Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
, Firefox < 114, and Thunderbird < 102.12. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1752703%2C1818394%2C1826875%2C1827340%2C1827655%2C1828065%2C1830190%2C1830206%2C1830795%2C1833339 - https://www.mozilla.org/security/advisories/mfsa2023-19/ - https://www.mozilla.org/security/advisories/mfsa2023-20/ - https://www.mozilla.org/security/advisories/mfsa2023-21/ - https://security.gentoo.org/glsa/202312-03 - https://security.gentoo.org/glsa/202401-10
CVE ID: CVE-2023-34417 State: PUBLISHED Published: 2023-06-19T10:42:55.747Z Last Updated: 2025-05-05T15:57:30.806Z Vendors: Mozilla Products: Firefox Problem Types: Memory safety bugs fixed in Firefox 114 Description: Memory safety bugs present in Firefox 113. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 114. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1746447%2C1820903%2C1832832 - https://www.mozilla.org/security/advisories/mfsa2023-20/ - https://secu
buglist.cgi?bug_id=1746447%2C1820903%2C1832832 - https://www.mozilla.org/security/advisories/mfsa2023-20/ - https://security.gentoo.org/glsa/202401-10
CVE ID: CVE-2023-34418 State: PUBLISHED Published: 2023-06-26T19:45:05.363Z Last Updated: 2024-12-03T18:31:42.016Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Lenovo Products: Lenovo XClarity Administrator Problem Types: CWE-89 Description: A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vulnerability in a specific web API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-98715
CVE ID: CVE-2023-34419 State: PUBLISHED Published: 2023-08-17T16:49:12.282Z Last Updated: 2024-08-02T16:10:06.823Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Lenovo Notebook Problem Types: CWE-120 Description: A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-134879
CVE ID: CVE-2023-34420 State: PUBLISHED Published: 2023-06-26T19:45:12.130Z Last Updated: 2024-12-04T14:33:26.899Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Lenovo XClarity Administrator Problem Types: CWE-78 Description: A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-98715
CVE ID: CVE-2023-34421 State: PUBLISHED Published: 2023-06-26T19:45:26.406Z Last Updated: 2024-11-06T21:46:11.204Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: Lenovo Products: Lenovo XClarity Administrator Problem Types: CWE-20 Description: A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to insufficient input validation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-98715
CVE ID: CVE-2023-34422 State: PUBLISHED Published: 2023-06-26T19:45:31.576Z Last Updated: 2024-11-06T21:44:40.603Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: Lenovo Products: Lenovo XClarity Administrator Problem Types: CWE-20 Description: A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due to insufficient input validation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-98715
CVE ID: CVE-2023-34423 State: PUBLISHED Published: 2024-04-03T07:09:42.923Z Last Updated: 2024-11-06T14:40:54.619Z Vendors: AYS Pro Plugins Products: Survey Maker Problem Types: Cross-site scripting (XSS) Description: Survey Maker prior to 3.6.4 contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the website using the product with the administrative privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wordpress.org/plugins/survey-maker/ - https://jvn.jp/en/jp/JVN51098626/
CVE ID: CVE-2023-34424 State: PUBLISHED Published: 2024-08-14T13:45:42.453Z Last Updated: 2025-11-03T21:48:49.099Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) CSME Problem Types: denial of service, CWE-20 Description: Improper input validation in firmware for some Intel(R) CSME may allow a privileged user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00999.html
CVE ID: CVE-2023-34425 State: PUBLISHED Published: 2023-07-28T04:30:39.127Z Last Updated: 2025-02-13T16:55:33.501Z Vendors: Apple Products: iOS and iPadOS, macOS, watchOS Problem Types: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. This issue is fixed in watchOS 9.6, macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, macOS Big Sur 11.7.9, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213841 - https://support.app
Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213841 - https://support.apple.com/en-us/HT213843 - https://support.apple.com/en-us/HT213842 - https://support.apple.com/en-us/HT213845 - https://support.apple.com/en-us/HT213844 - https://support.apple.com/en-us/HT213848 - https://support.apple.com/kb/HT213843 - https://support.apple.com/kb/HT213844 - https://support.apple.com/kb/HT213841 - https://support.apple.com/kb/HT213845 - https://support.apple.com/kb/HT213842 - https://support.apple.com/kb/HT213848
CVE ID: CVE-2023-34426 State: PUBLISHED Published: 2023-10-11T15:14:29.500Z Last Updated: 2025-11-04T19:16:48.618Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Yifan Products: YF325 Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the httpd manage_request functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to stack-based buffer overflow. An attacker can send a network request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1766
CVE ID: CVE-2023-34427 State: PUBLISHED Published: 2023-08-11T02:37:24.682Z Last Updated: 2024-10-04T13:05:09.647Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA Problem Types: escalation of privilege, CWE-693 Description: Protection mechanism failure in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-c
