Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wacom.com/en-us/support/product-support/drivers - https://jvn.jp/en/jp/JVN90278893/
CVE ID: CVE-2023-27530 State: PUBLISHED Published: 2023-03-10T00:00:00 Last Updated: 2024-10-15T18:33:52.509Z Vendors: n/a Products: https://github.com/rack/rack Problem Types: CWE-400 Description: A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.rubyonrails.org/t/cve-2023-27530-possible-dos-vulnerability-in-multipart-mime-parsing/82388 - https://lists.debian.org/debian-lts-announce/2023/04/
27530-possible-dos-vulnerability-in-multipart-mime-parsing/82388 - https://lists.debian.org/debian-lts-announce/2023/04/msg00017.html - https://www.debian.org/security/2023/dsa-5530 - https://security.netapp.com/advisory/ntap-20231208-0015/
CVE ID: CVE-2023-27531 State: PUBLISHED Published: 2025-01-09T00:33:47.739Z Last Updated: 2025-01-09T21:21:36.117Z Vendors: Rails Products: Kredis JSON Description: There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.rubyonrails.org/t/cve-2023-27531-possible-deserialization-of-untrusted-data-vulnerability-in-kredis-json/82467
CVE ID: CVE-2023-27532 State: PUBLISHED Published: 2023-03-10T00:00:00.000Z Last Updated: 2025-10-21T23:15:24.077Z Vendors: n/a Products: Veeam Backup & Replication Problem Types: CWE-306 Description: Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4424
CVE ID: CVE-2023-27533 State: PUBLISHED Published: 2023-03-30T00:00:00 Last Updated: 2024-08-02T12:16:35.624Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-75 Description: A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system. Additional A
ed if an application allows user input, thereby enabling attackers to execute arbitrary code on the system. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1891474 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/ - https://security.netapp.com/advisory/ntap-20230420-0011/ - https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html - https://security.gentoo.org/glsa/202310-12
CVE ID: CVE-2023-27534 State: PUBLISHED Published: 2023-03-30T00:00:00.000Z Last Updated: 2025-04-23T16:23:04.273Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-22 Description: A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user. Additional Analyst Notes: - CVE Program Container: - C
path like /~2/foo while accessing a server with a specific user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1892351 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/ - https://security.netapp.com/advisory/ntap-20230420-0012/ - https://security.gentoo.org/glsa/202310-12 - https://lists.debian.org/debian-lts-announce/2024/03/msg00016.html
CVE ID: CVE-2023-27535 State: PUBLISHED Published: 2023-03-30T00:00:00.000Z Last Updated: 2025-06-09T14:47:57.951Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-305 Description: An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easi
OPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1892780 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/ - https://security.netapp.com/advisory/ntap-20230420-0010/ - https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html - https://security.gentoo.org/glsa/20
0230420-0010/ - https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html - https://security.gentoo.org/glsa/202310-12
CVE ID: CVE-2023-27536 State: PUBLISHED Published: 2023-03-30T00:00:00.000Z Last Updated: 2025-02-14T15:39:25.676Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-305 Description: An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been c
sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1895135 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/ - https://security.netapp.com/advisory/ntap-20230420-0010/ - https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html - https://security.gentoo.org/glsa/202310-12
CVE ID: CVE-2023-27537 State: PUBLISHED Published: 2023-03-30T00:00:00 Last Updated: 2024-08-02T12:16:35.551Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-415 Description: A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1897203 - http
fter-free. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1897203 - https://security.netapp.com/advisory/ntap-20230420-0010/ - https://security.gentoo.org/glsa/202310-12
CVE ID: CVE-2023-27538 State: PUBLISHED Published: 2023-03-30T00:00:00.000Z Last Updated: 2025-06-09T14:52:08.739Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-305 Description: An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connec
from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1898475 - https://security.netapp.com/advisory/ntap-20230420-0010/ - https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html - https://security.gentoo.org/glsa/202310-12
CVE ID: CVE-2023-27539 State: PUBLISHED Published: 2025-01-09T00:33:47.737Z Last Updated: 2025-01-09T21:24:51.396Z Vendors: Rails Products: Rack Description: There is a denial of service vulnerability in the header parsing component of Rack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.rubyonrails.org/t/cve-2023-27539-possible-denial-of-service-vulnerability-in-racks-header-parsing/82466 - https://github.com/advisories/GHSA-c6qg-cjj8-47qp - https://github.com/rack/rack/commit/231ef369ad0b542575fb36c74fcfcfabcf6c530c - https://github.com/rack/rack/commit/ee7919ea04303717858be1c3f16b406adc6d8cff - https://lists.debian.org/debian-lts-announce/2023/04/msg00017
