Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
- https://support.apple.com/en-us/HT213936 - https://support.apple.com/en-us/HT213941 - https://support.apple.com/en-us/HT213940 - https://support.apple.com/en-us/HT213937 - http://www.openwall.com/lists/oss-security/2023/09/28/3 - http://seclists.org/fulldisclosure/2023/Oct/2 - http://seclists.org/fulldisclosure/2023/Oct/10 - http://seclists.org/fulldisclosure/2023/Oct/8 - http://seclists.org/fulldisclosure/2023/Oct/9 - http://seclists.org/fulldisclosure/2023/Oct/3 - https://www.debian.org/security/2023/dsa-5527 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EEMDC5TQAANFH5D77QM34ZTUKXPFGVL/ - https://security.gentoo.org/glsa/202401-33
CVE ID: CVE-2023-41075 State: PUBLISHED Published: 2024-01-10T22:03:36.440Z Last Updated: 2024-08-26T20:09:19.352Z Vendors: Apple Products: macOS, iOS and iPadOS Problem Types: An app may be able to execute arbitrary code with kernel privileges Description: A type confusion issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7.5, macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4. An app may be able to execute arbitrary code with kernel privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213670 - https://support.apple.com/en-us/HT213
CVE ID: CVE-2023-41076 State: PUBLISHED Published: 2025-04-11T14:53:57.354Z Last Updated: 2025-04-12T03:55:18.166Z Vendors: Apple Products: macOS Problem Types: This issue was addressed by removing the vulnerable code. Description: An app may be able to elevate privileges. This issue is fixed in macOS 14. This issue was addressed by removing the vulnerable code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/120950
CVE ID: CVE-2023-41077 State: PUBLISHED Published: 2023-10-25T18:31:51.078Z Last Updated: 2025-06-12T14:57:03.130Z Vendors: Apple Products: macOS Problem Types: The issue was addressed with improved checks. Description: An app may be able to access protected user data. This issue is fixed in macOS Sonoma 14, macOS Ventura 13.6.1. The issue was addressed with improved checks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/120950 - https://support.apple.com/en-us/109050
CVE ID: CVE-2023-41078 State: PUBLISHED Published: 2023-09-26T20:14:44.069Z Last Updated: 2025-11-04T19:20:55.812Z Vendors: Apple Products: macOS Problem Types: An app may be able to bypass certain Privacy preferences Description: An authorization issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14. An app may be able to bypass certain Privacy preferences. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213940 - http://seclists.org/fulldisclosure/2023/Oct/3
CVE ID: CVE-2023-41079 State: PUBLISHED Published: 2023-09-26T20:14:49.103Z Last Updated: 2025-11-04T19:20:56.903Z Vendors: Apple Products: macOS Problem Types: An app may be able to bypass Privacy preferences Description: The issue was addressed with improved permissions logic. This issue is fixed in macOS Sonoma 14. An app may be able to bypass Privacy preferences. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213940 - http://seclists.org/fulldisclosure/2023/Oct/3
CVE ID: CVE-2023-41080 State: PUBLISHED Published: 2023-08-25T20:39:36.584Z Last Updated: 2025-10-29T12:04:40.271Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apa
application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f
CVE ID: CVE-2023-41081 State: PUBLISHED Published: 2023-09-13T09:30:05.584Z Last Updated: 2024-09-25T17:21:30.509Z Vendors: Apache Software Foundation Products: Apache Tomcat Connectors Problem Types: Unexpected default behaviour Description: Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or
o the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected. This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48. Users are recommended to upgrade to version 1.2.49, which fixes the issue. History 2023-09-13 Original advisory 2023-09-28 Updated summary Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://list
8 Updated summary Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/rd1r26w7271jyqgzr4492tooyt583d8b - https://www.openwall.com/lists/oss-security/2023/09/13/2 - https://lists.debian.org/debian-lts-announce/2023/09/msg00027.html - http://www.openwall.com/lists/oss-security/2023/09/28/7
CVE ID: CVE-2023-41082 State: PUBLISHED Published: 2024-05-16T20:47:31.064Z Last Updated: 2024-08-02T18:46:11.798Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: n/a Products: Intel(R) CST software Problem Types: denial of service, CWE-395 Description: Null pointer dereference for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01021.html
