Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-0941 State: PUBLISHED Published: 2024-01-26T18:31:05.026Z Last Updated: 2024-11-13T14:54:04.052Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: Novel-Plus Problem Types: CWE-89 Description: A vulnerability was found in Novel-Plus 4.3.0-RC1 and classified as critical. This issue affects some unknown processing of the file /novel/bookComment/list. The manipulation of the argument sort leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-252185 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additiona
this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252185 - https://vuldb.com/?ctiid.252185 - https://github.com/red0-ha1yu/warehouse/blob/main/novel-plus_sqlinject2.md
CVE ID: CVE-2024-0942 State: PUBLISHED Published: 2024-01-26T19:31:04.140Z Last Updated: 2024-08-23T19:03:14.946Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Totolink Products: N200RE V5 Problem Types: CWE-613 Description: A vulnerability was found in Totolink N200RE V5 9.3.5u.6255_B20211224. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi. The manipulation leads to session expiration. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. VDB-252186 is the identi
tability is told to be difficult. The exploit has been disclosed to the public and may be used. VDB-252186 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252186 - https://vuldb.com/?ctiid.252186 - https://vuldb.com/?submit.269679 - https://drive.google.com/file/d/1oWAGbmDtHDIUN1WSRAh4ZnuzHOuvTU4T/view?usp=sharing - https://youtu.be/b0tU2CiLbnU
CVE ID: CVE-2024-0943 State: PUBLISHED Published: 2024-01-26T20:00:05.283Z Last Updated: 2024-10-18T14:53:04.968Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Totolink Products: N350RT Problem Types: CWE-613 Description: A vulnerability was found in Totolink N350RT 9.3.5u.6255. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation leads to session expiration. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier
tation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252187. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252187 - https://vuldb.com/?ctiid.252187 - https://vuldb.com/?submit.269680 - https://drive.google.com/file/d/1OBs4kc1KvbqrMhQHs54WtwxxxiBoI0hL/view?usp=sharing
CVE ID: CVE-2024-0944 State: PUBLISHED Published: 2024-01-26T20:00:06.345Z Last Updated: 2025-06-17T14:33:45.423Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Totolink Products: T8 Problem Types: CWE-613 Description: A vulnerability was found in Totolink T8 4.1.5cu.833_20220905. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerabil
s known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252188. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252188 - https://vuldb.com/?ctiid.252188 - https://vuldb.com/?submit.269681 - https://drive.google.com/file/d/1YPisSnxM5CwSLKFgs9w5k5MtNUgiijVo/view?usp=sharing
CVE ID: CVE-2024-0945 State: PUBLISHED Published: 2024-01-26T20:31:03.928Z Last Updated: 2024-11-13T14:53:04.995Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: 60IndexPage Problem Types: CWE-918 Description: A vulnerability classified as critical has been found in 60IndexPage up to 1.8.5. This affects an unknown part of the file /include/file.php of the component Parameter Handler. The manipulation of the argument url leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252189 was assigned to this vulnerability. NOTE: The vendor was contacted early ab
c and may be used. The identifier VDB-252189 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252189 - https://vuldb.com/?ctiid.252189 - https://note.zhaoj.in/share/7F54gy22y7uJ
CVE ID: CVE-2024-0946 State: PUBLISHED Published: 2024-01-26T21:00:07.332Z Last Updated: 2025-06-03T17:45:26.775Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: 60IndexPage Problem Types: CWE-918 Description: A vulnerability classified as critical was found in 60IndexPage up to 1.8.5. This vulnerability affects unknown code of the file /apply/index.php of the component Parameter Handler. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-252190 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about th
may be used. VDB-252190 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252190 - https://vuldb.com/?ctiid.252190 - https://note.zhaoj.in/share/iNSyaClT0hGi
CVE ID: CVE-2024-0947 State: PUBLISHED Published: 2024-06-27T09:27:41.220Z Last Updated: 2024-08-01T18:26:29.991Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Talya Informatics Products: Elektraweb Problem Types: CWE-565 Description: Reliance on Cookies without Validation and Integrity Checking vulnerability in Talya Informatics Elektraweb allows Session Credential Falsification through Manipulation, Accessing/Intercepting/Modifying HTTP Cookies, Manipulating Opaque Client-based Data Tokens.This issue affects Elektraweb: before v17.0.68. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bil
8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-0808
