Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-49062 State: PUBLISHED Published: 2023-11-28T15:45:42.674Z Last Updated: 2024-08-02T21:46:28.773Z Vendors: Facebook Products: Katran Problem Types: Missing Initialization of a Variable (CWE-456) Description: Katran could disclose non-initialized kernel memory as part of an IP header. The issue was present for IPv4 encapsulation and ICMP (v4) Too Big packet generation. After a bpf_xdp_adjust_head call, Katran code didn’t initialize the Identification field for the IPv4 header, resulting in writing content of kernel memory in that field of IP header. The issue affected all Katran versions prior to commit 6a03106ac1eab39d0303662963589ecb2374c97f Additional Analyst Notes: - CVE
e affected all Katran versions prior to commit 6a03106ac1eab39d0303662963589ecb2374c97f Additional Analyst Notes: - CVE Program Container: References: - https://www.facebook.com/security/advisories/cve-2023-49062 - https://github.com/facebookincubator/katran/commit/6a03106ac1eab39d0303662963589ecb2374c97f
CVE ID: CVE-2023-49068 State: PUBLISHED Published: 2023-11-27T09:49:42.477Z Last Updated: 2024-08-02T21:46:28.937Z Vendors: Apache Software Foundation Products: Apache DolphinScheduler Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators. Additional Analyst Notes: - CVE Program Container: References: - htt
e the logs are only available to trusted operators. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/apache/dolphinscheduler/pull/15192 - https://lists.apache.org/thread/jn6kr6mjdgtfgpxoq9j8q4pkfsq8zmpq
CVE ID: CVE-2023-49069 State: PUBLISHED Published: 2024-09-10T09:36:25.399Z Last Updated: 2025-01-14T10:29:57.002Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Siemens Products: Mendix Runtime V10, Mendix Runtime V10.12, Mendix Runtime V10.6, Mendix Runtime V8, Mendix Runtime V9 Problem Types: CWE-204 Description: A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.17.0 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.12 (All versions < V10.12.11 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.6 (All versions < V10.6.19 only if the basic authenti
tication mechanism is used by the application), Mendix Runtime V10.6 (All versions < V10.6.19 only if the basic authentication mechanism is used by the application), Mendix Runtime V8 (All versions < V8.18.33 only if the basic authentication mechanism is used by the application), Mendix Runtime V9 (All versions < V9.24.31 only if the basic authentication mechanism is used by the application). The authentication mechanism of affected applications contains an observable response discrepancy vulnerability when validating usernames. This could allow unauthenticated remote attackers to distinguish between valid and invalid usernames. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
kers to distinguish between valid and invalid usernames. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-097435.html
CVE ID: CVE-2023-49070 State: PUBLISHED Published: 2023-12-05T08:05:06.966Z Last Updated: 2025-02-13T17:18:28.237Z Vendors: Apache Software Foundation Products: Apache OFBiz Problem Types: CWE-94 Description: Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are recommended to upgrade to version 18.12.10 Additional Analyst Notes: - CVE Program Container: References: - https://ofbiz.apache.org/download.html - https://ofbiz.apache.org/security.html - https://ofbiz.apache.org/release-notes-18.12.10.html - https://issues.apache.org/jira/browse/OFBIZ-12812 - https://lists.apache.org/thread/jmbqk2l
elease-notes-18.12.10.html - https://issues.apache.org/jira/browse/OFBIZ-12812 - https://lists.apache.org/thread/jmbqk2lp4t4483whzndp5xqlq4f3otg3 - http://packetstormsecurity.com/files/176323/Apache-OFBiz-18.12.09-Remote-Code-Execution.html
CVE ID: CVE-2023-49073 State: PUBLISHED Published: 2024-07-08T15:22:28.584Z Last Updated: 2025-11-04T17:12:59.776Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: LevelOne, Realtek Products: WBR-6013, rtl819x Jungle SDK Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the boa formFilter functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary code execution. An attacker can send a sequence of requests to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerabi
l Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1875
CVE ID: CVE-2023-49074 State: PUBLISHED Published: 2024-04-09T14:12:48.559Z Last Updated: 2025-11-04T18:19:33.189Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Tp-Link Products: AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) Problem Types: CWE-749 Description: A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of network requests can lead to reset to factory settings. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pro
e of unauthenticated packets to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1861
CVE ID: CVE-2023-49075 State: PUBLISHED Published: 2023-11-28T04:33:23.642Z Last Updated: 2024-08-02T21:46:29.190Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: pimcore Products: admin-ui-classic-bundle Problem Types: CWE-308 Description: The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without having to provide the two factor credentials. This issue has been patched in version 1.2.2. Additional Analyst Notes: - CVE Program Container: References: - https://git
is issue has been patched in version 1.2.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-9wwg-r3c7-4vfg - https://github.com/pimcore/admin-ui-classic-bundle/pull/345 - https://github.com/pimcore/admin-ui-classic-bundle/commit/e412b0597830ae564a604e2579eb40e76f7f0628 - https://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch
CVE ID: CVE-2023-49076 State: PUBLISHED Published: 2023-11-30T05:42:12.668Z Last Updated: 2025-06-05T13:27:42.356Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: pimcore Products: customer-data-framework Problem Types: CWE-352 Description: Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an attacker could abuse this vulnerability to create new customers. This issue has been patched in version 4.0.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pimcore/customer-data-framework/security/advis
gram Container: - CISA ADP Vulnrichment: References: - https://github.com/pimcore/customer-data-framework/security/advisories/GHSA-xx63-4jr8-9ghc - https://github.com/pimcore/customer-data-framework/commit/ef7414415cfa64189b8433eff0aa2a9b537a89f7.patch
CVE ID: CVE-2023-49077 State: PUBLISHED Published: 2023-11-30T07:14:04.580Z Last Updated: 2024-08-02T21:46:29.125Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: mailcow Products: mailcow-dockerized Problem Types: CWE-79 Description: Mailcow: dockerized is an open source groupware/email suite based on docker. A Cross-Site Scripting (XSS) vulnerability has been identified within the Quarantine UI of the system. This vulnerability poses a significant threat to administrators who utilize the Quarantine feature. An attacker can send a carefully crafted email containing malicious JavaScript code. This issue has been patched in version 2023-11. Additional Analyst N
crafted email containing malicious JavaScript code. This issue has been patched in version 2023-11. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-46x4-w2fm-5x6g - https://github.com/mailcow/mailcow-dockerized/releases/tag/2023-11
CVE ID: CVE-2023-49078 State: PUBLISHED Published: 2023-11-28T18:15:24.447Z Last Updated: 2024-08-02T21:46:29.244Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: zediious Products: raptor-web Problem Types: CWE-79 Description: raptor-web is a CMS for game server communities that can be used to host information and keep track of players. In version 0.4.4 of raptor-web, it is possible to craft a malicious URL that will result in a reflected cross-site scripting vulnerability. A user controlled URL parameter is loaded into an internal template that has autoescape disabled. This is a cross-site scripting vulnerability that affects all deployments of `raptor-web
e that has autoescape disabled. This is a cross-site scripting vulnerability that affects all deployments of `raptor-web` on version `0.4.4`. Any victim who clicks on a malicious crafted link will be affected. This issue has been patched 0.4.4.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zediious/raptor-web/security/advisories/GHSA-8r6g-fhh4-xhmq - https://github.com/zediious/raptor-web/releases/tag/0.4.4.1
CVE ID: CVE-2023-49079 State: PUBLISHED Published: 2023-11-29T18:56:17.189Z Last Updated: 2024-08-02T21:46:29.089Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N) Vendors: misskey-dev Products: misskey Problem Types: CWE-347 Description: Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. This issue has been patched in version 2023.11.1-beta.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/misskey-dev/misskey/security/advisories/GHSA-3f39-6537-3cgc
CVE ID: CVE-2023-49080 State: PUBLISHED Published: 2023-12-04T21:00:59.026Z Last Updated: 2025-02-13T17:18:29.396Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: jupyter-server Products: jupyter_server Problem Types: CWE-209 Description: The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered part
o known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment. A fix has been introduced in commit `0056c3aa52` which no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty. This commit has been included in version 2.11.2. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jupyter-server/jupyter_server/security/advisories/GH
st Notes: - CVE Program Container: References: - https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-h56g-gq9v-vc8r - https://github.com/jupyter-server/jupyter_server/commit/0056c3aa52cbb28b263a7a609ae5f17618b36652 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62LO7PPIAMLIDEKUOORXLHKLGA6QPL77/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG2JWZI5KPUYMDPS53AIFTZJWZD3IT6I/
CVE ID: CVE-2023-49081 State: PUBLISHED Published: 2023-11-30T06:56:26.348Z Last Updated: 2025-11-04T18:19:34.328Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: aio-libs Products: aiohttp Problem Types: CWE-20 Description: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0. Additional Analyst Notes: - CVE Program Cont
HTTP version of the request. This issue has been patched in version 3.9.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2 - https://github.com/aio-libs/aiohttp/pull/7835/files - https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b - https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e
CVE ID: CVE-2023-49082 State: PUBLISHED Published: 2023-11-29T20:07:29.341Z Last Updated: 2025-11-04T18:19:35.587Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: aio-libs Products: aiohttp Problem Types: CWE-93, CWE-20 Description: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it
control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aio-libs/aiohttp/security/advisories/GHSA-qvrw-v9rv-5rjx - https://github.com/aio-libs/aiohttp/pull/7806/files - https://github.com/aio-libs/aiohttp/commit/e4ae01c2077d2cfa116aa82e4ff6866857f7c466 - https://gist.github.com/jnovikov/7f411ae9fe6a9a7804cf162a3bdbb44b
