rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-0742 
It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp used to prevent input after page load. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.
Problem types: description: Failure to update user input timestamp
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Andrew McCreight
Published: 2024-01-23T13:48:15.625Z
CVE-2024-0743 
An unchecked return value in TLS handshake code could have caused a potentially exploitable crash. This vulnerability affects Firefox < 122, Firefox ESR < 115.9, and Thunderbird < 115.9.
Problem types: description: Crash in NSS TLS method
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: John Schanck
Published: 2024-01-23T13:48:20.194Z
CVE-2024-0744 
In some circumstances, JIT compiled code could have dereferenced a wild pointer value. This could have led to an exploitable crash. This vulnerability affects Firefox < 122.
Problem types: description: Wild pointer dereference in JavaScript
Affected products: vendor: Mozilla
product: Firefox
Credits: lang: en
value: Lukas Bernhard
Published: 2024-01-23T13:48:20.751Z
CVE-2024-0745 
The WebAudio `OscillatorNode` object was susceptible to a stack buffer overflow. This could have led to a potentially exploitable crash. This vulnerability affects Firefox < 122.
Problem types: description: Stack buffer overflow in WebAudio
Affected products: vendor: Mozilla
product: Firefox
Credits: lang: en
value: Yangkang of 360 ATA Team
Published: 2024-01-23T13:48:21.297Z
CVE-2024-0746 
A Linux user opening the print preview dialog could have caused the browser to crash. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.
Problem types: description: Crash when listing printers on Linux
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Cornel Ionce
Published: 2024-01-23T13:48:16.400Z
CVE-2024-0747 
When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have overridden the child Content Security Policy. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.
Problem types: description: Bypass of Content Security Policy when directive unsafe-inline was set
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Seongil Wi
Published: 2024-01-23T13:48:16.960Z
CVE-2024-0748 
A compromised content process could have updated the document URI. This could have allowed an attacker to set an arbitrary URI in the address bar or history. This vulnerability affects Firefox < 122.
Problem types: description: Compromised content process could modify document URI
Affected products: vendor: Mozilla
product: Firefox
Credits: lang: en
value: Young Min Kim
Published: 2024-01-23T13:48:21.814Z
CVE-2024-0749 
A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the address bar. This vulnerability affects Firefox < 122 and Thunderbird < 115.7.
Problem types: description: Phishing site popup could show local origin in address bar
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Kestrel
Published: 2024-01-23T13:48:17.500Z
CVE-2024-0750 
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.
Problem types: description: Potential permissions request bypass via clickjacking
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Hafiizh
Published: 2024-01-23T13:48:18.029Z
CVE-2024-0751 
A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.
Problem types: description: Privilege escalation through devtools
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Rob Wu
Published: 2024-01-23T13:48:18.580Z
CVE-2024-0752 
A use-after-free crash could have occurred on macOS if a Firefox update were being applied on a very busy system. This could have resulted in an exploitable crash. This vulnerability affects Firefox < 122.
Problem types: description: Use-after-free could occur when applying update on macOS
Affected products: vendor: Mozilla
product: Firefox
Credits: lang: en
value: Nika Layzell
Published: 2024-01-23T13:48:22.310Z
CVE-2024-0753 
In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.
Problem types: description: HSTS policy on subdomain could bypass policy of upper domain
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Hanno Böck
Published: 2024-01-23T13:48:19.157Z
CVE-2024-0754 
Some WASM source files could have caused a crash when loaded in devtools. This vulnerability affects Firefox < 122.
Problem types: description: Crash when using some WASM files in devtools
Affected products: vendor: Mozilla
product: Firefox
Credits: lang: en
value: Christian Holler
Published: 2024-01-23T13:48:22.822Z
CVE-2024-0755 
Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.
Problem types: description: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Daniel Holbert, Andrew Osmond, and the Mozilla Fuzzing Team
Published: 2024-01-23T13:48:19.684Z
CVE-2024-0756 Insert or Embed Articulate Content into WordPress <= 4.3000000023 - Iframe Injection
The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 lacks validation of URLs when adding iframes, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page.
Problem types: description: CWE-345 Insufficient Verification of Data Authenticity
Affected products: vendor: Unknown
product: Insert or Embed Articulate Content into WordPress
default_status: affected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2024-06-04T14:28:07.852Z
CVE-2024-0757 Insert or Embed Articulate Content into WordPress <= 4.3000000023 - Author+ Upload to RCE
The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 is not properly filtering which file extensions are allowed to be imported on the server, allowing the uploading of malicious code within zip files
Problem types: description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Unknown
product: Insert or Embed Articulate Content into WordPress
default_status: affected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2024-06-04T06:00:02.008Z
CVE-2024-0758 MolecularFaces XSS
MolecularFaces before 0.3.0 is vulnerable to cross site scripting. A remote attacker can execute arbitrary JavaScript in the context of a victim browser via crafted molfiles.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: default_status: unaffected
Published: 2024-01-19T20:19:40.558Z
CVE-2024-0759 Collection of internally resolving IPs
Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internally resolving IPs of other services that are on the same network as AnythingLLM.

This would require the attacker also be able to guess these internal IPs as `/*` ranging is not possible, but could be brute forced.

There is a duty of care that other services on the same network would not be fully open and accessible via a simple CuRL with zero authentication as it is not possible to set headers or access via the link collector.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: mintplex-labs
product: mintplex-labs/anything-llm
Published: 2024-02-27T05:12:38.318Z
CVE-2024-0760 A flood of DNS messages over TCP may make the server unstable
A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. 
This issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1.
Affected products: vendor: ISC
product: BIND 9
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
baseScore: 7.5
baseSeverity: HIGH
Published: 2024-07-23T14:26:54.983Z
CVE-2024-0761 File Manager <= 7.2.1 - Sensitive Information Exposure via Backup Filenames
The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to insufficient randomness in the backup filenames, which use a timestamp plus 4 random digits. This makes it possible for unauthenticated attackers, to extract sensitive data including site backups in configurations where the .htaccess file in the directory does not block access.
Problem types: cwe_id: CWE-330
description: CWE-330 Use of Insufficiently Random Values
Affected products: vendor: mndpsingh287
product: File Manager
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.1
baseSeverity: HIGH
Credits: lang: en
value: Yuki Haruma
Published: 2024-02-05T21:21:34.656Z
CVE-2024-0762 Potential buffer overflow when handling UEFI variables
Potential buffer overflow 
in unsafe UEFI variable handling 

in Phoenix SecureCore™ for select Intel platforms


This issue affects:


Phoenix 

SecureCore™ for Intel Kaby Lake: from 4.0.1.1 before 4.0.1.998;


Phoenix 

SecureCore™ for Intel Coffee Lake: from 4.1.0.1 before 4.1.0.562;


Phoenix 

SecureCore™ for Intel Ice Lake: from 4.2.0.1 before 4.2.0.323;


Phoenix 

SecureCore™ for Intel Comet Lake: from 4.2.1.1 before 4.2.1.287;


Phoenix 

SecureCore™ for Intel Tiger Lake: from 4.3.0.1 before 4.3.0.236;


Phoenix 

SecureCore™ for Intel Jasper Lake: from 4.3.1.1 before 4.3.1.184;


Phoenix 

SecureCore™ for Intel Alder Lake: from 4.4.0.1 before 4.4.0.269;


Phoenix 

SecureCore™ for Intel Raptor Lake: from 4.5.0.1 before 4.5.0.218;


Phoenix 

SecureCore™ for Intel Meteor Lake: from 4.5.1.1 before 4.5.1.15.
Affected products: vendor: Phoenix
product: SecureCore™ for Intel Kaby Lake
default_status: unaffected
vendor: Phoenix
product: SecureCore™ for Intel Coffee Lake
default_status: unaffected
vendor: Phoenix
product: SecureCore™ for Intel Ice Lake
default_status: unaffected
vendor: Phoenix
product: SecureCore™ for Intel Comet Lake
default_status: unaffected
vendor: Phoenix
product: SecureCore™ for Intel Tiger Lake
default_status: unaffected
vendor: Phoenix
product: SecureCore™ for Intel Jasper Lake
default_status: unaffected
vendor: Phoenix
product: SecureCore™ for Intel Alder Lake
default_status: unaffected
vendor: Phoenix
product: SecureCore™ for Intel Raptor Lake
default_status: unaffected
vendor: Phoenix
product: SecureCore™ for Intel Meteor Lake
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Oren Isacson from Eclypsium
Published: 2024-05-14T14:56:25.578Z
CVE-2024-0763 Improper validation of document removal parameter
Any user can delete an arbitrary folder (recursively) on a remote server due to bad input sanitization leading to path traversal. The attacker would need access to the server at some privilege level since this endpoint is protected and requires authorization.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: mintplex-labs
product: mintplex-labs/anything-llm
Published: 2024-02-27T21:14:56.552Z
CVE-2024-0765 Default user role exporting save state of instance
As a default user on a multi-user instance of AnythingLLM, you could execute a call to the `/export-data` endpoint of the system and then unzip and read that export that would enable you do exfiltrate data of the system at that save state.

