deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-2079
Published: 2024-03-13
Description: The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'per_line_mobile' shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3048239%40addons-for-visual-composer&new=3048239%40addons-for-visual-composer&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/2c07b5c8-7fae-499d-9f6c-9392166f74b8?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3048239%40addons-for-visual-composer&new=3048239%40addons-for-visual-composer&sfp_email=&sfph_mail=
CVE: CVE-2024-2242
Published: 2024-03-13
Description: The Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘active-tab’ parameter in all versions up to, and including, 5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3049594/contact-form-7/trunk/admin/edit-contact-form.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/d5bf4972-424a-4470-a0bc-7dcc95378e0e?source=cve; https://plugins.trac.wordpress.org/changeset/3049594/contact-form-7/trunk/admin/edit-contact-form.php
CVE: CVE-2024-28251
Published: 2024-03-14
Description: Querybook is a Big Data Querying UI, combining collocated table metadata and a simple notebook interface. Querybook's datadocs functionality works by using a Websocket Server. The client talks to this WSS whenever updating/deleting/reading any cells as well as for watching the live status of query executions. Currently the CORS setting allows all origins, which could result in cross-site websocket hijacking and allow attackers to read/edit/remove datadocs of the user. This issue has been addressed in version 3.32.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-345
References: https://github.com/pinterest/querybook/pull/1425; https://github.com/pinterest/querybook/security/advisories/GHSA-5349-j4c9-x767; https://github.com/pinterest/querybook/pull/1425
CVE: CVE-2024-25228
Published: 2024-03-14
Description: Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler.class.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/; https://seclists.org/fulldisclosure/2024/Mar/15; http://seclists.org/fulldisclosure/2024/Mar/15
CVE: CVE-2024-25650
Published: 2024-03-14
Description: Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator to obtain the Symmetric Key (used to encrypt RabbitMQ messages) via crafted payloads to the /pre-authenticate, /authenticate, and /execute-and-respond REST API endpoints. This makes it possible for a PAM administrator to impersonate the Engine and exfiltrate sensitive information from the messages published in the RabbitMQ exchanges, without being audited in the application.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25650; https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25650
CVE: CVE-2024-1221
Published: 2024-03-14
Description: This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint. The attacker must carry out some reconnaissance to gain knowledge of a system token. This CVE only affects Linux and macOS PaperCut NG/MF servers.
CVSS Score: 3.1 (LOW)
CWE: CWE-76
References: https://www.papercut.com/kb/Main/Security-Bulletin-March-2024; https://www.papercut.com/kb/Main/Security-Bulletin-March-2024
CVE: CVE-2024-1222
Published: 2024-03-14
Description: This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls.
CVSS Score: 8.6 (HIGH)
CWE: CWE-250
References: https://www.papercut.com/kb/Main/Security-Bulletin-March-2024; https://www.papercut.com/kb/Main/Security-Bulletin-March-2024
CVE: CVE-2024-1223
Published: 2024-03-14
Description: This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge of some combination of valid usernames, device names and an internal system key. For such an attack to be successful the system must be in a specific runtime state.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-488
References: https://www.papercut.com/kb/Main/Security-Bulletin-March-2024; https://www.papercut.com/kb/Main/Security-Bulletin-March-2024
CVE: CVE-2024-1654
Published: 2024-03-14
Description: This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this. 
CVSS Score: 7.2 (HIGH)
CWE: CWE-183
References: https://www.papercut.com/kb/Main/Security-Bulletin-March-2024; https://www.papercut.com/kb/Main/Security-Bulletin-March-2024
CVE: CVE-2024-25649
Published: 2024-03-14
Description: In Delinea PAM Secret Server 11.4, it is possible for an attacker (with Administrator access to the Secret Server machine) to read the following data from a memory dump: the decrypted master key, database credentials (when SQL Server Authentication is enabled), the encryption key of RabbitMQ queue messages, and session cookies.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-316
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25649; https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25649
CVE: CVE-2024-25651
Published: 2024-03-14
Description: User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attacker to determine whether a user is valid because of a difference in responses from the /oauth2/token endpoint.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25651; https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25651
CVE: CVE-2024-25652
Published: 2024-03-14
Description: In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED ADMIN MODE (with access to the Report functionality) to gain unauthorized access to remote sessions created by legitimate users through information obtained from the Custom Legacy Report functionality.
