Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
osed to the public and may be used. VDB-240250 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.240250 - https://vuldb.com/?ctiid.240250 - https://github.com/llixixi/cve/blob/main/D-LINK-DAR-8000-10_upload_%20changelogo.md - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354
CVE ID: CVE-2023-5155 State: PUBLISHED Published: 2024-02-15T15:46:51.062Z Last Updated: 2024-08-15T18:06:24.833Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Utarit Information Technologies Products: SoliPay Mobile App Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Utarit Information Technologies SoliPay Mobile App allows SQL Injection.This issue affects SoliPay Mobile App: before 5.0.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-0104
CVE ID: CVE-2023-5156 State: PUBLISHED Published: 2023-09-25T15:55:15.558Z Last Updated: 2025-11-20T17:29:59.677Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-401 Description: A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-5156 - https://bugzilla.redhat.com/show_bug.cgi?id=2240541 - https://sou
https://access.redhat.com/security/cve/CVE-2023-5156 - https://bugzilla.redhat.com/show_bug.cgi?id=2240541 - https://sourceware.org/bugzilla/show_bug.cgi?id=30884 - https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=ec6b95c3303c700eb89eebeda2d7264cc184a796
CVE ID: CVE-2023-5157 State: PUBLISHED Published: 2023-09-26T13:25:24.082Z Last Updated: 2025-11-08T03:13:36.712Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Software Collections for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 7 Problem Types: CWE-400 Description: A
at Software Collections for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 7 Problem Types: CWE-400 Description: A vulnerability was found in MariaDB. An OpenVAS port scan on ports 3306 and 4567 allows a malicious remote client to cause a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2023:5259 - https://access.redhat.com/errata/RHSA-2023:5683 - https://access.redhat.com/errata/RHSA-2023:5684 - https://access.redhat.com/errata/RHSA-2023:6821 - https://access.redhat.com/errata/RHSA-2023:6822 - https://access.redhat.com/errata/RHSA-2023:6883 - https://access.redhat.com/errata/RHSA-2023:763
errata/RHSA-2023:6822 - https://access.redhat.com/errata/RHSA-2023:6883 - https://access.redhat.com/errata/RHSA-2023:7633 - https://access.redhat.com/security/cve/CVE-2023-5157 - https://bugzilla.redhat.com/show_bug.cgi?id=2240246
CVE ID: CVE-2023-5158 State: PUBLISHED Published: 2023-09-25T15:55:15.724Z Last Updated: 2025-02-27T20:49:05.203Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a, Red Hat, Fedora Products: kernel, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Fedora Problem Types: CWE-684 Description: A flaw was found in vringh_kiov_advance in drivers/vhost/vringh.c in the host side of a virtio ring in the Linux Kernel. This issue may result in a denial of service from guest to host via zero length descriptor. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
ero length descriptor. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-5158 - https://bugzilla.redhat.com/show_bug.cgi?id=2240561
CVE ID: CVE-2023-5159 State: PUBLISHED Published: 2023-09-29T09:21:37.828Z Last Updated: 2024-09-20T16:02:33.923Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-5160 State: PUBLISHED Published: 2023-10-02T10:46:33.153Z Last Updated: 2024-09-05T19:51:13.978Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-200 Description: Mattermost fails to check the Show Full Name option at the /api/v4/teams/TEAM_ID/top/team_members endpoint allowing a member to get the full name of another user even if the Show Full Name option was disabled Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-5161 State: PUBLISHED Published: 2023-09-26T01:51:14.286Z Last Updated: 2025-02-05T19:18:53.363Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpcalc Products: Modal Window – create popup modal window Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Modal Window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to i
upplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/48e2129f-6a2c-45e4-a0cf-7d8d5f563a7f?source=cve - https://plugins.trac.wordpress.org/browser/modal-window/tags/5.3.5/public/shortcode.php#L53 - https://plugins.trac.wordpress.org/browser/modal-window/tags/5.3.5/public/class-public.php#L73 - https://plugins.trac.wordpress.org/changeset/2971132/modal-window#file195 - https://plugins.t
lic/class-public.php#L73 - https://plugins.trac.wordpress.org/changeset/2971132/modal-window#file195 - https://plugins.trac.wordpress.org/changeset/2971132/modal-window#file196
CVE ID: CVE-2023-5162 State: PUBLISHED Published: 2023-09-26T01:51:15.201Z Last Updated: 2025-02-05T19:18:37.772Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: domainsupport Products: Options for Twenty Seventeen Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Options for Twenty Seventeen plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social-links' shortcode in versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level a
output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/df35d8c6-55ec-4cf5-8055-93ec5193c0a4?source=cve - https://plugins.trac.wordpress.org/browser/options-for-twenty-seventeen/tags/2.5.0/options-for-twenty-seventeen.php#L3110 - https://plugins.trac.wordpress.org/changeset/2971104/options-for-twenty-seventeen
