rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-38735 IBM Cognos Dashboards improper authentication
IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a victim to a phishing site.  IBM X-Force ID:  262482.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: IBM
product: Cognos Dashboards on Cloud Pak for Data
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
version: 3.1
Published: 2023-10-22T01:05:02.599Z
CVE-2023-38736 IBM QRadar WinCollect Agent privilege escalation
IBM QRadar WinCollect Agent 10.0 through 10.1.6, when installed to run as ADMIN or SYSTEM, is vulnerable to a local escalation of privilege attack that a normal user could utilize to gain SYSTEM permissions.  IBM X-Force ID:  262542.
Problem types: description: 264 Permissions, Privileges, Access Controls
Affected products: vendor: IBM
product: QRadar WinCollect Agent
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-09-08T18:49:24.176Z
CVE-2023-38737 IBM WebSphere Application Server Liberty denial of service
IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.  IBM X-Force ID:  262567.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: IBM
product: WebSphere Application Server Liberty
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-08-16T18:07:30.569Z
CVE-2023-38738 IBM OpenPages with Watson information disclosure

IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in a OpenPages environment using Native authentication. If OpenPages is using Native authentication an attacker with access to the OpenPages database could through a series of specially crafted steps could exploit this weakness and gain unauthorized access to other OpenPages accounts. IBM X-Force ID: 262594.


Problem types: cwe_id: CWE-257
description: CWE-257 Storing Passwords in a Recoverable Format
Affected products: vendor: IBM
product: OpenPages with Watson
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2024-01-19T00:41:22.409Z
CVE-2023-38739 IBM Sterling B2B Integrator cross-site request forgery
IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: IBM
product: Sterling B2B Integrator
cpes: cpe:2.3:a:ibm:sterling_b2b_integrator:6.0.0.0:*:*:*:standard:*:*:*
cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.2.5:*:*:*:standard:*:*:*
cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.0:*:*:*:standard:*:*:*
cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.3:*:*:*:standard:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2025-01-31T15:19:20.155Z
CVE-2023-38740 IBM Db2 denial of service
IBM Db2 for Linux, UNIX, and Windows (includes Db2 Connect Server) 11.5 is vulnerable to a denial of service with a specially crafted SQL statement.  IBM X-Force ID:  262613.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: IBM
product: Db2 for Linux, UNIX and Windows
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-10-16T21:24:15.155Z
CVE-2023-38741 IBM TXSeries for Multiplatforms denial of service

IBM TXSeries for Multiplatforms 8.1, 8.2, and 9.1 is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting a slowloris-type attacks, a remote attacker could exploit this vulnerability to cause a denial of service. IBM X-Force ID: 262905.


Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: IBM
product: TXSeries for Multiplatforms
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-08-14T17:19:00.370Z
CVE-2023-38743 
Zoho ManageEngine ADManager Plus before Build 7200 allows admin users to execute commands on the host machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-11T00:00:00.000Z
CVE-2023-38744 
Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2 CPU unit and the communication function of the CS/CJ Series EtherNet/IP unit. If an affected product receives a packet which is specially crafted by a remote unauthenticated attacker, the unit of the affected product may fall into a denial-of-service (DoS) condition. Affected products/versions are as follows: CJ2M CPU Unit CJ2M-CPU3[] Unit version of the built-in EtherNet/IP section Ver. 2.18 and earlier, CJ2H CPU Unit CJ2H-CPU6[]-EIP Unit version of the built-in EtherNet/IP section Ver. 3.04 and earlier, CS/CJ Series EtherNet/IP Unit CS1W-EIP21 V3.04 and earlier, and CS/CJ Series EtherNet/IP Unit CJ1W-EIP21 V3.04 and earlier.
Problem types: description: Denial-of-service (DoS)
Affected products: vendor: OMRON Corporation
product: CJ2M CPU Unit
vendor: OMRON Corporation
product: CJ2H CPU Unit
vendor: OMRON Corporation
product: CS/CJ Series EtherNet/IP Unit
vendor: OMRON Corporation
product: CS/CJ Series EtherNet/IP Unit
Published: 2023-08-03T04:55:52.423Z
CVE-2023-38745 
Pandoc before 3.1.6 allows arbitrary file write: this can be triggered by providing a crafted image element in the input when generating files via the --extract-media option or outputting to PDF format. This allows an attacker to create or overwrite arbitrary files, depending on the privileges of the process running Pandoc. It only affects systems that pass untrusted user input to Pandoc and allow Pandoc to be used to produce a PDF or with the --extract-media option. NOTE: this issue exists because of an incomplete fix for CVE-2023-35936 (failure to properly account for double encoded path names).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-25T00:00:00.000Z
CVE-2023-38746 
Out-of-bounds read vulnerability/issue exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.
Problem types: description: Out-of-bounds read
Affected products: vendor: OMRON Corporation
product: CX-Programmer
Published: 2023-08-03T04:58:30.228Z
CVE-2023-38747 
Heap-based buffer overflow vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.
Problem types: description: Heap-based buffer overflow
Affected products: vendor: OMRON Corporation
product: CX-Programmer
Published: 2023-08-03T05:00:34.672Z
CVE-2023-38748 
Use after free vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.
Problem types: description: Use after free
Affected products: vendor: OMRON Corporation
product: CX-Programmer
Published: 2023-08-03T05:09:16.186Z
CVE-2023-38750 
In Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, internal JSP and XML files can be exposed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-31T00:00:00.000Z
CVE-2023-38751 
Improper authorization vulnerability in Special Interest Group Network for Analysis and Liaison versions 4.4.0 to 4.7.7 allows the authorized API users to view the organization information of the information receiver that is set as "non-disclosure" in the information provision operation.
Problem types: description: Improper authorization
Affected products: vendor:  Japan Computer Emergency Response Team Coordination Center (JPCERT/CC)
product: Special Interest Group Network for Analysis and Liaison
Published: 2023-08-09T03:29:37.666Z
CVE-2023-38752 
Improper authorization vulnerability in Special Interest Group Network for Analysis and Liaison versions 4.4.0 to 4.7.7 allows the authorized API users to view the attribute information of the poster that is set as"non-disclosure" in the system settings.
Problem types: description: Improper authorization
Affected products: vendor: Japan Computer Emergency Response Team Coordination Center (JPCERT/CC)
product: Special Interest Group Network for Analysis and Liaison 
Published: 2023-08-09T03:29:51.888Z
CVE-2023-38758 
Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the license_author field in the add-ingredient function in the templates/ingredients/view.html, models/ingredients.py, and views/ingredients.py components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-08T00:00:00.000Z
CVE-2023-38759 
Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/reset_user_password.html, templates/user/overview.html, core/views/user.py, and templates/user/preferences.html, core/forms.py components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-08T00:00:00.000Z
CVE-2023-38760 
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the role and gender parameters within the /QueryView.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-08T00:00:00.000Z
CVE-2023-38761 
Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the systemSettings.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-08T00:00:00.000Z
CVE-2023-38762 
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the friendmonths parameter within the /QueryView.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-08T00:00:00.000Z
CVE-2023-38763 
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the FundRaiserID parameter within the /FundRaiserEditor.php endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-08T00:00:00.000Z
CVE-2023-38764 
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the birthmonth and percls parameters within the /QueryView.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-08T00:00:00.000Z
CVE-2023-38765 
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the membermonth parameter within the /QueryView.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-08T00:00:00.000Z
CVE-2023-38766 
Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the PersonView.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-08T00:00:00.000Z
CVE-2023-38767 
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the 'value' and 'custom' parameters within the /QueryView.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-08T00:00:00.000Z
CVE-2023-38768 
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the PropertyID parameter within the /QueryView.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-08T00:00:00.000Z
CVE-2023-38769 
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the searchstring and searchwhat parameters within the /QueryView.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-08T00:00:00.000Z
CVE-2023-38770 
