rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-3753 Creativeitem Mastery LMS browse cross site scripting
A vulnerability classified as problematic has been found in Creativeitem Mastery LMS 1.2. This affects an unknown part of the file /browse. The manipulation of the argument search/featured/recommended/skill leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-234423. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: Creativeitem
product: Mastery LMS
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: skalvin (VulDB User)
Published: 2023-07-19T02:00:06.762Z
CVE-2023-3754 Creativeitem Ekushey Project Manager CRM xxxxxxxx[random-msg-hash] cross site scripting
A vulnerability, which was classified as problematic, was found in Creativeitem Ekushey Project Manager CRM 5.0. Affected is an unknown function of the file /index.php/client/message/message_read/xxxxxxxx[random-msg-hash]. The manipulation of the argument message leads to cross site scripting. It is possible to launch the attack remotely. VDB-234426 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: Creativeitem
product: Ekushey Project Manager CRM
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: skalvin (VulDB User)
Published: 2023-07-19T03:00:05.454Z
CVE-2023-3755 Creativeitem Atlas Business Directory Listing filter_listings cross site scripting
A vulnerability has been found in Creativeitem Atlas Business Directory Listing 2.13 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /home/filter_listings. The manipulation of the argument price-range leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-234427. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: Creativeitem
product: Atlas Business Directory Listing
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Published: 2023-07-19T03:31:03.904Z
CVE-2023-3756 Creativeitem Atlas Business Directory Listing search cross site scripting
A vulnerability was found in Creativeitem Atlas Business Directory Listing 2.13 and classified as problematic. Affected by this issue is some unknown functionality of the file /home/search. The manipulation of the argument search_string leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-234428. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: Creativeitem
product: Atlas Business Directory Listing
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: skalvin (VulDB User)
Published: 2023-07-19T04:00:04.066Z
CVE-2023-3757 GZ Scripts Car Rental Script cross site scripting
A vulnerability classified as problematic has been found in GZ Scripts Car Rental Script 1.8. Affected is an unknown function of the file /EventBookingCalendar/load.php?controller=GzFront/action=checkout/cid=1/layout=calendar/show_header=T/local=3. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-234432. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: GZ Scripts
product: Car Rental Script
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: skalvin (VulDB User)
Published: 2023-07-19T04:31:03.319Z
CVE-2023-3758 Sssd: race condition during authorization leads to gpo policies functioning inconsistently
A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.
Problem types: cwe_id: CWE-362
description: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:enterprise_linux:8::crb
cpe:/o:redhat:enterprise_linux:8::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:enterprise_linux:8::crb
cpe:/o:redhat:enterprise_linux:8::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Extended Update Support
cpes: cpe:/o:redhat:rhev_hypervisor:4.4::el8
cpe:/a:redhat:rhel_eus:8.6::crb
cpe:/o:redhat:rhel_eus:8.6::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.8 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:8.8::crb
cpe:/o:redhat:rhel_eus:8.8::baseos
cpe:/a:redhat:rhel_eus:8.8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::crb
cpe:/o:redhat:enterprise_linux:9::baseos
cpe:/a:redhat:enterprise_linux:9::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::crb
cpe:/o:redhat:enterprise_linux:9::baseos
cpe:/a:redhat:enterprise_linux:9::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.0 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:9.0::crb
cpe:/o:redhat:rhel_eus:9.0::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.2 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:9.2::appstream
cpe:/o:redhat:rhel_eus:9.2::baseos
cpe:/a:redhat:rhel_eus:9.2::crb
default_status: affected
vendor: Red Hat
product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:rhev_hypervisor:4.4::el8
cpe:/a:redhat:rhel_eus:8.6::crb
cpe:/o:redhat:rhel_eus:8.6::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unknown
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-04-18T19:06:44.216Z
CVE-2023-3759 Intergard SGS permission
A vulnerability, which was classified as critical, was found in Intergard SGS 8.7.0. Affected is an unknown function. The manipulation leads to permission issues. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-234444. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-275
description: CWE-275 Permission Issues
Affected products: vendor: Intergard
product: SGS
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: hiagomoura (VulDB User)
Published: 2023-07-19T05:00:04.934Z
CVE-2023-3760 Intergard SGS Change Password denial of service
A vulnerability has been found in Intergard SGS 8.7.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Change Password Handler. The manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-234445 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-404