CVE ID: CVE-2023-5163 State: PUBLISHED Published: 2023-11-22T15:33:34.005Z Last Updated: 2024-08-02T07:52:07.328Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: weatheratlas Products: Weather Atlas Widget Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Weather Atlas Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shortcode-weather-atlas' shortcode in versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and abo
escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c2324caa-f804-4f76-9d08-8951fbee4669?source=cve - https://plugins.trac.wordpress.org/browser/weather-atlas/tags/1.2.1/includes/class-weather-atlas.php#L838 - https://plugins.trac.wordpress.org/browser/weather-atlas/tags/1.2.1/includes/class-weather-atlas.php#L858 - https://plugins.trac.wordpress.org/browser/weather-atlas/tags/1.2.1/includ
1.2.1/includes/class-weather-atlas.php#L858 - https://plugins.trac.wordpress.org/browser/weather-atlas/tags/1.2.1/includes/class-weather-atlas.php#L844 - https://plugins.trac.wordpress.org/browser/weather-atlas/tags/1.2.1/includes/class-weather-atlas.php#L845 - https://plugins.trac.wordpress.org/browser/weather-atlas/tags/1.2.1/includes/class-weather-atlas.php#L860
CVE ID: CVE-2023-5164 State: PUBLISHED Published: 2023-10-30T13:48:57.647Z Last Updated: 2025-02-05T18:55:52.704Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sevenspark Products: Bellows Accordion Menu Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Bellows Accordion Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to injec
ied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/50283a4f-ea59-488a-bab0-dd6bc5718556?source=cve - https://plugins.trac.wordpress.org/browser/bellows-accordion-menu/tags/1.4.2/includes/functions.php#L12 - https://plugins.trac.wordpress.org/browser/bellows-accordion-menu/tags/1.4.2/includes/bellows.api.php#L5
CVE ID: CVE-2023-5165 State: PUBLISHED Published: 2023-09-25T15:29:12.869Z Last Updated: 2024-09-24T15:55:38.645Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Docker Inc. Products: Docker Desktop Problem Types: CWE-862, CWE-424 Description: Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions via the debug shell which remains accessible for a short time window after launching Docker Desktop. The affected functionality is available for Docker Business customers only and assumes an environment where users are not granted local root or Administrator privileges. This issue has been fixed in Docker De
n environment where users are not granted local root or Administrator privileges. This issue has been fixed in Docker Desktop 4.23.0. Affected Docker Desktop versions: from 4.13.0 before 4.23.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.docker.com/desktop/release-notes/#4230
CVE ID: CVE-2023-5166 State: PUBLISHED Published: 2023-09-25T15:30:10.164Z Last Updated: 2024-09-24T15:54:17.938Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Docker Inc. Products: Docker Desktop Problem Types: CWE-200 Description: Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL. This issue affects Docker Desktop: before 4.23.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.docker.com/desktop/release-notes/#4230
CVE ID: CVE-2023-5167 State: PUBLISHED Published: 2023-10-16T19:39:00.682Z Last Updated: 2025-04-23T16:13:31.175Z Vendors: Unknown Products: user-activity-log-pro Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The User Activity Log Pro WordPress plugin before 2.3.4 does not properly escape recorded User-Agents in the user activity logs dashboard, which may allow visitors to conduct Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/78ea6fe0-5fac-4923-949c-023c85fe2437
CVE ID: CVE-2023-5168 State: PUBLISHED Published: 2023-09-27T14:12:58.905Z Last Updated: 2025-05-01T20:13:54.748Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Out-of-bounds write in FilterNodeD2D1 Description: A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
d Thunderbird < 115.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1846683 - https://www.mozilla.org/security/advisories/mfsa2023-41/ - https://www.mozilla.org/security/advisories/mfsa2023-42/ - https://www.mozilla.org/security/advisories/mfsa2023-43/
CVE ID: CVE-2023-5169 State: PUBLISHED Published: 2023-09-27T14:13:08.573Z Last Updated: 2025-02-13T17:19:46.801Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Out-of-bounds write in PathOps Description: A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1846685 - https://www.mozilla.org/security/advisorie
ichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1846685 - https://www.mozilla.org/security/advisories/mfsa2023-41/ - https://www.mozilla.org/security/advisories/mfsa2023-42/ - https://www.mozilla.org/security/advisories/mfsa2023-43/ - https://www.debian.org/security/2023/dsa-5506 - https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html - https://www.debian.org/security/2023/dsa-5513 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/ - https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
CVE ID: CVE-2023-5170 State: PUBLISHED Published: 2023-09-27T14:13:28.264Z Last Updated: 2025-02-13T17:19:47.978Z Vendors: Mozilla Products: Firefox Problem Types: Memory leak from a privileged process Description: In canvas rendering, a compromised content process could have caused a surface to change unexpectedly, leading to a memory leak of a privileged process. This memory leak could be used to effect a sandbox escape if the correct data was leaked. This vulnerability affects Firefox < 118. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1846686 - https://www.mozilla.org/security/advisories/mfsa2023-41