ack/rack/commit/ee7919ea04303717858be1c3f16b406adc6d8cff - https://lists.debian.org/debian-lts-announce/2023/04/msg00017.html - https://security.netapp.com/advisory/ntap-20231208-0016/ - https://www.debian.org/security/2023/dsa-5530
CVE ID: CVE-2023-27540 State: PUBLISHED Published: 2023-07-10T00:22:35.465Z Last Updated: 2024-10-25T19:52:30.451Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Watson CP4D Data Stores Problem Types: CWE-770 Description: IBM Watson CP4D Data Stores 4.6.0 does not properly allocate resources without limits or throttling which could allow a remote attacker with information specific to the system to cause a denial of service. IBM X-Force ID: 248924. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7009883 - https://exchange.xforce.ibmcloud.com/vulnerabilities/248924
CVE ID: CVE-2023-27545 State: PUBLISHED Published: 2024-02-29T00:45:45.301Z Last Updated: 2024-08-02T12:16:35.595Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Watson CloudPak for Data Data Stores Problem Types: CWE-525 Description: IBM Watson CloudPak for Data Data Stores information disclosure 4.6.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 248947. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6965446 - https://exchange.xforce.ibmcloud.com/vulnerabilities/248947
CVE ID: CVE-2023-27554 State: PUBLISHED Published: 2023-05-11T19:25:13.416Z Last Updated: 2025-01-24T16:13:22.107Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:L) Vendors: IBM Products: WebSphere Application Server Problem Types: CWE-611 Description: IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 249185. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6989451 - https://exchang
ogram Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6989451 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249185
CVE ID: CVE-2023-27555 State: PUBLISHED Published: 2023-04-28T17:38:59.623Z Last Updated: 2025-02-13T16:45:26.913Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: DB2 for Linux, UNIX and Windows Problem Types: CWE-20 Description: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 is vulnerable to a denial of service when attempting to use ACR client affinity for unfenced DRDA federation wrappers. IBM X-Force ID: 249187. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6985683 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249187 - https:/
- https://www.ibm.com/support/pages/node/6985683 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249187 - https://security.netapp.com/advisory/ntap-20230511-0010/
CVE ID: CVE-2023-27556 State: PUBLISHED Published: 2023-04-28T00:56:37.311Z Last Updated: 2025-01-30T20:45:01.194Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Safer Payments Problem Types: CWE-770 Description: IBM Counter Fraud Management for Safer Payments 6.1.0.00, 6.2.0.00, 6.3.0.00 through 6.3.1.03, 6.4.0.00 through 6.4.2.02 and 6.5.0.00 does not properly allocate resources without limits or throttling which could allow a remote attacker to cause a denial of service. IBM X-Force ID: 249190. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6985601 - https://e
CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6985601 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249190
CVE ID: CVE-2023-27557 State: PUBLISHED Published: 2023-04-28T01:35:26.863Z Last Updated: 2025-01-30T19:33:04.499Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Safer Payments Problem Types: CWE-327 Description: IBM Counter Fraud Management for Safer Payments 6.1.0.00 through 6.1.1.02, 6.2.0.00 through 6.2.2.02, 6.3.0.00 through 6.3.1.02, 6.4.0.00 through 6.4.2.01, and 6.5.0.00 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 249192. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/
tional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6985603 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249192
CVE ID: CVE-2023-27558 State: PUBLISHED Published: 2023-07-09T23:32:13.179Z Last Updated: 2025-02-13T16:45:27.416Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Db2 for Windows Problem Types: 264 Permissions, Privileges, Access Controls Description: IBM Db2 on Windows 10.5, 11.1, and 11.5 may be vulnerable to a privilege escalation caused by at least one installed service using an unquoted service path. A local attacker could exploit this vulnerability to gain elevated privileges by inserting an executable file in the path of the affected service. IBM X-Force ID: 249194. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment
the affected service. IBM X-Force ID: 249194. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7010571 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249194 - https://security.netapp.com/advisory/ntap-20230818-0017/
CVE ID: CVE-2023-27559 State: PUBLISHED Published: 2023-04-26T19:02:45.540Z Last Updated: 2024-11-21T18:43:08.350Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-20 Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash when using a specially crafted subquery. IBM X-Force ID: 249196. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6985667 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249196 - https://