CVE ID: CVE-2023-41084 State: PUBLISHED Published: 2023-09-18T19:56:27.267Z Last Updated: 2024-08-02T18:46:11.684Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Socomec Products: MODULYS GP (MOD3GP-SY-120K) Problem Types: CWE-565 Description: Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03
CVE ID: CVE-2023-41085 State: PUBLISHED Published: 2023-10-10T12:33:11.777Z Last Updated: 2024-09-19T13:39:51.189Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-755 Description: When IPSec is configured on a Virtual Server, undisclosed traffic can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000132420
CVE ID: CVE-2023-41086 State: PUBLISHED Published: 2023-10-03T00:15:47.652Z Last Updated: 2024-08-02T18:46:11.906Z Vendors: FURUNO SYSTEMS Co.,Ltd. Products: ACERA 1210, ACERA 1150i, ACERA 1150w, ACERA 1110, ACERA 1020, ACERA 1010, ACERA 950, ACERA 850F, ACERA 900, ACERA 850M, ACERA 810, ACERA 800ST Problem Types: Cross-site request forgery (CSRF) Description: Cross-site request forgery (CSRF) vulnerability exists in FURUNO SYSTEMS wireless LAN access point devices. If a user views a malicious page while logged in, unintended operations may be performed. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA
nd versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 and earlier, ACERA 1150w firmware ver.01.35 and earlier, ACERA 1110 firmware ver.01.76 and earlier, ACERA 1020 firmware ver.01.86 and earlier, ACERA 1010 firmware ver.01.86 and earlier, ACERA 950 firmware ver.01.60 and earlier, ACERA 850F firmware ver.01.60 and earlier, ACERA 900 firmware ver.02.54 and earlier, ACERA 850M firmware ver.02.06 and earlier, ACERA 810 firmware ver.03.74 and earlier, and ACERA 800ST firmware ver.07.35 and earlier. They are affected when running in ST(Standalone) mode. Additional Analyst Notes: - CVE Program Container: References: - https://www.furunosystems.co.jp/
n ST(Standalone) mode. Additional Analyst Notes: - CVE Program Container: References: - https://www.furunosystems.co.jp/news/info/vulner20231002.html - https://jvn.jp/en/vu/JVNVU94497038/
CVE ID: CVE-2023-41088 State: PUBLISHED Published: 2023-10-19T18:08:34.103Z Last Updated: 2024-09-11T20:09:33.344Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: DEXMA Products: DexGate Problem Types: CWE-319 Description: The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker with access to the network, where clients have access to the DexGate server, could capture traffic. The attacker can later us the information within it to access the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-adviso
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-271-02
CVE ID: CVE-2023-41089 State: PUBLISHED Published: 2023-10-19T18:13:25.005Z Last Updated: 2024-09-12T17:54:32.972Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: DEXMA Products: DexGate Problem Types: CWE-287 Description: The affected product is vulnerable to an improper authentication vulnerability, which may allow an attacker to impersonate a legitimate user as long as the device keeps the session active, since the attack takes advantage of the cookie header to generate "legitimate" requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-271-02
CVE ID: CVE-2023-41090 State: PUBLISHED Published: 2024-02-14T13:38:08.833Z Last Updated: 2024-08-07T19:23:09.857Z Severity: LOW (CVSS 1.8 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: n/a Products: Intel(R) MAS software Problem Types: escalation of privilege, CWE-421 Description: Race condition in some Intel(R) MAS software before version 2.3 may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00967.html
CVE ID: CVE-2023-41091 State: PUBLISHED Published: 2024-02-14T13:38:19.194Z Last Updated: 2024-08-09T18:10:02.276Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) MPI Library Software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path for some Intel(R) MPI Library Software before version 2021.11 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01005.html
CVE ID: CVE-2023-41092 State: PUBLISHED Published: 2024-05-16T20:47:35.955Z Last Updated: 2024-08-21T17:55:14.226Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H) Vendors: n/a Products: Intel(R) Stratix 10 and Intel(R) Agilex 7 FPGAs Problem Types: denial of service, CWE-252 Description: Unchecked return value in SDM firmware for Intel(R) Stratix 10 and Intel(R) Agilex 7 FPGAs before version 23.3 may allow an authenticated user to potentially enable denial of service via adjacent access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01007.html