description: CWE-404 Denial of Service
Affected products: vendor: Intergard
product: SGS
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: hiagomoura (VulDB User)
Published: 2023-07-19T05:31:03.867Z
CVE-2023-3761 Intergard SGS Password Change cleartext transmission
A vulnerability was found in Intergard SGS 8.7.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Password Change Handler. The manipulation leads to cleartext transmission of sensitive information. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. VDB-234446 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: Intergard
product: SGS
CVSS v3.1: version: 3.1
baseScore: 3.7
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
baseSeverity: LOW
Credits: lang: en
value: hiagomoura (VulDB User)
Published: 2023-07-19T06:00:04.545Z
CVE-2023-3762 Intergard SGS sensitive information in memory
A vulnerability was found in Intergard SGS 8.7.0. It has been classified as problematic. This affects an unknown part. The manipulation leads to cleartext storage of sensitive information in memory. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-234447. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-316
description: CWE-316 Cleartext Storage of Sensitive Information in Memory
Affected products: vendor: Intergard
product: SGS
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: hiagomoura (VulDB User)
Published: 2023-07-19T06:31:03.558Z
CVE-2023-3763 Intergard SGS SQL Query cleartext transmission
A vulnerability was found in Intergard SGS 8.7.0. It has been declared as problematic. This vulnerability affects unknown code of the component SQL Query Handler. The manipulation leads to cleartext transmission of sensitive information. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-234448. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: Intergard
product: SGS
CVSS v3.1: version: 3.1
baseScore: 3.7
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
baseSeverity: LOW
Credits: lang: en
value: hiagomoura (VulDB User)
Published: 2023-07-19T07:00:05.033Z
CVE-2023-3764 WooCommerce PDF Invoice Builder <= 1.2.90 - Cross-Site Request Forgery via Save
The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.90. This is due to missing or incorrect nonce validation on the Save function. This makes it possible for unauthenticated attackers to make changes to invoices via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: edgarrojas
product: PDF Builder for WooCommerce. Create invoices,packing slips and more
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Marco Wotschka
Published: 2023-08-31T05:33:14.499Z
CVE-2023-3765 Absolute Path Traversal in mlflow/mlflow
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
Problem types: cwe_id: CWE-36
description: CWE-36 Absolute Path Traversal
Affected products: vendor: mlflow
product: mlflow/mlflow
Published: 2023-07-19T00:53:33.969Z
CVE-2023-3766 Invalid Slice Split Results in Server Panic
A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue specifically occurs when processing encrypted query data received from remote clients and enables an attacker with knowledge of this vulnerability to craft and send specially designed encrypted queries to targeted ODOH servers running with odoh-rs. Upon successful exploitation, the server will crash abruptly, disrupting its normal operation and rendering the service temporarily unavailable.


Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Cloudflare
product: odoh-rs
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: 00xc
Published: 2023-08-03T13:49:46.751Z
CVE-2023-3767 OS command injection on  EasyPHP  Webserver 
An OS command injection vulnerability has been found on EasyPHP  Webserver affecting version 14.1. This vulnerability could allow an attacker to get full access to the system by sending a specially crafted exploit to the /index.php?zone=settings parameter. 
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: EasyPHP
product: Webserver
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Rafael Pedrero
Published: 2023-09-26T07:51:36.754Z
CVE-2023-3768 Vulnerability in Ingeteam's INGEPAC EF/DA
Incorrect data input validation vulnerability, which could allow an attacker with access to the network to implement fuzzing techniques that would allow him to gain knowledge about specially crafted packets that would create a DoS condition through the MMS protocol when initiating communication, achieving a complete system reboot of the device and its services.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Ingeteam
product: INGEPAC DA3451
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Aarón Flecha Menéndez and Gabriel Vía Echezarreta
Published: 2023-10-02T10:55:39.288Z
CVE-2023-3769 Vulnerability in Ingeteam's INGEPAC EF 
Incorrect data input validation vulnerability, which could allow an attacker with access to the network to implement fuzzing techniques that would allow him to gain knowledge about specially crafted packets that would create a DoS condition through the MMS protocol when initiating communication, achieving a complete system reboot of the device and its services.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Ingeteam
product: INGEPAC FC5066
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Aarón Flecha Menéndez and Gabriel Vía Echezarreta.
