deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-49092
Published: 2023-11-28
Description: RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. There is currently no fix available. As a workaround, avoid using the RSA crate in settings where attackers are able to observe timing information, e.g. local use on a non-compromised computer.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-385, CWE-203
References: https://github.com/RustCrypto/RSA/issues/19#issuecomment[PII_REDACTED]; https://github.com/RustCrypto/RSA/security/advisories/GHSA-c38w-74pg-36hr; https://github.com/RustCrypto/RSA/issues/19#issuecomment[PII_REDACTED]
CVE: CVE-2023-46944
Published: 2023-11-28
Description: An issue in GitKraken GitLens before v.14.0.0 allows an attacker to execute arbitrary code via a crafted file to the Visual Studio Codes workspace trust component.
CVSS Score: 7.8 (HIGH)
References: https://github.com/gitkraken/vscode-gitlens/commit/ee2a0c42a92d33059a39fd15fbbd5dd3d5ab6440; https://www.sonarsource.com/blog/vscode-security-markdown-vulnerabilities-in-extensions/; https://github.com/gitkraken/vscode-gitlens/commit/ee2a0c42a92d33059a39fd15fbbd5dd3d5ab6440
CVE: CVE-2023-23324
Published: 2023-11-29
Description: Zumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain hardcoded credentials for the Administrator account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://zumtobel.com; https://yoroi.company/en/research/cve-advisory-partial-disclosure-zumtobel-multiple-vulnerabilities/; http://zumtobel.com
CVE: CVE-2023-23325
Published: 2023-11-29
Description: Zumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain a command injection vulnerability via the NetHostname parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://zumtobel.com; https://yoroi.company/en/research/cve-advisory-partial-disclosure-zumtobel-multiple-vulnerabilities/; http://zumtobel.com
CVE: CVE-2023-24294
Published: 2023-11-29
Description: Zumtobel Netlink CCD Onboard v3.74 - Firmware v3.80 was discovered to contain a buffer overflow via the component NetlinkWeb::Information::SetDeviceIdentification.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://zumtobel.com; https://yoroi.company/en/research/cve-advisory-partial-disclosure-zumtobel-multiple-vulnerabilities/; http://zumtobel.com
CVE: CVE-2023-46886
Published: 2023-11-29
Description: Dreamer CMS before version 4.0.1 is vulnerable to Directory Traversal. Background template management allows arbitrary modification of the template file, allowing system sensitive files to be read.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://gitee.com/iteachyou/dreamer_cms/issues/I6NOFN; https://gitee.com/iteachyou/dreamer_cms/issues/I6NOFN
CVE: CVE-2023-46887
Published: 2023-11-29
Description: In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-494
References: https://gitee.com/iteachyou/dreamer_cms/issues/I6NDEZ; https://gitee.com/iteachyou/dreamer_cms/issues/I6NDEZ
CVE: CVE-2023-47462
Published: 2023-11-29
Description: Insecure Permissions vulnerability in GL.iNet AX1800 v.3.215 and before allows a remote attacker to execute arbitrary code via the file sharing function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary%20File%20Read%20through%20file%20share.md; https://github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary%20File%20Read%20through%20file%20share.md
CVE: CVE-2023-45479
Published: 2023-11-29
Description: Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the list parameter in the function sub_49E098.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/l3m0nade/IOTvul/blob/master/assets/sub_49E098_code.png; https://github.com/l3m0nade/IOTvul/blob/master/sub_49E098.md; https://github.com/l3m0nade/IOTvul/blob/master/assets/sub_49E098_code.png
CVE: CVE-2023-45480
Published: 2023-11-29
Description: Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the src parameter in the function sub_47D878.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/l3m0nade/IOTvul/blob/master/assets/sub_47d878_code.png; https://github.com/l3m0nade/IOTvul/blob/master/sub_47D878.md; https://github.com/l3m0nade/IOTvul/blob/master/assets/sub_47d878_code.png
CVE: CVE-2023-45481
Published: 2023-11-29