CVE ID: CVE-2023-41093 State: PUBLISHED Published: 2024-07-12T19:56:16.225Z Last Updated: 2024-08-02T18:46:11.834Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Silicon Labs Products: Simplicity SDK Problem Types: CWE-416 Description: Use After Free vulnerability in Silicon Labs Bluetooth SDK on 32 bit, ARM may allow an attacker with precise timing capabilities to intercept a small number of packets intended for a recipient that has left the network.This issue affects Silabs Bluetooth SDK: through 8.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.silabs.com/068Vm000007v4HP
CVE ID: CVE-2023-41094 State: PUBLISHED Published: 2023-10-04T20:01:16.250Z Last Updated: 2024-09-26T21:39:11.670Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Silicon Labs Products: Ember ZNet Problem Types: CWE-940 Description: TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifetime may allow a device to be added outside of valid TouchLink range or pairing duration This issue affects Ember ZNet 7.1.x from 7.1.3 through 7.1.5; 7.2.x from 7.2.0 through 7.2.3; Version 7.3 and later are unaffected Additional Analyst Notes: - CVE Program Container: - C
.x from 7.2.0 through 7.2.3; Version 7.3 and later are unaffected Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.silabs.com/0688Y00000aIPzL
CVE ID: CVE-2023-41095 State: PUBLISHED Published: 2023-10-26T13:10:11.193Z Last Updated: 2024-09-25T16:20:12.263Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: silabs.com Products: OpenThread SDK Problem Types: CWE-312 Description: Missing Encryption of Security Keys vulnerability in Silicon Labs OpenThread SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or extraction of network credentials stored in flash. This issue affects Silicon Labs OpenThread SDK: 2.3.1 and earlier. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/docume
am Container: - CISA ADP Vulnrichment: References: - https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000ZkKh7QAF?operationContext=S1
CVE ID: CVE-2023-41096 State: PUBLISHED Published: 2023-10-26T13:10:34.406Z Last Updated: 2024-09-25T16:23:10.406Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: silabs.com Products: Ember ZNet SDK Problem Types: CWE-312 Description: Missing Encryption of Security Keys vulnerability in Silicon Labs Ember ZNet SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or extraction of network credentials stored in flash. This issue affects Silicon Labs Ember ZNet SDK: 7.3.1 and earlier. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/docume
CVE ID: CVE-2023-41097 State: PUBLISHED Published: 2023-12-21T20:33:04.967Z Last Updated: 2025-04-23T16:23:05.829Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: silabs.com Products: GSDK Problem Types: CWE-208, CWE-327 Description: An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This issue affects GSDK: through 4.4.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm0000007rArIAI?operationContext=S1 - https://github.com/SiliconLab
.force.com/sfc/servlet.shepherd/document/download/069Vm0000007rArIAI?operationContext=S1 - https://github.com/SiliconLabs/gecko_sdk/releases
CVE ID: CVE-2023-41098 State: PUBLISHED Published: 2023-08-23T00:00:00 Last Updated: 2024-10-03T14:01:16.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP 2.4.174. In app/Controller/DashboardsController.php, a reflected XSS issue exists via the id parameter upon a dashboard edit. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MISP/MISP/commit/09fb0cba65eab9341e81f1cbebc2ae10be34a2b7
CVE ID: CVE-2023-41099 State: PUBLISHED Published: 2024-03-22T00:00:00 Last Updated: 2024-08-22T17:04:18.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Windows installer in Atos Eviden CardOS API before 5.5.5.2811, Local Privilege Escalation can occur.(from a regular user to SYSTEM). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.bull.com/ols/product/security/psirt/security-bulletins/cardos-api-local-privilege-escalation-psirt-358-tlp-clear-version-2-6-cve-2023-41099/view
CVE ID: CVE-2023-41100 State: PUBLISHED Published: 2023-08-23T00:00:00 Last Updated: 2024-10-03T14:00:35.618Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the hcaptcha (aka hCaptcha for EXT:form) extension before 2.1.2 for TYPO3. It fails to check that the required captcha field is submitted in the form data. allowing a remote user to bypass the CAPTCHA check. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-ext-sa-2023-007
