Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-29369 State: PUBLISHED Published: 2023-06-13T23:26:09.722Z Last Updated: 2025-01-01T01:43:59.276Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-190 Description: Remote Procedure Call Runtime Denial of Service Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Cont
edure Call Runtime Denial of Service Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29369
CVE ID: CVE-2023-29370 State: PUBLISHED Published: 2023-06-13T23:26:10.385Z Last Updated: 2025-01-01T01:43:59.789Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: CWE-122 Description: Windows Media Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: -
-122 Description: Windows Media Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29370
CVE ID: CVE-2023-29371 State: PUBLISHED Published: 2023-06-13T23:26:10.950Z Last Updated: 2025-01-01T01:44:00.463Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Wi
08 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-20 Description: Windows GDI Elevation of Privilege Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29371
CVE ID: CVE-2023-29372 State: PUBLISHED Published: 2023-06-13T23:26:11.543Z Last Updated: 2025-02-28T21:09:53.452Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Wi
08 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-122 Description: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29372
CVE ID: CVE-2023-29373 State: PUBLISHED Published: 2023-06-13T23:26:12.105Z Last Updated: 2025-02-28T21:09:47.397Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Wi
08 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-125 Description: Microsoft ODBC Driver Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29373
CVE ID: CVE-2023-29374 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-12T16:24:39.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec method. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hwchase17/langchain/pull/1119 - https://github.com/hwchase17/langchain/issues/814 - https://twitter.com/rharang/status/1641899743608463365/photo/1 - https://github.com/hwchase17/langchain/issues/1026
CVE ID: CVE-2023-29375 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-02-12T14:22:50.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before 14.3.8025. There is potentially dangerous file upload through the SharePoint connector. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.progress.com/sitefinity-cms - https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-April-2023
CVE ID: CVE-2023-29376 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-02-11T15:21:02.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before 14.3.8025. There is potential XSS by privileged users in Sitefinity to media libraries. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.progress.com/sitefinity-cms - https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-April-2023
CVE ID: CVE-2023-29380 State: PUBLISHED Published: 2023-05-28T00:00:00 Last Updated: 2025-01-13T21:24:33.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: Warpinator before 1.6.0 allows remote file deletion via directory traversal in top_dir_basenames. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/linuxmint/warpinator/compare/1.4.5...1.6.0 - https://www.openwall.com/lists/oss-security/2023/04/26/1
CVE ID: CVE-2023-29381 State: PUBLISHED Published: 2023-07-06T00:00:00 Last Updated: 2024-11-19T17:26:11.033Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and 2FA parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
CVE ID: CVE-2023-29382 State: PUBLISHED Published: 2023-07-06T00:00:00 Last Updated: 2024-11-19T19:16:32.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preauth.jsp component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
CVE ID: CVE-2023-29383 State: PUBLISHED Published: 2023-04-14T00:00:00.000Z Last Updated: 2025-11-03T19:28:12.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a sys
ssible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shadow-maint/shadow/pull/687 - https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797 - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-
ty-advisories/?fid=31797 - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/
CVE ID: CVE-2023-29384 State: PUBLISHED Published: 2023-12-20T19:04:34.766Z Last Updated: 2024-09-16T18:23:45.963Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: HM Plugin Products: WordPress Job Board and Recruitment Plugin – JobWP Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue affects WordPress Job Board and Recruitment Plugin – JobWP: from n/a through 2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/jobwp/wordpress-job-board-and-recruitmen
A ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/jobwp/wordpress-job-board-and-recruitment-plugin-jobwp-plugin-2-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2023-29385 State: PUBLISHED Published: 2023-06-12T15:14:35.661Z Last Updated: 2025-02-19T21:29:43.608Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Kevon Adonis Products: WP Abstracts Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kevon Adonis WP Abstracts plugin <= 2.6.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-abstracts-manuscripts-manager/wordpress-wp-abstracts-plugin-2-6-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-29386 State: PUBLISHED Published: 2024-03-26T20:27:08.180Z Last Updated: 2024-08-02T16:08:10.138Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Julien Crego Products: Manager for Icomoon Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Julien Crego Manager for Icomoon.This issue affects Manager for Icomoon: from n/a through 2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/manager-for-icomoon/wordpress-manager-for-icommon-plugin-2-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2023-29387 State: PUBLISHED Published: 2023-08-18T14:57:56.323Z Last Updated: 2024-09-25T16:37:51.448Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Julien Crego Products: Manager for Icomoon Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Julien Crego Manager for Icomoon plugin <= 2.