CVE ID: CVE-2023-49083 State: PUBLISHED Published: 2023-11-29T18:50:24.263Z Last Updated: 2025-11-03T21:50:11.841Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: pyca Products: cryptography Problem Types: CWE-476 Description: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in sy
y application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97 - https://github.com/pyca/cryptography/pull/9926 - https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMNTYMUGFJSDBYBU22FUYBHFRZODRKXV/
CVE ID: CVE-2023-49084 State: PUBLISHED Published: 2023-12-21T23:04:44.219Z Last Updated: 2025-02-13T17:18:30.635Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Cacti Products: cacti Problem Types: CWE-98 Description: Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the se
ized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-86vp - http://packetstormsecurity.com/files/176995/Cacti-pollers.php-SQL-Injection-Remote-Code-Execution.html - https://lists.debian.org/debian-lts-announce/2024/03/msg00018.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
CVE ID: CVE-2023-49085 State: PUBLISHED Published: 2023-12-22T16:13:13.259Z Last Updated: 2025-02-13T17:18:31.593Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Cacti Products: cacti Problem Types: CWE-89 Description: Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability - arbitrary SQL code execution. As of time of publication, a patch does not appear to exist. Additional Analyst Notes: - CVE Prog
ry SQL code execution. As of time of publication, a patch does not appear to exist. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-vr3c-38wh-g855 - https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/pollers.php#L451 - http://packetstormsecurity.com/files/176995/Cacti-pollers.php-SQL-Injection-Remote-Code-Execution.html - https://lists.debian.org/debian-lts-announce/2024/03/msg00018.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
CVE ID: CVE-2023-49086 State: PUBLISHED Published: 2023-12-21T23:29:45.134Z Last Updated: 2025-11-04T18:19:36.814Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Cacti Products: cacti Problem Types: CWE-79 Description: Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). A vulnerability in versions prior to 1.2.27 bypasses an earlier fix for CVE-2023-39360, therefore leading to a DOM XSS attack. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `graphs_new.php`. The impact of the vulnerability is execution of arbitrary JavaScript code in th
rable component is the `graphs_new.php`. The impact of the vulnerability is execution of arbitrary JavaScript code in the attacked user's browser. This issue has been patched in version 1.2.27. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-wc73-r2vw-59pr - https://github.com/Cacti/cacti/commit/6ec01c8b2983bf4fcb86f8c647655f74090b5be9 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
CVE ID: CVE-2023-49087 State: PUBLISHED Published: 2023-11-30T05:20:28.298Z Last Updated: 2024-08-02T21:46:29.195Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: simplesamlphp Products: xml-security Problem Types: CWE-345 Description: xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the related XML-document matches a specific DigestValue-value, but also that the cryptographic signature on the SignedInfo-tree (the one that contains the DigestValue) verifies and matches a trusted public key. If an attacker somehow (i.e. by exploiting a bug in PHP's canonicaliza
Value) verifies and matches a trusted public key. If an attacker somehow (i.e. by exploiting a bug in PHP's canonicalization function) manages to manipulate the canonicalized version's DigestValue, it would be possible to forge the signature. This issue has been patched in version 1.6.12 and 5.0.0-alpha.13. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/simplesamlphp/xml-security/security/advisories/GHSA-ww7x-3gxh-qm6r - https://github.com/simplesamlphp/xml-security/commit/f509e3083dd7870cce5880c804b5122317287581
CVE ID: CVE-2023-49088 State: PUBLISHED Published: 2023-12-22T16:16:53.348Z Last Updated: 2025-02-13T17:18:33.056Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: Cacti Products: cacti Problem Types: CWE-79 Description: Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `Ge
the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration>Sites/Devices/Data`. The victim of this attack could be any account with permissions to view `http://<HOST>/cacti/data_debug.php`. As of time of publication, no complete fix has been included in Cacti. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-q7g7-gcf6-wh4x - https://github.com/Cacti/cacti/security/advisories/GHSA-hrg9-qqqx-wc4h - https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/data_debug.php - https://lists.debian.org/debian-lts-announce/2024/03
acti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/data_debug.php - https://lists.debian.org/debian-lts-announce/2024/03/msg00018.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
CVE ID: CVE-2023-49089 State: PUBLISHED Published: 2023-12-12T19:02:33.259Z Last Updated: 2024-08-02T21:46:29.033Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: umbraco Products: Umbraco-CMS Problem Types: CWE-22 Description: Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location. Versions 8.18.10, 10.8.1, and 12.3.0 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/umbraco/Umbraco-CMS/securit
s issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-6324-52pr-h4p5