Published: 2023-10-02T13:01:03.985Z
CVE-2023-3770 Vulnerability in Ingeteam's INGEPAC DA

 Incorrect validation vulnerability of the data entered, allowing an attacker with access to the network on which the affected device is located to use the discovery port protocol (1925/UDP) to obtain device-specific information without the need for authentication.


Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Ingeteam
product: INGEPAC DA3451
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Aarón Flecha Menéndez and Gabriel Vía Echezarreta
Published: 2023-10-02T13:11:05.513Z
CVE-2023-3771 T1 theme <= 19.0 - Open Redirect
The T1 WordPress theme through 19.0 is vulnerable to unauthenticated open redirect with which any attacker and redirect users to arbitrary websites.
Problem types: description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Unknown
product: t1
default_status: affected
Credits: lang: en
value: Vishal Barot vFlexo
lang: en
value: WPScan
Published: 2024-01-16T15:54:04.782Z
CVE-2023-3772 Kernel: xfrm: null pointer dereference in xfrm_update_ae_params()
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service.
Problem types: cwe_id: CWE-476
description: NULL Pointer Dereference
Affected products: vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::realtime
cpe:/a:redhat:enterprise_linux:8::nfv
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8::baseos
cpe:/a:redhat:enterprise_linux:8::crb
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Extended Update Support
cpes: cpe:/o:redhat:rhel_eus:8.6::baseos
cpe:/a:redhat:rhel_eus:8.6::crb
cpe:/o:redhat:rhev_hypervisor:4.4::el8
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.8 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:8.8::crb
cpe:/o:redhat:rhel_eus:8.8::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::nfv
cpe:/o:redhat:enterprise_linux:9::baseos
cpe:/a:redhat:enterprise_linux:9::crb
cpe:/a:redhat:enterprise_linux:9::realtime
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::nfv
cpe:/o:redhat:enterprise_linux:9::baseos
cpe:/a:redhat:enterprise_linux:9::crb
cpe:/a:redhat:enterprise_linux:9::realtime
default_status: affected
vendor: Red Hat
product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:rhel_eus:8.6::baseos
cpe:/a:redhat:rhel_eus:8.6::crb
cpe:/o:redhat:rhev_hypervisor:4.4::el8
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Lin Ma (ZJU & Ant Security Light-Year Lab) for reporting this issue.
Published: 2023-07-25T15:47:40.183Z
CVE-2023-3773 Kernel: xfrm: out-of-bounds read of xfrma_mtimer_thresh nlattr
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace.
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read
Affected products: vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::nfv
cpe:/a:redhat:enterprise_linux:9::realtime
cpe:/o:redhat:enterprise_linux:9::baseos
cpe:/a:redhat:enterprise_linux:9::crb
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::nfv
cpe:/a:redhat:enterprise_linux:9::realtime
cpe:/o:redhat:enterprise_linux:9::baseos
cpe:/a:redhat:enterprise_linux:9::crb
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Lin Ma (ZJU & Ant Security Light-Year Lab) for reporting this issue.
Published: 2023-07-25T15:47:40.391Z
CVE-2023-3774 Vault Enterprise Namespace Creation May Lead to Denial of Service
An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial of service. Fixed in 1.14.1, 1.13.5, and 1.12.9.
Problem types: cwe_id: CWE-248
description: CWE-248: Uncaught Exception
Affected products: vendor: HashiCorp
product: Vault Enterprise
default_status: unaffected
CVSS v3.1: baseScore: 4.9
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-07-28T00:45:04.379Z