deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-48052
Published: 2023-11-16
Description: Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295, CWE-599
References: https://gxx777.github.io/HTTPie_3.2.2_Cryptographic_API_Misuse_Vulnerability.md; https://gxx777.github.io/HTTPie_3.2.2_Cryptographic_API_Misuse_Vulnerability.md
CVE: CVE-2023-48053
Published: 2023-11-16
Description: Archery v1.10.0 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://gxx777.github.io/Archery_v1.10.0_Cryptographic_API_Misuse_Vulnerability.md; https://gxx777.github.io/Archery_v1.10.0_Cryptographic_API_Misuse_Vulnerability.md
CVE: CVE-2023-48054
Published: 2023-11-16
Description: Missing SSL certificate validation in localstack v2.3.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://gxx777.github.io/localstack_v_2.3.2_Cryptographic_API_Misuse_Vulnerability.md; https://gxx777.github.io/localstack_v_2.3.2_Cryptographic_API_Misuse_Vulnerability.md
CVE: CVE-2023-48055
Published: 2023-11-16
Description: SuperAGI v0.0.13 was discovered to use a hardcoded key for encryption operations. This vulnerability can lead to the disclosure of information and communications.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://gxx777.github.io/SuperAGI_v0.0.13_Cryptographic_API_Misuse_Vulnerability.md; https://gxx777.github.io/SuperAGI_v0.0.13_Cryptographic_API_Misuse_Vulnerability.md
CVE: CVE-2023-48056
Published: 2023-11-16
Description: PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: http://bandoche.com; http://pypinksign.com; https://gxx777.github.io/PyPinkSign_v0.5.1_Cryptographic_API_Misuse_Vulnerability.md
CVE: CVE-2023-6176
Published: 2023-11-16
Description: A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific socket configuration, which could allow a local user to crash the system or escalate their privileges on the system.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-476
References: https://access.redhat.com/errata/RHSA-2024:2394; https://access.redhat.com/errata/RHSA-2024:2950; https://access.redhat.com/errata/RHSA-2024:3138
CVE: CVE-2023-47239
Published: 2023-11-16
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Scott Paterson Easy PayPal Shopping Cart plugin <= 1.1.10 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/easy-paypal-shopping-cart/wordpress-easy-paypal-shopping-cart-plugin-1-1-10-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-paypal-shopping-cart/wordpress-easy-paypal-shopping-cart-plugin-1-1-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47240
Published: 2023-11-16
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Codeboxr CBX Map for Google Map & OpenStreetMap plugin <= 1.1.11 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/cbxgooglemap/wordpress-cbx-map-for-google-map-openstreetmap-plugin-1-1-11-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cbxgooglemap/wordpress-cbx-map-for-google-map-openstreetmap-plugin-1-1-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47242
Published: 2023-11-16
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Milesi ANAC XML Bandi di Gara plugin <= 7.5 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/avcp/wordpress-anac-xml-bandi-di-gara-plugin-7-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/avcp/wordpress-anac-xml-bandi-di-gara-plugin-7-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47245
Published: 2023-11-16
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Milesi ANAC XML Viewer plugin <= 1.7 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/anac-xml-viewer/wordpress-anac-xml-viewer-plugin-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/anac-xml-viewer/wordpress-anac-xml-viewer-plugin-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47508
Published: 2023-11-16
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Averta Master Slider Pro plugin <= 3.6.5 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/masterslider/wordpress-master-slider-pro-plugin-3-6-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/masterslider/wordpress-master-slider-pro-plugin-3-6-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47509
Published: 2023-11-16
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ioannup Edit WooCommerce Templates plugin <= 1.1.1 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woo-edit-templates/wordpress-edit-woocommerce-templates-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-edit-templates/wordpress-edit-woocommerce-templates-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47511
Published: 2023-11-16
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SO WP Pinyin Slugs plugin <= 2.3.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/so-pinyin-slugs/wordpress-pinyin-slugs-plugin-2-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/so-pinyin-slugs/wordpress-pinyin-slugs-plugin-2-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47512
Published: 2023-11-16
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Gravity Master Product Enquiry for WooCommerce plugin <= 3.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/gm-woocommerce-quote-popup/wordpress-product-enquiry-for-woocommerce-plugin-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gm-woocommerce-quote-popup/wordpress-product-enquiry-for-woocommerce-plugin-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-48134
Published: 2023-11-16
Description: nagayama_copabowl Line 13.6.1 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor.
CVSS Score: 7.5 (HIGH)
References: https://github.com/syz913/CVE-reports/blob/main/nagayama_copabowl.md; https://github.com/syz913/CVE-reports/blob/main/nagayama_copabowl.md
CVE: CVE-2023-28621
Published: 2023-11-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wishfulthemes Raise Mag, Wishfulthemes Wishful Blog themes allows Reflected XSS.This issue affects Raise Mag: from n/a through 1.0.7; Wishful Blog: from n/a through 2.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/raise-mag/wordpress-raise-mag-theme-1-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wishful-blog/wordpress-wishful-blog-theme-2-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/raise-mag/wordpress-raise-mag-theme-1-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32796
Published: 2023-11-16
Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in MingoCommerce WooCommerce Product Enquiry plugin <= 2.3.4 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woo-product-enquiry/wordpress-woocommerce-product-enquiry-plugin-2-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-product-enquiry/wordpress-woocommerce-product-enquiry-plugin-2-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32957
Published: 2023-11-16
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Dazzlersoft Team Members Showcase plugin <= 1.3.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/dazzlersoft-teams/wordpress-team-members-showcase-plugin-1-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/dazzlersoft-teams/wordpress-team-members-showcase-plugin-1-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-34375
Published: 2023-11-16
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in 10Web SEO by 10Web plugin <= 1.2.9 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/seo-by-10web/wordpress-seo-by-10web-plugin-1-2-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/seo-by-10web/wordpress-seo-by-10web-plugin-1-2-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-36008
Published: 2023-11-16
Description: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36008; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36008
CVE: CVE-2023-36026
Published: 2023-11-16
Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS Score: 4.3 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36026; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36026
CVE: CVE-2023-39926
Published: 2023-11-16
Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Acurax Under Construction / Maintenance Mode from Acurax plugin <= 2.6 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/coming-soon-maintenance-mode-from-acurax/wordpress-under-construction-maintenance-mode-from-acurax-plugin-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/coming-soon-maintenance-mode-from-acurax/wordpress-under-construction-maintenance-mode-from-acurax-plugin-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46213
Published: 2023-11-16
Description: In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffective escaping in the “Show syntax Highlighted” feature can result in the execution of unauthorized code in a user’s web browser.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://advisory.splunk.com/advisories/SVD-2023-1103; https://research.splunk.com/application/1030bc63-0b37-4ac9-9ae0-9361c955a3cc/; https://advisory.splunk.com/advisories/SVD-2023-1103
CVE: CVE-2023-46214
Published: 2023-11-16
Description: In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.
CVSS Score: 8.0 (HIGH)
CWE: CWE-91, CWE-91
References: https://advisory.splunk.com/advisories/SVD-2023-1104; https://research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/; https://research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/
CVE: CVE-2023-6014
Published: 2023-11-16
Description: An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-598
References: https://huntr.com/bounties/3e64df69-ddc2-463e-9809-d07c24dc1de4; https://huntr.com/bounties/3e64df69-ddc2-463e-9809-d07c24dc1de4
CVE: CVE-2023-6020
Published: 2023-11-16
Description: LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862, CWE-862
References: https://huntr.com/bounties/83dd8619-6dc3-4c98-8f1b-e620fedcd1f6; https://huntr.com/bounties/83dd8619-6dc3-4c98-8f1b-e620fedcd1f6
CVE: CVE-2023-40314
Published: 2023-11-16
Description: 