Description: Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the firewallEn parameter in the function SetFirewallCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://github.com/l3m0nade/IOTvul/blob/master/SetFirewallCfg.md; https://github.com/l3m0nade/IOTvul/blob/master/assets/setFirewallCfg_code.png; https://github.com/l3m0nade/IOTvul/blob/master/SetFirewallCfg.md
CVE: CVE-2023-45482
Published: 2023-11-29
Description: Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the urls parameter in the function get_parentControl_list_Info.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/l3m0nade/IOTvul/blob/master/assets/get_parentControl_list_Info_code.png; https://github.com/l3m0nade/IOTvul/blob/master/get_parentControl_list_Info.md; https://github.com/l3m0nade/IOTvul/blob/master/assets/get_parentControl_list_Info_code.png
CVE: CVE-2023-45483
Published: 2023-11-29
Description: Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the time parameter in the function compare_parentcontrol_time.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/l3m0nade/IOTvul/blob/master/assets/compare_parentcontrol_time_code.png; https://github.com/l3m0nade/IOTvul/blob/master/compare_parentcontrol_time.md; https://github.com/l3m0nade/IOTvul/blob/master/assets/compare_parentcontrol_time_code.png
CVE: CVE-2023-45484
Published: 2023-11-29
Description: Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the shareSpeed parameter in the function fromSetWifiGuestBasic.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/l3m0nade/IOTvul/blob/master/assets/fromSetWifiGuestBasic_code.png; https://github.com/l3m0nade/IOTvul/blob/master/fromSetWifiGusetBasic.md; https://github.com/l3m0nade/IOTvul/blob/master/assets/fromSetWifiGuestBasic_code.png
CVE: CVE-2023-6070
Published: 2023-11-29
Description: 
A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary content, potentially altering configuration. This is possible through the certificate validation functionality where the API accepts uploaded content and doesn't parse for invalid data


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://kcm.trellix.com/corporate/index?page=content&id=SB10413; https://kcm.trellix.com/corporate/index?page=content&id=SB10413
CVE: CVE-2023-6345
Published: 2023-11-29
Description: Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-190, CWE-190
References: https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html; https://crbug.com/1505053; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T7ABNYMOI4ZHVCSPCNP7HQTOLGF53A2/
CVE: CVE-2023-6346
Published: 2023-11-29
Description: Use after free in WebAudio in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html; https://crbug.com/1500856; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T7ABNYMOI4ZHVCSPCNP7HQTOLGF53A2/
CVE: CVE-2023-6347
Published: 2023-11-29
Description: Use after free in Mojo in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html; https://crbug.com/1494461; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T7ABNYMOI4ZHVCSPCNP7HQTOLGF53A2/
CVE: CVE-2023-6348
Published: 2023-11-29
Description: Type Confusion in Spellcheck in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: http://packetstormsecurity.com/files/176368/Chrome-BindTextSuggestionHostForFrame-Type-Confusion.html; https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html; https://crbug.com/1491459
CVE: CVE-2023-6350
Published: 2023-11-29
Description: Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted avif file. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html; https://crbug.com/1501766; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T7ABNYMOI4ZHVCSPCNP7HQTOLGF53A2/
CVE: CVE-2023-6351
Published: 2023-11-29
Description: Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted avif file. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html; https://crbug.com/1501770; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T7ABNYMOI4ZHVCSPCNP7HQTOLGF53A2/
CVE: CVE-2023-6378
Published: 2023-11-29
Description: A serialization vulnerability in logback receiver component part of 
logback version 1.4.11 allows an attacker to mount a Denial-Of-Service 
attack by sending poisoned data.


CVSS Score: 7.1 (HIGH)
CWE: CWE-502
References: https://logback.qos.ch/news.html#1.3.12; https://logback.qos.ch/news.html#1.3.12; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-40626
Published: 2023-11-29
Description: The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information.