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00912.html
CVE ID: CVE-2023-34429 State: PUBLISHED Published: 2023-07-19T21:45:39.544Z Last Updated: 2024-10-28T14:29:40.049Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Weintek Products: Weincloud Problem Types: CWE-237 Description: Weintek Weincloud v0.13.6 could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-04
CVE ID: CVE-2023-34430 State: PUBLISHED Published: 2023-11-14T19:05:02.864Z Last Updated: 2024-08-30T15:24:10.490Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel Battery Life Diagnostic Tool software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path in some Intel Battery Life Diagnostic Tool software before version 2.2.1 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00843.html
CVE ID: CVE-2023-34431 State: PUBLISHED Published: 2023-11-14T19:05:08.245Z Last Updated: 2024-08-30T16:57:11.553Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Server Board BIOS firmware Problem Types: escalation of privilege, CWE-20 Description: Improper input validation in some Intel(R) Server Board BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00719.html
CVE ID: CVE-2023-34432 State: PUBLISHED Published: 2023-07-10T20:05:39.681Z Last Updated: 2024-10-01T16:24:35.073Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a, Red Hat, Fedora Products: sox, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Fedora, Extra Packages for Enterprise Linux Problem Types: CWE-122 Description: A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at sox/src/formats_i.c:98:16. This flaw can lead to a denial of service, code execution, or information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2
lyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-34432 - https://bugzilla.redhat.com/show_bug.cgi?id=2212291
CVE ID: CVE-2023-34433 State: PUBLISHED Published: 2023-07-06T23:06:34.227Z Last Updated: 2024-11-14T14:02:50.764Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: PiiGAB Products: M-Bus SoftwarePack Problem Types: CWE-916 Description: PiiGAB M-Bus stores passwords using a weak hash algorithm. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-187-01
CVE ID: CVE-2023-34434 State: PUBLISHED Published: 2023-07-25T07:09:58.676Z Last Updated: 2025-02-13T16:55:34.105Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-502 Description: Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The attacker could bypass the current logic and achieve arbitrary file reading. To solve it, users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8130 . Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/7f1o71w5
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/7f1o71w5r732cspltmtdydn01gllf4jo - http://seclists.org/fulldisclosure/2023/Jul/43 - http://www.openwall.com/lists/oss-security/2023/07/25/3
CVE ID: CVE-2023-34435 State: PUBLISHED Published: 2024-07-08T15:25:39.165Z Last Updated: 2025-11-04T17:12:32.405Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: LevelOne, Realtek Products: WBR-6013, rtl819x Jungle SDK Problem Types: CWE-347 Description: A firmware update vulnerability exists in the boa formUpload functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted network packets can lead to arbitrary firmware update. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-202
A ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1874
CVE ID: CVE-2023-34436 State: PUBLISHED Published: 2024-01-08T14:47:43.652Z Last Updated: 2025-11-04T18:14:42.672Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-119 Description: An out-of-bounds write vulnerability exists in the LXT2 num_time_table_entries functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1819 - https://lists.debian.org/
nrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1819 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-34437 State: PUBLISHED Published: 2023-10-18T23:25:25.969Z Last Updated: 2025-01-16T21:29:21.547Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Baker Hughes - Bently Nevada Products: Bently Nevada 3500 System Problem Types: CWE-732 Description: Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an attacker to access passwords stored on the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-05
CVE ID: CVE-2023-34438 State: PUBLISHED Published: 2023-08-11T02:37:29.580Z Last Updated: 2024-08-02T16:10:07.139Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) NUC BIOS firmware Problem Types: escalation of privilege, CWE-421 Description: Race condition in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00917.html
CVE ID: CVE-2023-34439 State: PUBLISHED Published: 2023-12-06T08:40:53.373Z Last Updated: 2024-08-02T16:10:07.263Z Vendors: Implem Inc. Products: Pleasanter Problem Types: Cross-site scripting (XSS) Description: Pleasanter 1.3.47.0 and earlier contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the user's web browser. Additional Analyst Notes: - CVE Program Container: References: - https://pleasanter.org/archives/vulnerability-update-202311 - https://jvn.jp/en/jp/JVN96209256/
CVE ID: CVE-2023-34440 State: PUBLISHED Published: 2025-02-12T21:19:25.772Z Last Updated: 2025-11-03T20:35:35.346Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Processors Problem Types: Escalation of Privilege, CWE-20 Description: Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html