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/manager-for-icomoon/wordpress-manager-for-icommon-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-29388 State: PUBLISHED Published: 2023-04-07T14:48:45.268Z Last Updated: 2025-01-10T18:55:39.643Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: impleCode Products: Product Catalog Simple Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in impleCode Product Catalog Simple plugin <= 1.6.17 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/post-type-x/wordpress-product-catalog-simple-plugin-1-6-17-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-29389 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-12T16:12:07.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: Toyota RAV4 2021 vehicles automatically trust messages from other ECUs on a CAN bus, which allows physically proximate attackers to drive a vehicle by accessing the control CAN bus after pulling the bumper away and reaching the headlight connector, and then sending forged "Key is validated" messages via CAN Injection, as exploited in the wild in (for example) July 2022. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kentindell.github.io/2023/04/03/can-injection/ - https:
rogram Container: - CISA ADP Vulnrichment: References: - https://kentindell.github.io/2023/04/03/can-injection/ - https://news.ycombinator.com/item?id=35452963
CVE ID: CVE-2023-29400 State: PUBLISHED Published: 2023-05-11T15:29:24.874Z Last Updated: 2025-01-24T16:47:46.724Z Vendors: Go standard library Products: html/template Problem Types: CWE-74: Improper input validation Description: Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/59722 - https://go.dev/cl/491617 - https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU - https://pkg
/go.dev/issue/59722 - https://go.dev/cl/491617 - https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU - https://pkg.go.dev/vuln/GO-2023-1753
CVE ID: CVE-2023-29401 State: PUBLISHED Published: 2023-06-08T20:27:15.057Z Last Updated: 2025-01-06T19:30:14.833Z Vendors: github.com/gin-gonic/gin Products: github.com/gin-gonic/gin Problem Types: CWE 20: Improper Input Validation Description: The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat&quot;;x=.txt" will be sent as a file named "setup.bat". If the FileAttachment function is called with names provided by an untrusted source, this may permit a
amed "setup.bat". If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gin-gonic/gin/issues/3555 - https://github.com/gin-gonic/gin/pull/3556 - https://github.com/gin-gonic/gin/releases/tag/v1.9.1 - https://pkg.go.dev/vuln/GO-2023-1737
CVE ID: CVE-2023-29402 State: PUBLISHED Published: 2023-06-08T20:19:04.483Z Last Updated: 2025-02-13T16:49:13.450Z Vendors: Go toolchain Products: cmd/go Problem Types: CWE-94: Improper Control of Generation of Code ('Code Injection') Description: The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected). Additional Analyst
get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/60167 - https://go.dev/cl/501226 - https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ - https://pkg.go.dev/vuln/GO-2023-1839 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/ - https://security.gentoo.org/glsa/202311-09
CVE ID: CVE-2023-29403 State: PUBLISHED Published: 2023-06-08T20:19:13.222Z Last Updated: 2025-02-13T16:49:14.029Z Vendors: Go standard library Products: runtime Problem Types: CWE-642: External Control of Critical State Data Description: On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program
s can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/60272 - https://go.dev/cl/501223 - https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ - https://pkg.go.dev/vuln/GO-2023-1840 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YC
U55QLT2UE762ZX/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/ - https://security.gentoo.org/glsa/202311-09
CVE ID: CVE-2023-29404 State: PUBLISHED Published: 2023-06-08T20:19:17.548Z Last Updated: 2025-01-06T19:47:57.434Z Vendors: Go toolchain Products: cmd/go Problem Types: CWE-94: Improper Control of Generation of Code ("Code Injection") Description: The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. Th
ional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/60305 - https://go.dev/cl/501225 - https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ - https://pkg.go.dev/vuln/GO-2023-1841 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/ - https
doraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/ - https://security.gentoo.org/glsa/202311-09
CVE ID: CVE-2023-29405 State: PUBLISHED Published: 2023-06-08T20:19:19.267Z Last Updated: 2025-01-06T19:44:24.568Z Vendors: Go toolchain Products: cmd/go, cmd/cgo Problem Types: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') Description: The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including the
bedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/60306 - https://go.dev/cl/501224 - https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ - https://pkg.go.dev/vuln/GO-2023-1842 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZM
T2UE762ZX/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/ - https://security.gentoo.org/glsa/202311-09
CVE ID: CVE-2023-29406 State: PUBLISHED Published: 2023-07-11T19:23:58.511Z Last Updated: 2025-02-13T16:49:14.579Z Vendors: Go standard library Products: net/http Problem Types: CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') Description: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/60374 - https://g