CVSS Score: 7.5 (HIGH)
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-exposure-of-environment-variables.html; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-exposure-of-environment-variables.html
CVE: CVE-2023-49652
Published: 2023-11-29
Description: Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier allow attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate system-scoped credentials IDs of credentials stored in Jenkins and to connect to Google Cloud Platform using attacker-specified credentials IDs obtained through another method, to obtain information about existing projects. This fix has been backported to 4.3.17.1.
CVSS Score: 2.7 (LOW)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2023/11/29/1; https://www.jenkins.io/security/advisory/2023-11-29/#SECURITY-2835; http://www.openwall.com/lists/oss-security/2023/11/29/1
CVE: CVE-2023-49653
Published: 2023-11-29
Description: Jenkins Jira Plugin 3.11 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2023/11/29/1; https://www.jenkins.io/security/advisory/2023-11-29/#SECURITY-3225; http://www.openwall.com/lists/oss-security/2023/11/29/1
CVE: CVE-2023-49654
Published: 2023-11-29
Description: Missing permission checks in Jenkins MATLAB Plugin 2.11.0 and earlier allow attackers to have Jenkins parse an XML file from the Jenkins controller file system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2023/11/29/1; https://www.jenkins.io/security/advisory/2023-11-29/#SECURITY-3193; http://www.openwall.com/lists/oss-security/2023/11/29/1
CVE: CVE-2023-49655
Published: 2023-11-29
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins MATLAB Plugin 2.11.0 and earlier allows attackers to have Jenkins parse an XML file from the Jenkins controller file system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2023/11/29/1; https://www.jenkins.io/security/advisory/2023-11-29/#SECURITY-3193; http://www.openwall.com/lists/oss-security/2023/11/29/1
CVE: CVE-2023-49656
Published: 2023-11-29
Description: Jenkins MATLAB Plugin 2.11.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2023/11/29/1; https://www.jenkins.io/security/advisory/2023-11-29/#SECURITY-3193; http://www.openwall.com/lists/oss-security/2023/11/29/1
CVE: CVE-2023-49673
Published: 2023-11-29
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.openwall.com/lists/oss-security/2023/11/29/1; https://www.jenkins.io/security/advisory/2023-11-29/#SECURITY-3256; http://www.openwall.com/lists/oss-security/2023/11/29/1
CVE: CVE-2023-49674
Published: 2023-11-29
Description: A missing permission check in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2023/11/29/1; https://www.jenkins.io/security/advisory/2023-11-29/#SECURITY-3256; http://www.openwall.com/lists/oss-security/2023/11/29/1
CVE: CVE-2023-49090
Published: 2023-11-29
Description: CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed. This issue has been patched in versions 2.2.5 and 3.0.5.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/carrierwaveuploader/carrierwave/commit/39b282db5c1303899b3d3381ce8a837840f983b5; https://github.com/carrierwaveuploader/carrierwave/commit/863d425c76eba12c3294227b39018f6b2dccbbf3; https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-gxhx-g4fq-49hj
CVE: CVE-2023-48880
Published: 2023-11-29
Description: A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu Name field at /login.php?m=admin&c=Index&a=changeTableVal&_ajax=1&lang=cn.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/weng-xianhu/eyoucms/issues/52; https://github.com/weng-xianhu/eyoucms/issues/52
CVE: CVE-2023-48881
Published: 2023-11-29
Description: A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field Title field at /login.php?m=admin&c=Field&a=arctype_add&_ajax=1&lang=cn.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/weng-xianhu/eyoucms/issues/53; https://github.com/weng-xianhu/eyoucms/issues/53
CVE: CVE-2023-48882
Published: 2023-11-29
Description: A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Document Properties field at /login.php m=admin&c=Index&a=changeTableVal&_ajax=1&lang=cn.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/weng-xianhu/eyoucms/issues/54; https://github.com/weng-xianhu/eyoucms/issues/54
CVE: CVE-2023-6217
Published: 2023-11-29
Description: 
In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerability has been identified when MOVEit Gateway is used in conjunction with MOVEit Transfer.  