rences: - https://bugzilla.mozilla.org/show_bug.cgi?id=1846686 - https://www.mozilla.org/security/advisories/mfsa2023-41/ - https://security.gentoo.org/glsa/202401-10
CVE ID: CVE-2023-5171 State: PUBLISHED Published: 2023-09-27T14:13:12.642Z Last Updated: 2025-02-13T17:19:49.191Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Use-after-free in Ion Compiler Description: During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potentially exploitable crash. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1851599 - https://www.mozilla.org/security/advisories/mfsa2
: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1851599 - https://www.mozilla.org/security/advisories/mfsa2023-41/ - https://www.mozilla.org/security/advisories/mfsa2023-42/ - https://www.mozilla.org/security/advisories/mfsa2023-43/ - https://www.debian.org/security/2023/dsa-5506 - https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html - https://www.debian.org/security/2023/dsa-5513 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/ - https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
CVE ID: CVE-2023-5172 State: PUBLISHED Published: 2023-09-27T14:13:33.980Z Last Updated: 2025-05-01T17:54:52.409Z Vendors: Mozilla Products: Firefox Problem Types: Memory Corruption in Ion Hints Description: A hashtable in the Ion Engine could have been mutated while there was a live interior reference, leading to a potential use-after-free and exploitable crash. This vulnerability affects Firefox < 118. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1852218 - https://www.mozilla.org/security/advisories/mfsa2023-41/ - https://security.gentoo.org/glsa/202401-10
CVE ID: CVE-2023-5173 State: PUBLISHED Published: 2023-09-27T14:13:51.511Z Last Updated: 2025-02-13T17:19:50.296Z Vendors: Mozilla Products: Firefox Problem Types: Out-of-bounds write in HTTP Alternate Services Description: In a non-standard configuration of Firefox, an integer overflow could have occurred based on network traffic (possibly under influence of a local unprivileged webpage), leading to an out-of-bounds write to privileged process memory. *This bug only affects Firefox if a non-standard preference allowing non-HTTPS Alternate Services (`network.http.altsvc.oe`) is enabled.* This vulnerability affects Firefox < 118. Additional Analyst Notes: - CVE Program Container: References:
) is enabled.* This vulnerability affects Firefox < 118. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1823172 - https://www.mozilla.org/security/advisories/mfsa2023-41/ - https://security.gentoo.org/glsa/202401-10
CVE ID: CVE-2023-5174 State: PUBLISHED Published: 2023-09-27T14:13:19.990Z Last Updated: 2025-05-05T14:59:34.904Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Double-free in process spawning on Windows Description: If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. *This bug only affects Firefox on Windows when run in non-standard configurations (such as using `runas`). Other operating systems are unaffected.* This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. Additional Analyst Note
fected.* This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1848454 - https://www.mozilla.org/security/advisories/mfsa2023-41/ - https://www.mozilla.org/security/advisories/mfsa2023-42/ - https://www.mozilla.org/security/advisories/mfsa2023-43/
CVE ID: CVE-2023-5175 State: PUBLISHED Published: 2023-09-27T14:13:57.892Z Last Updated: 2025-05-01T20:07:54.778Z Vendors: Mozilla Products: Firefox Problem Types: Use-after-free of ImageBitmap during process shutdown Description: During process shutdown, it was possible that an `ImageBitmap` was created that would later be used after being freed from a different codepath, leading to a potentially exploitable crash. This vulnerability affects Firefox < 118. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1849704 - https://www.mozilla.org/security/advisories/mfsa2023-41/ - https://security.gentoo.org/glsa/2
/show_bug.cgi?id=1849704 - https://www.mozilla.org/security/advisories/mfsa2023-41/ - https://security.gentoo.org/glsa/202401-10
CVE ID: CVE-2023-5176 State: PUBLISHED Published: 2023-09-27T14:13:25.411Z Last Updated: 2025-05-01T17:53:11.846Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3 Description: Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc
R < 115.3, and Thunderbird < 115.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195 - https://www.mozilla.org/security/advisories/mfsa2023-41/ - https://www.mozilla.org/security/advisories/mfsa2023-42/ - https://www.mozilla.org/security/advisories/mfsa2023-43/ - https://www.debian.org/security/2023/dsa-5506 - https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html - https://www.debian.org/security/2023/dsa-5513 - https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
CVE ID: CVE-2023-5177 State: PUBLISHED Published: 2023-10-16T19:38:53.691Z Last Updated: 2025-04-23T16:14:49.346Z Vendors: Unknown Products: Vrm 360 3D Model Viewer Problem Types: CWE-209 Information Exposure Through an Error Message Description: The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 exposes the full path of a file when putting in a non-existent file in a parameter of the shortcode. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a67b9c21-a35a-4cdb-9627-a5932334e5f0