CVE ID: CVE-2024-0948 State: PUBLISHED Published: 2024-01-26T21:31:04.046Z Last Updated: 2024-08-01T18:26:29.999Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: NetBox Problem Types: CWE-79 Description: ** DISPUTED ** A vulnerability, which was classified as problematic, has been found in NetBox up to 3.7.0. This issue affects some unknown processing of the file /core/config-revisions of the component Home Page Configuration. The manipulation with the input <<h1 onload=alert(1)>>test</h1> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is sti
remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-252191. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.252191 - https://vuldb.com/?ctiid.252191 - https://vuldb.com/?submit.270218 - https://drive.google.com/file/d/1tcgyzu9Fh3AMG0INR0EdOR7ZjWmBK0ZR/view?usp=sharing
CVE ID: CVE-2024-0949 State: PUBLISHED Published: 2024-06-27T09:36:59.897Z Last Updated: 2025-10-14T12:33:41.539Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Talya Informatics Products: Elektraweb Problem Types: CWE-306, CWE-552, CWE-798 Description: Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass.This issue affects Elektraweb: before v17.0.68. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-0808
CVE ID: CVE-2024-0951 State: PUBLISHED Published: 2024-03-18T19:05:52.481Z Last Updated: 2025-03-27T15:20:10.944Z Vendors: Unknown Products: Advanced Social Feeds Widget & Shortcode Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Advanced Social Feeds Widget & Shortcode WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/88b2e479-eb15-4213-9
s: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/88b2e479-eb15-4213-9df8-3d353074974e/
CVE ID: CVE-2024-0952 State: PUBLISHED Published: 2024-04-09T18:59:32.870Z Last Updated: 2024-08-01T18:26:30.227Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: wedevs Products: WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in all versions up to, and including, 1.12.9 due to insufficient escaping on the user supplied
ion via the id parameter in all versions up to, and including, 1.12.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with accounting manager or admin privileges or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f3ba06f9-de51-49ea-87c1-4583e939314b?source=cve - https://plugins.trac.wordpress.org/changeset/3060269/erp/tags/1.13.0/mo
3ba06f9-de51-49ea-87c1-4583e939314b?source=cve - https://plugins.trac.wordpress.org/changeset/3060269/erp/tags/1.13.0/modules/accounting/includes/functions/people.php
CVE ID: CVE-2024-0953 State: PUBLISHED Published: 2024-02-05T16:48:33.899Z Last Updated: 2024-10-27T22:12:29.342Z Vendors: Mozilla Products: Firefox for iOS Problem Types: QR Code Scanner does not prompt before navigating user Description: When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before being navigated to the page specified in the code. This may surprise the user and potentially direct them to unwanted content. This vulnerability affects Firefox for iOS < 129. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1837916 - https://www.mozilla.org/security/advisories/
ainer: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1837916 - https://www.mozilla.org/security/advisories/mfsa2024-36/
CVE ID: CVE-2024-0954 State: PUBLISHED Published: 2024-02-05T21:21:52.530Z Last Updated: 2024-08-01T18:26:30.279Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting through editing context via the 'data-eael-wrapper-link' wrapper in all versions up to, and including,
ss-Site Scripting through editing context via the 'data-eael-wrapper-link' wrapper in all versions up to, and including, 5.9.7 due to insufficient input sanitization and output escaping on user supplied protocols. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/875db71d-c799-40b9-95e1-74d53046b0a9?source=cve - https://plugins.trac.wordpress.org/changeset/3029928/essential-addons-for-elementor-lite/t
5e1-74d53046b0a9?source=cve - https://plugins.trac.wordpress.org/changeset/3029928/essential-addons-for-elementor-lite/tags/5.9.8/assets/front-end/js/view/wrapper-link.js
CVE ID: CVE-2024-0955 State: PUBLISHED Published: 2024-02-06T23:34:19.528Z Last Updated: 2024-08-01T18:26:29.995Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Tenable Products: Nessus Problem Types: CWE-20 Description: A stored XSS vulnerability exists where an authenticated, remote attacker with administrator privileges on the Nessus application could alter Nessus proxy settings, which could lead to the execution of remote arbitrary scripts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.tenable.com/security/tns-2024-01
CVE ID: CVE-2024-0956 State: PUBLISHED Published: 2024-03-29T06:44:03.130Z Last Updated: 2024-08-23T13:28:41.286Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: wedevs Products: WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter via the erp/v1/accounting/v1/vendors/1/products/ REST route in all versions up to, and includin
ion via the id parameter via the erp/v1/accounting/v1/vendors/1/products/ REST route in all versions up to, and including, 1.12.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin or accounting manager privileges, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d4e04650-624a-4440-b166-8de0f24bb1dd?source=cve - https://plugins.trac.