CVSS Score: 7.6 (HIGH)
CWE: CWE-287
References: https://docs.delinea.com/online-help/secret-server/admin/unlimited-administration-mode/index.htm?Highlight=unlimited%20admin; https://docs.delinea.com/online-help/secret-server/release-notes/ssc-rn-2024-02-10.htm; https://trust.delinea.com/
CVE: CVE-2024-25653
Published: 2024-03-14
Description: Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view system reports and modify custom reports via the Report functionality in the Web UI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25653; https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25653
CVE: CVE-2024-28388
Published: 2024-03-14
Description: SQL injection vulnerability in SunnyToo stproductcomments module for PrestaShop v.1.0.5 and before, allows a remote attacker to escalate privileges and obtain sensitive information via the StProductCommentClass::getListcomments method.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2024/03/12/stproductcomments.html; https://security.friendsofpresta.org/modules/2024/03/12/stproductcomments.html
CVE: CVE-2024-1882
Published: 2024-03-14
Description: This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-76
References: https://www.papercut.com/kb/Main/Security-Bulletin-March-2024; https://www.papercut.com/kb/Main/Security-Bulletin-March-2024
CVE: CVE-2024-1883
Published: 2024-03-14
Description: This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server. An attacker can exploit this weakness by crafting a malicious URL that contains a script. When an unsuspecting user clicks on this malicious link, it could potentially lead to limited loss of confidentiality, integrity or availability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-76, CWE-79
References: https://www.papercut.com/kb/Main/Security-Bulletin-March-2024; https://www.papercut.com/kb/Main/Security-Bulletin-March-2024
CVE: CVE-2024-1884
Published: 2024-03-14
Description: This is a Server-Side Request Forgery (SSRF) vulnerability in the PaperCut NG/MF server-side module that  allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://www.papercut.com/kb/Main/Security-Bulletin-March-2024; https://www.papercut.com/kb/Main/Security-Bulletin-March-2024
CVE: CVE-2024-22396
Published: 2024-03-14
Description: An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a specially crafted IKEv2 payload.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-190
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0004; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0004
CVE: CVE-2024-22397
Published: 2024-03-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the SonicOS SSLVPN portal allows a remote authenticated attacker as a firewall 'admin' user to store and execute arbitrary JavaScript code.
CVSS Score: 8.3 (HIGH)
CWE: CWE-79
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0005; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0005
CVE: CVE-2024-22398
Published: 2024-03-14
Description: An improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in SonicWall Email Security Appliance could allow a remote attacker with administrative privileges to conduct a directory traversal attack and delete arbitrary files from the appliance file system.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-23
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0006; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0006
CVE: CVE-2024-28390
Published: 2024-03-14
Description: An issue in Advanced Plugins ultimateimagetool module for PrestaShop before v.2.2.01, allows a remote attacker to escalate privileges and obtain sensitive information via Improper Access Control.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://security.friendsofpresta.org/modules/2024/03/12/ultimateimagetool.html; https://security.friendsofpresta.org/modules/2024/03/12/ultimateimagetool.html
CVE: CVE-2024-28391
Published: 2024-03-14
Description: SQL injection vulnerability in FME Modules quickproducttable module for PrestaShop v.1.2.1 and before, allows a remote attacker to escalate privileges and obtain information via the readCsv(), displayAjaxProductChangeAttr, displayAjaxProductAddToCart, getSearchProducts, and displayAjaxProductSku methods.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://security.friendsofpresta.org/modules/2024/03/12/quickproducttable.html; https://security.friendsofpresta.org/modules/2024/03/12/quickproducttable.html
CVE: CVE-2024-0311
Published: 2024-03-14
Description: A malicious insider can bypass the existing policy of Skyhigh Client Proxy without a valid release code.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-622
References: https://kcm.trellix.com/corporate/index?page=content&id=SB10418; https://kcm.trellix.com/corporate/index?page=content&id=SB10418
CVE: CVE-2024-0312
Published: 2024-03-14
Description: A malicious insider can uninstall Skyhigh Client Proxy without a valid uninstall password.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-622
References: https://kcm.trellix.com/corporate/index?page=content&id=SB10418; https://kcm.trellix.com/corporate/index?page=content&id=SB10418
CVE: CVE-2024-0313
Published: 2024-03-14
Description: A malicious insider exploiting this vulnerability can circumvent existing security controls put in place by the organization. On the contrary, if the victim is legitimately using the temporary bypass to reach out to the Internet for retrieving application and system updates, a remote device could target it and undo the bypass, thereby denying the victim access to the update service, causing it to fail. 
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-670
References: https://kcm.trellix.com/corporate/index?page=content&id=SB10418; https://kcm.trellix.com/corporate/index?page=content&id=SB10418
CVE: CVE-2024-27986
Published: 2024-03-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh Elementor Addons by Livemesh allows Stored XSS.This issue affects Elementor Addons by Livemesh: from n/a through 8.3.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/addons-for-elementor/wordpress-elementor-addons-by-livemesh-plugin-8-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/addons-for-elementor/wordpress-elementor-addons-by-livemesh-plugin-8-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-28746
Published: 2024-03-14
Description: Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. 

Users of Apache Airflow are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with this vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-281
References: http://www.openwall.com/lists/oss-security/2024/03/13/5; https://github.com/apache/airflow/pull/37881; https://lists.apache.org/thread/b4pffc7w7do6qgk4jjbyxvdz5odrvny7
CVE: CVE-2024-2437
Published: 2024-03-14
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-41728. Reason: This candidate is a reservation duplicate of CVE-2023-41728. Notes: All CVE users should reference CVE-2023-41728 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-2438
Published: 2024-03-14
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-47851. Reason: This candidate is a reservation duplicate of CVE-2023-47851. Notes: All CVE users should reference CVE-2023-47851 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-1623
Published: 2024-03-14
Description: Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the 'Login.asp and logout.asp' files do not handle session details correctly.