CVE ID: CVE-2023-34441 State: PUBLISHED Published: 2023-10-18T23:22:29.808Z Last Updated: 2024-09-11T20:10:19.553Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L) Vendors: Baker Hughes - Bently Nevada Products: Bently Nevada 3500 System Problem Types: CWE-319 Description: Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-2
: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-05
CVE ID: CVE-2023-34442 State: PUBLISHED Published: 2023-07-10T09:31:05.286Z Last Updated: 2024-10-07T19:41:16.865Z Vendors: Apache Software Foundation Products: Apache Camel JIRA Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Camel.This issue affects Apache Camel: from 3.X through <=3.14.8, from 3.18.X through <=3.18.7, from 3.20.X through <= 3.20.5, from 4.X through <= 4.0.0-M3. Users should upgrade to 3.14.9, 3.18.8, 3.20.6 or 3.21.0 and for users on Camel 4.x update to 4.0.0-M1 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/
0-M1 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/x4vy2hhbltb1xrvy1g6m8hpjgj2k7wgh
CVE ID: CVE-2023-34443 State: PUBLISHED Published: 2024-11-04T23:29:00.751Z Last Updated: 2024-11-05T16:34:56.924Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Combodo Products: iTop Problem Types: CWE-79 Description: Combodo iTop is a simple, web based IT Service Management tool. When displaying page Run queries Cross-site Scripting (XSS) are possible for scripts outside of script tags. This has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-9mx6-pwpp-
nalyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-9mx6-pwpp-j3xx - https://huntr.dev/bounties/c230d55d-1f0e-40c3-8c7e-20587d3e54da/?token=4d1195d5a50a9f0f7ae9fc24a2b0a3bd907427edaf7ee6ac1f8f31c11d8b7a5d2c204957125e63fd7cf3a87df6d5d12a35f9c7107ba5f33b5f668fa199a36932448b9bf186daa62cb32b5635770730eb68eeeba079b8864ab00358fd0dc65fa406d986525814a14951db2025e117f0098a1f270f5a5b2c935a65b00b5106e5511b61d501c4357654cb8ea76b
CVE ID: CVE-2023-34444 State: PUBLISHED Published: 2024-11-04T23:30:21.686Z Last Updated: 2024-11-05T16:31:24.314Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Combodo Products: iTop Problem Types: CWE-79 Description: Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.searchform.php XSS are possible for scripts outside of script tags. This issue has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-rwx9-rcxf-qrwv
CVE ID: CVE-2023-34445 State: PUBLISHED Published: 2024-11-04T23:31:51.164Z Last Updated: 2024-11-05T16:29:52.751Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Combodo Products: iTop Problem Types: CWE-79 Description: Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.render.php XSS are possible for scripts outside of script tags. This issue has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-mm45-wh68-jpvq
CVE ID: CVE-2023-34446 State: PUBLISHED Published: 2023-10-25T15:35:21.187Z Last Updated: 2024-09-10T20:42:19.268Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Combodo Products: iTop Problem Types: CWE-79 Description: iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, when displaying `pages/preferences.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-q4pp-j46r-gm68 - https://github.com/Combodo/iTop/commit/e3ba826e5dfd3b724f1
ub.com/Combodo/iTop/security/advisories/GHSA-q4pp-j46r-gm68 - https://github.com/Combodo/iTop/commit/e3ba826e5dfd3b724f1ee97bebfd20ded3c70b10
CVE ID: CVE-2023-34447 State: PUBLISHED Published: 2023-10-25T15:35:24.730Z Last Updated: 2024-09-11T20:36:52.769Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Combodo Products: iTop Problem Types: CWE-79 Description: iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, on `pages/UI.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-6rfm-2rwg-mj7p - https://github.com/Combodo/iTop/commit/519751faa10b2fc5b75ea4516a1b8ef13ca35b33
curity/advisories/GHSA-6rfm-2rwg-mj7p - https://github.com/Combodo/iTop/commit/519751faa10b2fc5b75ea4516a1b8ef13ca35b33 - https://github.com/Combodo/iTop/commit/b8f61362f570e1ef8127175331012b7fc8aba802
CVE ID: CVE-2023-34448 State: PUBLISHED Published: 2023-06-14T22:06:01.338Z Last Updated: 2024-12-18T21:38:44.207Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: getgrav Products: grav Problem Types: CWE-20, CWE-1336 Description: Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default `filter()` function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke arbitrary unsafe functions, thereby allowing for remote code execution. A patch in version 1.74.2 overrides the built-in Twig `map()` an
functions, thereby allowing for remote code execution. A patch in version 1.74.2 overrides the built-in Twig `map()` and `reduce()` filter functions in `system/src/Grav/Common/Twig/Extension/GravExtension.php` to validate the argument passed to the filter in `$arrow`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/getgrav/grav/security/advisories/GHSA-whr7-m3f8-mpm8 - https://github.com/getgrav/grav/commit/8c2c1cb72611a399f13423fc6d0e1d998c03e5c8 - https://github.com/twigphp/Twig/blob/v1.44.7/src/Environment.php#L148 - https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66/ - https://www.github.com/getgrav/grav/commit/9d
#L148 - https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66/ - https://www.github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfeb83