-32715 State: PUBLISHED Published: 2023-06-01T16:34:27.816Z Last Updated: 2025-02-28T11:03:57.054Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Splunk Products: Splunk App for Lookup File Editing Problem Types: CWE-79 Description: In the Splunk App for Lookup File Editing versions below 4.0.1, a user can insert potentially malicious JavaScript code into the app, which causes that code to run on the user’s machine. The app itself does not contain the potentially malicious JavaScript code. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser, and requires additional user
acker to phish the victim by tricking them into initiating a request within their browser, and requires additional user interaction to trigger. The attacker cannot exploit the vulnerability at will. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2023-0610
CVE ID: CVE-2023-32716 State: PUBLISHED Published: 2023-06-01T16:34:29.168Z Last Updated: 2025-02-28T11:03:45.371Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-754 Description: In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, an attacker can exploit a vulnerability in the {{dump}} SPL command to cause a denial of service by crashing the Splunk daemon. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2023-0611 - https://research.s
tainer: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2023-0611 - https://research.splunk.com/application/fb0e6823-365f-48ed-b09e-272ac4c1dad6/
CVE ID: CVE-2023-32717 State: PUBLISHED Published: 2023-06-01T16:34:28.464Z Last Updated: 2025-02-28T11:03:51.073Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-285 Description: On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, an unauthorized user can access the {{/services/indexing/preview}} REST endpoint to overwrite search results if they know the search ID (SID) of an existing search job. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0612 -
Additional Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0612 - https://research.splunk.com/application/bbe26f95-1655-471d-8abd-3d32fafa86f8/
CVE ID: CVE-2023-32721 State: PUBLISHED Published: 2023-10-12T06:04:10.100Z Last Updated: 2025-11-03T21:48:35.952Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N) Vendors: Zabbix Products: Zabbix Problem Types: CWE-20 Description: A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL. Additional Analyst Notes: - CVE Program Container: References: - https://support.zabbix.com/browse/ZBX-23389 - https://lists.debian.org/debian-lts-announce/2024/01/msg00012.html
CVE ID: CVE-2023-32722 State: PUBLISHED Published: 2023-10-12T06:06:52.182Z Last Updated: 2025-11-03T21:48:37.420Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Zabbix Products: Zabbix Problem Types: CWE-120 Description: The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-23390
CVE ID: CVE-2023-32723 State: PUBLISHED Published: 2023-10-12T06:11:26.612Z Last Updated: 2025-02-13T16:55:00.262Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N) Vendors: Zabbix Products: Zabbix Problem Types: CWE-732 Description: Request to LDAP is sent before user permissions are checked. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-23230 - https://lists.debian.org/debian-lts-announce/2024/01/msg00012.html
CVE ID: CVE-2023-32724 State: PUBLISHED Published: 2023-10-12T06:14:45.978Z Last Updated: 2025-11-03T21:48:38.879Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H) Vendors: Zabbix Products: Zabbix Problem Types: CWE-732 Description: Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-23391
CVE ID: CVE-2023-32725 State: PUBLISHED Published: 2023-12-18T09:15:23.931Z Last Updated: 2024-08-02T15:25:36.630Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Zabbix Products: Zabbix Problem Types: CWE-565 Description: The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user. Additional Analyst Notes: - CVE Program Container: References: - https://support.zabbix.com/browse/ZBX-23854
CVE ID: CVE-2023-32726 State: PUBLISHED Published: 2023-12-18T09:17:47.628Z Last Updated: 2025-11-03T21:48:40.326Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: Zabbix Products: Zabbix Problem Types: CWE-754 Description: The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server. Additional Analyst Notes: - CVE Program Container: References: - https://support.zabbix.com/browse/ZBX-23855 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMFKNV5E4LG2DIZNPRWQ2ENH75H6UEQT/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorapro
ssage/UMFKNV5E4LG2DIZNPRWQ2ENH75H6UEQT/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BYSYLA7VTHR25CBLYO5ZLEJFGU7HTHQB/ - https://lists.debian.org/debian-lts-announce/2024/01/msg00012.html
CVE ID: CVE-2023-32727 State: PUBLISHED Published: 2023-12-18T09:18:48.446Z Last Updated: 2025-11-03T21:48:41.788Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Zabbix Products: Zabbix Problem Types: CWE-20 Description: An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-23857
CVE ID: CVE-2023-32728 State: PUBLISHED Published: 2023-12-18T09:19:51.507Z Last Updated: 2024-11-27T20:43:26.283Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Zabbix Products: Zabbix Problem Types: CWE-20 Description: The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-23858
CVE ID: CVE-2023-32731 State: PUBLISHED Published: 2023-06-09T10:54:08.472Z Last Updated: 2024-09-26T19:12:06.245Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: Google Products: gRPC Problem Types: CWE-440 Description: When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can
he proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. We recommend upgrading beyond the commit contained in https://github.com/grpc/grpc/pull/33005 https://github.com/grpc/grpc/pull/33005 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/grpc/grpc/pull/32309 - https://github.com/grpc/grpc/pull/33005