CVSS Score: 7.7 (HIGH)
CWE: CWE-613
References: https://www.incibe.es/en/incibe-cert/notices/aviso/insufficient-session-timeout-vulnerability-sagemcom-router; https://www.incibe.es/en/incibe-cert/notices/aviso/insufficient-session-timeout-vulnerability-sagemcom-router
CVE: CVE-2024-28383
Published: 2024-03-14
Description: Tenda AX12 v1.0 v22.03.01.16 was discovered to contain a stack overflow via the ssid parameter in the sub_431CF0 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://github.com/cvdyfbwa/IoT-Tenda-Router/blob/main/sub_431CF0.md; https://github.com/cvdyfbwa/IoT-Tenda-Router/blob/main/sub_431CF0.md
CVE: CVE-2024-28417
Published: 2024-03-14
Description: Webedition CMS 9.2.2.0 has a Stored XSS vulnerability via /webEdition/we_cmd.php.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-80
References: https://gitee.com/shavchen214/pwn/issues/I94VFH; https://gitee.com/shavchen214/pwn/issues/I94VFH
CVE: CVE-2024-28418
Published: 2024-03-14
Description: Webedition CMS 9.2.2.0 has a File upload vulnerability via /webEdition/we_cmd.php
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://gitee.com/shavchen214/pwn/issues/I94VI3; https://gitee.com/shavchen214/pwn/issues/I94VI3
CVE: CVE-2024-25156
Published: 2024-03-14
Description: 
A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web Clients.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.fortra.com/security/advisory/fi-2024-004; https://www.fortra.com/security/advisory/fi-2024-004
CVE: CVE-2024-28323
Published: 2024-03-14
Description: The bwdates-report-result.php file in Phpgurukul User Registration & Login and User Management System 3.1 contains a potential security vulnerability related to user input validation. The script retrieves user-provided date inputs without proper validation, making it susceptible to SQL injection attacks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://packetstormsecurity.com/files/177168/User-Registration-And-Login-And-User-Management-System-3.1-SQL-Injection.html; https://sospiro014.github.io/User-Registration-And-Login-And-User-Management-System-3.1-SQL-Injection; https://packetstormsecurity.com/files/177168/User-Registration-And-Login-And-User-Management-System-3.1-SQL-Injection.html
CVE: CVE-2023-50168
Published: 2024-03-14
Description: Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation.
CVSS Score: 7.7 (HIGH)
CWE: CWE-611, CWE-611
References: https://support.pega.com/support-doc/pega-security-advisory-a24-vulnerability-remediation-note; https://support.pega.com/support-doc/pega-security-advisory-a24-vulnerability-remediation-note
CVE: CVE-2024-25139
Published: 2024-03-14
Description: In TP-Link Omada er605 1.0.1 through (v2.6) 2.2.3, a cloud-brd binary is susceptible to an integer overflow that leads to a heap-based buffer overflow. After heap shaping, an attacker can achieve code execution in the context of the cloud-brd binary that runs at the root level. This is fixed in ER605(UN)_v2_2.2.4 Build 020240119.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-120
References: https://github.com/microsoft/Microsoft-TP-Link-Research-Team; https://www.tp-link.com/us/omada-sdn/; https://github.com/microsoft/Microsoft-TP-Link-Research-Team
CVE: CVE-2023-22655
Published: 2024-03-14
Description: Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-693
References: https://lists.debian.org/debian-lts-announce/2024/05/msg00003.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html
CVE: CVE-2023-27502
Published: 2024-03-14
Description: Insertion of sensitive information into log file for some Intel(R) Local Manageability Service software before version 2316.5.1.2 may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 3.3 (LOW)
CWE: CWE-532
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00923.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00923.html
CVE: CVE-2023-28389
Published: 2024-03-14
Description: Incorrect default permissions in some Intel(R) CSME installer software before version 2328.5.5.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00923.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00923.html
CVE: CVE-2023-28746
Published: 2024-03-14
Description: Information exposure through microarchitectural state after transient execution from some register files for some Intel(R) Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1342
References: http://www.openwall.com/lists/oss-security/2024/03/12/13; https://lists.debian.org/debian-lts-announce/2024/05/msg00003.html; https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
CVE: CVE-2023-32282
Published: 2024-03-14
Description: Race condition in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-367
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00929.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00929.html
CVE: CVE-2023-32633
Published: 2024-03-14
Description: Improper input validation in the Intel(R) CSME installer software before version 2328.5.5.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00923.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00923.html
CVE: CVE-2023-32666
Published: 2024-03-14
Description: On-chip debug and test interface with improper access control in some 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-1191
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00986.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-35191
Published: 2024-03-14
Description: Uncontrolled resource consumption for some Intel(R) SPS firmware versions may allow a privileged user to potentially enable denial of service via network access.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-400
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00923.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-38575
Published: 2024-03-14
Description: Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1303
References: https://lists.debian.org/debian-lts-announce/2024/05/msg00003.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00982.html