ww.wordfence.com/threat-intel/vulnerabilities/id/d4e04650-624a-4440-b166-8de0f24bb1dd?source=cve - https://plugins.trac.wordpress.org/browser/erp/trunk/modules/accounting/includes/functions/products.php#L387
CVE ID: CVE-2024-0957 State: PUBLISHED Published: 2024-03-22T02:00:00.179Z Last Updated: 2024-08-01T18:26:28.962Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: webtoffee Products: WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Customer Notes field in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This make
field in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected invoice for printing. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c7ba4218-5b60-4e72-b98d-7c95c9fc3d59?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050923%40print-invoices-packing-slip-labels-for-woocommerce&new=3050923%40print-invoices-packing-slip-labels-for-woocommerce&sfp_email=&sf
oices-packing-slip-labels-for-woocommerce&new=3050923%40print-invoices-packing-slip-labels-for-woocommerce&sfp_email=&sfph_mail=
CVE ID: CVE-2024-0958 State: PUBLISHED Published: 2024-01-27T06:00:05.543Z Last Updated: 2024-10-18T14:39:40.386Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CodeAstro Products: Stock Management System Problem Types: CWE-79 Description: A vulnerability was found in CodeAstro Stock Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /index.php of the component Add Category Handler. The manipulation of the argument Category Name/Category Description leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerabilit
d remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252203. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252203 - https://vuldb.com/?ctiid.252203 - https://drive.google.com/drive/folders/17JTwjuT09q7he_oXkMtZS5jyyXw8ZIgg?usp=sharing
CVE ID: CVE-2024-0959 State: PUBLISHED Published: 2024-01-27T10:31:04.184Z Last Updated: 2024-11-13T14:27:29.247Z Severity: N/A (CVSS 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P) Vendors: StanfordVL Products: GibsonEnv Problem Types: CWE-502 Description: A vulnerability was found in StanfordVL GibsonEnv 0.3.1. It has been classified as critical. Affected is the function cloudpickle.load of the file gibson\utils\pposgd_fuse.py. The manipulation leads to deserialization. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB
be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252204. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252204 - https://vuldb.com/?ctiid.252204 - https://github.com/bayuncao/vul-cve-7 - https://github.com/bayuncao/vul-cve-7/blob/main/dataset.pkl
CVE ID: CVE-2024-0960 State: PUBLISHED Published: 2024-01-27T12:00:07.334Z Last Updated: 2025-06-02T19:48:37.467Z Severity: N/A (CVSS 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P) Vendors: flink-extended Products: ai-flow Problem Types: CWE-502 Description: A vulnerability was found in flink-extended ai-flow 0.3.1. It has been declared as critical. Affected by this vulnerability is the function cloudpickle.loads of the file \ai_flow\cli\commands\workflow_command.py. The manipulation leads to deserialization. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier
The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-252205 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252205 - https://vuldb.com/?ctiid.252205 - https://github.com/bayuncao/vul-cve-8 - https://github.com/bayuncao/vul-cve-8/blob/main/dataset.pkl
CVE ID: CVE-2024-0961 State: PUBLISHED Published: 2024-02-05T21:21:48.120Z Last Updated: 2024-08-01T18:26:28.983Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gpriday Products: SiteOrigin Widgets Bundle Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the code editor in all versions up to, and including, 1.58.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts
This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6f7c164f-2f78-4857-94b9-077c2dea13df?source=cve - https://plugins.trac.wordpress.org/browser/so-widgets-bundle/trunk/widgets/button/button.php#L355 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3027675%40so-widgets-bundle%2Ftrunk&old=3027506%40so-widgets-bundle%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-0962 State: PUBLISHED Published: 2024-01-27T12:31:04.433Z Last Updated: 2025-06-17T21:29:16.525Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: obgm Products: libcoap Problem Types: CWE-121 Description: A vulnerability was found in obgm libcoap 4.3.4. It has been rated as critical. Affected by this issue is the function get_split_entry of the file src/coap_oscore.c of the component Configuration File Handler. The manipulation leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-252206 is the identifier assigned to this vu
and may be used. It is recommended to apply a patch to fix this issue. VDB-252206 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252206 - https://vuldb.com/?ctiid.252206 - https://github.com/obgm/libcoap/issues/1310 - https://github.com/obgm/libcoap/issues/1310#issue-2099860835 - https://github.com/obgm/libcoap/pull/1311