CVE ID: CVE-2023-41101 State: PUBLISHED Published: 2023-11-17T00:00:00 Last Updated: 2024-09-04T20:17:59.075Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the captive portal in OpenNDS before version 10.1.3. get_query in http_microhttpd.c does not validate the length of the query string of GET requests. This leads to a stack-based buffer overflow in versions 9.x and earlier, and to a heap-based buffer overflow in versions 10.x and later. Attackers may exploit the issue to crash OpenNDS (Denial-of-Service condition) or to inject and execute arbitrary bytecode (Remote Code Execution). Affected OpenNDS before version 10.1.3 fixed in OpenWrt master and Op
xecute arbitrary bytecode (Remote Code Execution). Affected OpenNDS before version 10.1.3 fixed in OpenWrt master and OpenWrt 23.05 on 23. November by updating OpenNDS to version 10.2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openNDS/openNDS/releases/tag/v10.1.3 - https://github.com/openNDS/openNDS/commit/c294cf30e0a2512062c66e6becb674557b4aed8d - https://github.com/openwrt/routing/commit/88c98c910acccab694b3afb6d36d70ca429118a6 - https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006-v4/#sthash.2vJg3d85.rwx82g1C.dpbs
CVE ID: CVE-2023-41102 State: PUBLISHED Published: 2023-11-17T00:00:00 Last Updated: 2024-08-02T18:54:03.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the captive portal in OpenNDS before version 10.1.3. It has multiple memory leaks due to not freeing up allocated memory. This may lead to a Denial-of-Service condition due to the consumption of all available memory. Affected OpenNDS before version 10.1.3 fixed in OpenWrt master and OpenWrt 23.05 on 23. November by updating OpenNDS to version 10.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/openNDS/openNDS/releases/tag/v10.1.3 - htt
A ADP Vulnrichment: - CVE Program Container: References: - https://github.com/openNDS/openNDS/releases/tag/v10.1.3 - https://github.com/openNDS/openNDS/commit/31dbf4aa069c5bb39a7926d86036ce3b04312b51 - https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006-v4/#sthash.2vJg3d85.rwx82g1C.dpbs - https://github.com/openwrt/routing/commit/ad787a920ccb9dacf5b01d52bce36ac14a5ecd89
CVE ID: CVE-2023-41103 State: PUBLISHED Published: 2023-09-11T00:00:00.000Z Last Updated: 2025-05-30T16:02:48.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: Interact 7.9.79.5 allows stored Cross-site Scripting (XSS) attacks in several locations, allowing an attacker to store a JavaScript payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.interactsoftware.com/ - https://excellium-services.com/cert-xlm-advisory/CVE-2023-41103 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-41103
CVE ID: CVE-2023-41104 State: PUBLISHED Published: 2023-08-23T00:00:00 Last Updated: 2024-10-03T14:09:51.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an out-of-bounds memory access during base64 decoding, leading to both authentication bypass and information disclosure; however, the exact attack surface will depend on the particular VCL (Varnish Configuration Language) configuration in use. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.varnish-cache.org/security/VSV00012.html - https://docs.varnish-software.com/security/VSV00012/ - h
ences: - https://www.varnish-cache.org/security/VSV00012.html - https://docs.varnish-software.com/security/VSV00012/ - https://github.com/varnish/libvmod-digest/releases/tag/libvmod-digest-1.0.3
CVE ID: CVE-2023-41105 State: PUBLISHED Published: 2023-08-23T00:00:00 Last Updated: 2024-10-03T14:04:01.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/python/cpython/issues/106242 - https://github.com
m Container: - CISA ADP Vulnrichment: References: - https://github.com/python/cpython/issues/106242 - https://github.com/python/cpython/pull/107983 - https://github.com/python/cpython/pull/107981 - https://github.com/python/cpython/pull/107982 - https://mail.python.org/archives/list/security-announce%40python.org/thread/D6CDW3ZZC5D444YGL3VQUY6D4ECMCQLD/ - https://security.netapp.com/advisory/ntap-20231006-0015/
CVE ID: CVE-2023-41106 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T18:54:02.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.3. An attacker can gain access to a Zimbra account. This is also fixed in 9.0.0 Patch 35 and 8.8.15 Patch 42. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - http://www.openwall.com/lists/oss-security/2023/11/17/2