Cross-site scripting in bootstrap.jsp in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Horizon 32.0.5 or newer and Meridian 2023.1.9 or newer










Meridian
and Horizon installation instructions state that they are intended for
installation within an organization's private networks and should not be
directly accessible from the Internet. 

OpenNMS thanks 

Moshe Apelbaum

 for reporting this issue.








CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20, CWE-79, CWE-79
References: https://github.com/OpenNMS/opennms/pull/6791; https://github.com/OpenNMS/opennms/pull/6791
CVE: CVE-2023-47112
Published: 2023-11-16
Description: Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which provides a list of job names and groups for any project, without the necessary authorization checks. The output of these endpoints only exposes the name of job groups and the jobs contained within the specified project. The output is read-only and the access does not allow changes to the information. This vulnerability has been patched in version 4.17.3. Users are advised to upgrade. Users unable to upgrade may block access to the two URLs used in either Rundeck Open Source or Process Automation products at a load balancer level.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://github.com/rundeck/rundeck/security/advisories/GHSA-xvmv-4rx6-x6jx; https://github.com/rundeck/rundeck/security/advisories/GHSA-xvmv-4rx6-x6jx
CVE: CVE-2023-47642
Published: 2023-11-16
Description: Zulip is an open-source team collaboration tool. It was discovered by the Zulip development team that active users who had previously been subscribed to a stream incorrectly continued being able to use the Zulip API to access metadata for that stream. As a result, users who had been removed from a stream, but still had an account in the organization, could still view metadata for that stream (including the stream name, description, settings, and an email address used to send emails into the stream via the incoming email integration). This potentially allowed users to see changes to a stream’s metadata after they had lost access to the stream. This vulnerability has been addressed in version 7.5 and all users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/zulip/zulip/commit/6336322d2f9bbccaacfc80cba83a3c62eefd5737; https://github.com/zulip/zulip/security/advisories/GHSA-c9wc-65fh-9x8p; https://github.com/zulip/zulip/commit/6336322d2f9bbccaacfc80cba83a3c62eefd5737
CVE: CVE-2023-47688
Published: 2023-11-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in Alexufo Youtube SpeedLoad plugin <= 0.6.3 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/youtube-speedload/wordpress-youtube-speedload-plugin-0-6-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/youtube-speedload/wordpress-youtube-speedload-plugin-0-6-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-48222
Published: 2023-11-16
Description: Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which would allow access to view or delete jobs, without the necessary authorization checks. This issue has been addressed in version 4.17.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.


CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://github.com/rundeck/rundeck/security/advisories/GHSA-phmw-jx86-x666; https://github.com/rundeck/rundeck/security/advisories/GHSA-phmw-jx86-x666
CVE: CVE-2023-47025
Published: 2023-11-16
Description: An issue in Free5gc v.3.3.0 allows a local attacker to cause a denial of service via the free5gc-compose component.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/free5gc/free5gc/issues/501; https://github.com/free5gc/free5gc/issues/501
CVE: CVE-2023-47686
Published: 2023-11-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.2.2 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/bft-autoresponder/wordpress-arigato-autoresponder-and-newsletter-plugin-2-7-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bft-autoresponder/wordpress-arigato-autoresponder-and-newsletter-plugin-2-7-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47687
Published: 2023-11-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in VJInfotech Woo Custom and Sequential Order Number plugin <= 2.6.0 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woo-custom-and-sequential-order-number/wordpress-woo-custom-and-sequential-order-number-plugin-2-6-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-custom-and-sequential-order-number/wordpress-woo-custom-and-sequential-order-number-plugin-2-6-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-48231
Published: 2023-11-16
Description: Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be viable. This issue has been addressed in commit `25aabc2b` which has been included in release version 9.0.2106. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 3.9 (LOW)
CWE: CWE-416
References: http://www.openwall.com/lists/oss-security/2023/11/16/1; https://github.com/vim/vim/commit/25aabc2b8ee1e19ced6f4da9d866cf9378fc4c5a; https://github.com/vim/vim/security/advisories/GHSA-8g46-v9ff-c765
CVE: CVE-2023-48232
Published: 2023-11-16
Description: Vim is an open source command line text editor. A floating point exception may occur when calculating the line offset for overlong lines and smooth scrolling is enabled and the cpo-settings include the 'n' flag. This may happen when a window border is present and when the wrapped line continues on the next physical line directly in the window border because the 'cpo' setting includes the 'n' flag. Only users with non-default settings are affected and the exception should only result in a crash. This issue has been addressed in commit `cb0b99f0` which has been included in release version 9.0.2107. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 3.9 (LOW)
CWE: CWE-755
References: http://www.openwall.com/lists/oss-security/2023/11/16/1; https://github.com/vim/vim/commit/cb0b99f0672d8446585d26e998343dceca17d1ce; https://github.com/vim/vim/security/advisories/GHSA-f6cx-x634-hqpw
CVE: CVE-2023-48233
Published: 2023-11-16
Description: Vim is an open source command line text editor. If the count after the :s command is larger than what fits into a (signed) long variable, abort with e_value_too_large. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `ac6378773` which has been included in release version 9.0.2108. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 2.8 (LOW)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2023/11/16/1; https://github.com/vim/vim/commit/ac63787734fda2e294e477af52b3bd601517fa78; https://github.com/vim/vim/security/advisories/GHSA-3xx4-hcq6-r2vj
CVE: CVE-2023-48234
Published: 2023-11-16
Description: Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `58f9befca1` which has been included in release version 9.0.2109. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 2.8 (LOW)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2023/11/16/1; https://github.com/vim/vim/commit/58f9befca1fa172068effad7f2ea5a9d6a7b0cca; https://github.com/vim/vim/security/advisories/GHSA-59gw-c949-6phq
CVE: CVE-2023-48235
Published: 2023-11-16
Description: Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an
overflow. Ironically this happens in the existing overflow check, because the line number becomes negative and LONG_MAX - lnum will cause the overflow. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `060623e` which has been included in release version 9.0.2110. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 2.8 (LOW)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2023/11/16/1; https://github.com/vim/vim/commit/060623e4a3bc72b011e7cd92bedb3bfb64e06200; https://github.com/vim/vim/security/advisories/GHSA-6g74-hr6q-pr8g
CVE: CVE-2023-48236
Published: 2023-11-16
Description: Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger
than MAX_INT. Impact is low, user interaction is required and a crash may not even happen in all situations. This vulnerability has been addressed in commit `73b2d379` which has been included in release version 9.0.2111. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 2.8 (LOW)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2023/11/16/1; https://github.com/vim/vim/commit/73b2d3790cad5694fc0ed0db2926e4220c48d968; https://github.com/vim/vim/security/advisories/GHSA-pr4c-932v-8hx5
CVE: CVE-2023-48237
Published: 2023-11-16
Description: Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `6bf131888` which has been included in version 9.0.2112. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 2.8 (LOW)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2023/11/16/1; https://github.com/vim/vim/commit/6bf131888a3d1de62bbfa8a7ea03c0ddccfd496e; https://github.com/vim/vim/security/advisories/GHSA-f2m2-v387-gv87