This would require the attacked to be granted explicit access to the system, but they can do this at any role. Additionally, post-download, the data is deleted so no evidence would exist that the exfiltration occured.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: mintplex-labs
product: mintplex-labs/anything-llm
Published: 2024-03-03T14:13:41.067Z
CVE-2024-0766 Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Missing Authorization via templates_ajax_request
The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the templates_ajax_request function in all versions up to, and including, 1.4.4. This makes it possible for subscribers and higher to create templates.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: envothemes
product: Envo's Templates & Widgets for Elementor and WooCommerce
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Francesco Carlucci
Published: 2024-02-28T08:33:11.015Z
CVE-2024-0767 Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Cross-Site Request Forgery via ajax_plugin_activation
The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.4. This is due to missing or incorrect nonce validation on the ajax_plugin_activation function. This makes it possible for unauthenticated attackers to activate arbitrary installed plugins via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: envothemes
product: Envo's Templates & Widgets for Elementor and WooCommerce
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Marco Wotschka
Published: 2024-02-28T08:33:13.010Z
CVE-2024-0768 Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Cross-Site Request Forgery via ajax_theme_activation
The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.4.4. This is due to missing or incorrect nonce validation on the ajax_theme_activation function. This makes it possible for unauthenticated attackers to activate arbitrary installed themes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: envothemes
product: Envo's Templates & Widgets for Elementor and WooCommerce
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Marco Wotschka
Published: 2024-02-28T08:33:08.602Z
CVE-2024-0769 D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
Problem types: cwe_id: CWE-22
description: CWE-22 Path Traversal
Affected products: vendor: D-Link
product: DIR-859
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: Françoa Taffarel
lang: en
value: francoa.taffarel (VulDB User)
lang: en
value: francoa.taffarel (VulDB User)
Published: 2024-01-21T08:00:05.383Z
CVE-2024-0770 European Chemicals Agency IUCLID Desktop Installer iuclid6.exe default permission
A vulnerability, which was classified as critical, was found in European Chemicals Agency IUCLID 7.10.3 on Windows. Affected is an unknown function of the file iuclid6.exe of the component Desktop Installer. The manipulation leads to incorrect default permissions. The attack needs to be approached locally. VDB-251670 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: European Chemicals Agency
product: IUCLID
CVSS v3.1: version: 3.1
baseScore: 4.4
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Andrea Intilangelo
lang: en
value: acme (VulDB User)
Published: 2024-01-21T23:00:05.982Z
CVE-2024-0771 Nsasoft Product Key Explorer Registration memory corruption
A vulnerability has been found in Nsasoft Product Key Explorer 4.0.9 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Registration Handler. The manipulation of the argument Name/Key leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251671. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-119
description: CWE-119 Memory Corruption
Affected products: vendor: Nsasoft
product: Product Key Explorer
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: fernando.mengali (VulDB User)
Published: 2024-01-21T23:00:07.048Z
CVE-2024-0772 Nsasoft ShareAlarmPro Registration memory corruption
A vulnerability was found in Nsasoft ShareAlarmPro 2.1.4 and classified as problematic. Affected by this issue is some unknown functionality of the component Registration Handler. The manipulation of the argument Name/Key leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251672. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-119
description: CWE-119 Memory Corruption
Affected products: vendor: Nsasoft
product: ShareAlarmPro
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: fernando.mengali (VulDB User)
Published: 2024-01-21T23:31:04.097Z
CVE-2024-0773 CodeAstro Internet Banking System pages_client_signup.php cross site scripting
A vulnerability classified as problematic was found in CodeAstro Internet Banking System 1.0. Affected by this vulnerability is an unknown functionality of the file pages_client_signup.php. The manipulation of the argument Client Full Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-251677 was assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: CodeAstro
product: Internet Banking System
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: Mohammed Aashique (VulDB User)
Published: 2024-01-21T23:31:05.166Z
CVE-2024-0774 Any-Capture Any Sound Recorder Registration memory corruption
A vulnerability was found in Any-Capture Any Sound Recorder 2.93. It has been declared as problematic. This vulnerability affects unknown code of the component Registration Handler. The manipulation of the argument User Name/Key Code leads to memory corruption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. VDB-251674 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-119
description: CWE-119 Memory Corruption
Affected products: vendor: Any-Capture
product: Any Sound Recorder
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: fernando.mengali (VulDB User)
Published: 2024-01-22T00:00:06.489Z
CVE-2024-0775 Kernel: use-after-free while changing the mount option in __ext4_remount leading
A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This flaw allows a local user to cause an information leak problem while freeing the old quota file names before a potential failure, leading to a use-after-free.
Problem types: cwe_id: CWE-416
description: Use After Free
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-01-22T13:03:09.603Z