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the group parameter within the /QueryView.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-08T00:00:00.000Z
CVE-2023-38771 
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp parameter within the /QueryView.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-08T00:00:00.000Z
CVE-2023-38773 
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp1 and volopp2 parameters within the /QueryView.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-08T00:00:00.000Z
CVE-2023-38802 
FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-29T00:00:00.000Z
CVE-2023-38817 
An issue in Inspect Element Ltd Echo.ac v.5.2.1.0 allows a local attacker to gain privileges via a crafted command to the echo_driver.sys component. NOTE: the vendor's position is that the reported ability for user-mode applications to execute code as NT AUTHORITY\SYSTEM was "deactivated by Microsoft itself."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-11T00:00:00.000Z
CVE-2023-38823 
Buffer Overflow vulnerability in Tenda Ac19 v.1.0, AC18, AC9 v.1.0, AC6 v.2.0 and v.1.0 allows a remote attacker to execute arbitrary code via the formSetCfm function in bin/httpd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-20T00:00:00.000Z
CVE-2023-38825 
SQL injection vulnerability in Vanderbilt REDCap before v.13.8.0 allows a remote attacker to obtain sensitive information via the password reset mechanism in MyCapMobileApp/update.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-06T00:00:00.000Z
CVE-2023-38826 
A Cross Site Scripting (XSS) vulnerability exists in Follet Learning Solutions Destiny through 20.0_1U. via the handlewpesearchform.do. searchString.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-25T00:00:00.000Z
CVE-2023-38827 
Cross Site Scripting vulnerability in Follet School Solutions Destiny v.20_0_1_AU4 and later allows a remote attacker to run arbitrary code via presentonesearchresultsform.do.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-09T00:00:00.000Z
CVE-2023-38829 
An issue in NETIS SYSTEMS WF2409E v.3.6.42541 allows a remote attacker to execute arbitrary code via the ping and traceroute functions of the diagnostic tools component in the admin management interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-11T00:00:00.000Z
CVE-2023-38830 
An information leak in PHPJabbers Yacht Listing Script v1.0 allows attackers to export clients' credit card numbers from the Reservations module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-10T00:00:00.000Z
CVE-2023-38831 
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-23T00:00:00.000Z
CVE-2023-38836 
File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-21T00:00:00.000Z
CVE-2023-38838 
SQL injection vulnerability in Kidus Minimati v.1.0.0 allows a remote attacker to obtain sensitive information via the edit.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-17T00:00:00.000Z
CVE-2023-38839 
SQL injection vulnerability in Kidus Minimati v.1.0.0 allows a remote attacker to obtain sensitive information via theID parameter in the fulldelete.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-18T00:00:00.000Z
CVE-2023-38840 
Bitwarden Desktop 2023.7.0 and below allows an attacker with local access to obtain sensitive information via the Bitwarden.exe process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-38843 
An issue in Atlos v.1.0 allows an authenticated attacker to execute arbitrary code via a crafted payload into the description field in the incident function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-17T00:00:00.000Z
CVE-2023-38844 
SQL injection vulnerability in PMB v.7.4.7 and earlier allows a remote attacker to execute arbitrary code via the thesaurus parameter in export_skos.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-21T00:00:00.000Z
CVE-2023-38845 
An issue in Anglaise Company Anglaise.Company v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-38846 
An issue in Marbre Lapin Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-38847 
An issue in CHRISTINA JAPAN Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-38848 
An issue in rmc R Beauty CLINIC Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-38849 
An issue in tire-sales Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-38850 
Buffer Overflow vulnerability in Michaelrsweet codedoc v.3.7 allows an attacker to cause a denial of service via the codedoc.c:1742 comppnent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-38851 
Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the xls_parseWorkBook function in xls.c:1018.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-38852 
Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the unicode_decode_wcstombs function in xlstool.c:266.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-38853 
Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the xls_parseWorkBook function in xls.c:1015.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-38854 
Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the transcode_latin1_to_utf8 function in xlstool.c:296.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-38855 
Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the get_string function in xlstool.c:395.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-38856 
Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the get_string function in xlstool.c:411.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-38857 
Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the stcoin function in mp4read.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z