An attacker could craft a malicious payload targeting the system which comprises a MOVEit Gateway and MOVEit Transfer deployment.  If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victim’s browser.

CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-November-2023; https://www.progress.com/moveit; https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-November-2023
CVE: CVE-2023-6218
Published: 2023-11-29
Description: 
In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with group administrators has been identified.  It is possible for a group administrator to elevate a group members permissions to the role of an organization administrator.

CVSS Score: 7.2 (HIGH)
CWE: CWE-269, CWE-269
References: https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-November-2023; https://www.progress.com/moveit; https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-November-2023
CVE: CVE-2023-49079
Published: 2023-11-29
Description: Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. This issue has been patched in version 2023.11.1-beta.1.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-347
References: https://github.com/misskey-dev/misskey/security/advisories/GHSA-3f39-6537-3cgc; https://github.com/misskey-dev/misskey/security/advisories/GHSA-3f39-6537-3cgc
CVE: CVE-2023-49083
Published: 2023-11-29
Description: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476
References: https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a; https://github.com/pyca/cryptography/pull/9926; https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97
CVE: CVE-2023-44383
Published: 2023-11-29
Description: October is a Content Management System (CMS) and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This issue has been patched in version 3.5.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/octobercms/october/commit/b7eed0bbf54d07ff310fcdc7037a8e8bf1f5043b; https://github.com/octobercms/october/security/advisories/GHSA-rvx8-p3xp-fj3p; https://github.com/octobercms/october/commit/b7eed0bbf54d07ff310fcdc7037a8e8bf1f5043b
CVE: CVE-2023-48945
Published: 2023-11-29
Description: A stack overflow in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/openlink/virtuoso-opensource/issues/1172; https://github.com/openlink/virtuoso-opensource/issues/1172
CVE: CVE-2023-48946
Published: 2023-11-29
Description: An issue in the box_mpy function of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement.
CVSS Score: 7.5 (HIGH)
References: https://github.com/openlink/virtuoso-opensource/issues/1178; https://github.com/openlink/virtuoso-opensource/issues/1178
CVE: CVE-2023-48947
Published: 2023-11-29
Description: An issue in the cha_cmp function of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement.
CVSS Score: 7.5 (HIGH)
References: https://github.com/openlink/virtuoso-opensource/issues/1179; https://github.com/openlink/virtuoso-opensource/issues/1179
CVE: CVE-2023-48948
Published: 2023-11-29
Description: An issue in the box_div function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement.
CVSS Score: 7.5 (HIGH)
References: https://github.com/openlink/virtuoso-opensource/issues/1176; https://github.com/openlink/virtuoso-opensource/issues/1176
CVE: CVE-2023-48949
Published: 2023-11-29
Description: An issue in the box_add function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement.
CVSS Score: 7.5 (HIGH)
References: https://github.com/openlink/virtuoso-opensource/issues/1173; https://github.com/openlink/virtuoso-opensource/issues/1173
CVE: CVE-2023-48950
Published: 2023-11-29
Description: An issue in the box_col_len function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement.
CVSS Score: 7.5 (HIGH)
References: https://github.com/openlink/virtuoso-opensource/issues/1174; https://github.com/openlink/virtuoso-opensource/issues/1174
CVE: CVE-2023-48951
Published: 2023-11-29
Description: An issue in the box_equal function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/openlink/virtuoso-opensource/issues/1177; https://github.com/openlink/virtuoso-opensource/issues/1177
CVE: CVE-2023-48952
Published: 2023-11-29
Description: An issue in the box_deserialize_reusing function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502, CWE-502
References: https://github.com/openlink/virtuoso-opensource/issues/1175; https://github.com/openlink/virtuoso-opensource/issues/1175