https://www.ibm.com/support/pages/node/6985667 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249196 - https://security.netapp.com/advisory/ntap-20230511-0010/
CVE ID: CVE-2023-27560 State: PUBLISHED Published: 2023-03-03T00:00:00.000Z Last Updated: 2025-03-06T20:19:00.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: Math/PrimeField.php in phpseclib 3.x before 3.0.19 has an infinite loop with composite primefields. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/phpseclib/phpseclib/commit/6298d1cd55c3ffa44533bd41906caec246b60440 - https://github.com/phpseclib/phpseclib/releases/tag/3.0.19
CVE ID: CVE-2023-27561 State: PUBLISHED Published: 2023-03-03T00:00:00 Last Updated: 2024-12-06T13:09:23.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/opencontainers/runc/issues/3751 - https://github.com/opencontainers/runc/issues/2197#issuec
rences: - https://github.com/opencontainers/runc/issues/3751 - https://github.com/opencontainers/runc/issues/2197#issuecomment-1437617334 - https://gist.github.com/LiveOverflow/c937820b688922eb127fb760ce06dab9 - https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHGVGGMKGZSJ7YO67TGGPFEHBYMS63VF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FYVE3GB4OG3BNT5DLQHYO4M5SXX33AQ5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6BF24VCZRFTYBTT3T7HDZUOTKOTNPLZ/ - https://lists.fedora
rchives/list/package-announce%40lists.fedoraproject.org/message/I6BF24VCZRFTYBTT3T7HDZUOTKOTNPLZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANUGDBJ7NBUMSUFZUSKU3ZMQYZ2Z3STN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNB2UEDIIJCRQW4WJLZOPQJZXCVSXMLD/
CVE ID: CVE-2023-27562 State: PUBLISHED Published: 2023-05-10T00:00:00.000Z Last Updated: 2025-01-27T21:33:03.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: The n8n package 0.218.0 for Node.js allows Directory Traversal. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/n8n-io/n8n/releases - https://www.synacktiv.com/sites/default/files/2023-05/Synacktiv-N8N-Multiple-Vulnerabilities_0.pdf - https://security.netapp.com/advisory/ntap-20230622-0007/
CVE ID: CVE-2023-27563 State: PUBLISHED Published: 2023-05-10T00:00:00.000Z Last Updated: 2025-01-27T21:09:27.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/n8n-io/n8n/releases - https://www.synacktiv.com/sites/default/files/2023-05/Synacktiv-N8N-Multiple-Vulnerabilities_0.pdf - https://security.netapp.com/advisory/ntap-20230622-0007/
CVE ID: CVE-2023-27564 State: PUBLISHED Published: 2023-05-10T00:00:00.000Z Last Updated: 2025-01-27T21:10:09.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: The n8n package 0.218.0 for Node.js allows Information Disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/n8n-io/n8n/releases - https://www.synacktiv.com/sites/default/files/2023-05/Synacktiv-N8N-Multiple-Vulnerabilities_0.pdf - https://security.netapp.com/advisory/ntap-20230622-0007/
CVE ID: CVE-2023-27566 State: PUBLISHED Published: 2023-03-03T00:00:00.000Z Last Updated: 2025-03-06T16:43:25.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cubism Core in Live2D Cubism Editor 4.2.03 allows out-of-bounds write via a crafted Section Offset Table or Count Info Table in an MOC3 file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://undeleted.ronsor.com/live2d-a-security-trainwreck/ - https://github.com/openl2d/moc3ingbird - https://docs.live2d.com/cubism-editor-manual/updates4/ - https://news.ycombinator.com/item?id=35013098
CVE ID: CVE-2023-27567 State: PUBLISHED Published: 2023-03-03T00:00:00.000Z Last Updated: 2025-03-06T16:41:51.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenBSD 7.2, a TCP packet with destination port 0 that matches a pf divert-to rule can crash the kernel. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/013_tcp.patch.sig - https://github.com/openbsd/src/commit/0a543725ccdd2a01669122ce79bb67e66ede77f2 - https://security.netapp.com/advisory/ntap-20230406-0001/
CVE ID: CVE-2023-27568 State: PUBLISHED Published: 2023-05-04T00:00:00.000Z Last Updated: 2025-02-13T16:45:27.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability inSpryker Commerce OS 0.9 that allows for access to sensitive data via customer/order?orderSearchForm[searchText]= Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2023-001.txt - https://www.schutzwerk.com/blog/schutzwerk-sa-2023-001/ - http://seclists.org/fulldisclosure/2023/May/2 - http://packetstormsecurity.com/files/172257/Spryker-Commerce-OS-1.0-SQL-Injection.html
CVE ID: CVE-2023-27569 State: PUBLISHED Published: 2023-03-21T00:00:00.000Z Last Updated: 2025-02-26T18:25:01.858Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The eo_tags package before 1.3.0 for PrestaShop allows SQL injection via an HTTP User-Agent or Referer header. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://profileo.com - https://security.profileo.com/cve/eo_tags_2023-27569-27570/
CVE ID: CVE-2023-27570 State: PUBLISHED Published: 2023-03-21T00:00:00.000Z Last Updated: 2025-02-26T17:20:34.160Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The eo_tags package before 1.4.19 for PrestaShop allows SQL injection via a crafted _ga cookie. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://profileo.com - https://security.profileo.com/cve/eo_tags_2023-27569-27570/