Vulnerability-Lookup

NCSC-2024-0297

Vulnerability from csaf_ncscnl - Published: 2024-07-17 13:53 - Updated: 2024-07-17 13:53

Summary

Kwetsbaarheden verholpen in Oracle Financial Services Applications

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten: Er zijn kwetsbaarheden verholpen in Oracle Financial Services Applications.

Interpretaties: Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade: * Denial-of-Service (DoS) * Toegang tot gevoelige gegevens * Toegang tot systeemgegevens * Manipulatie van gegevens * (Remote) code execution (Gebruikersrechten)

Oplossingen: Oracle heeft updates beschikbaar gesteld om de kwetsbaarheden te verhelpen. Zie de referenties voor meer informatie.

Kans: medium

Schade: high

CWE-1188: Initialization of a Resource with an Insecure Default

CWE-121: Stack-based Buffer Overflow

CWE-20: Improper Input Validation

CWE-306: Missing Authentication for Critical Function

CWE-328: Use of Weak Hash

CWE-400: Uncontrolled Resource Consumption

CWE-404: Improper Resource Shutdown or Release

CWE-416: Use After Free

CWE-426: Untrusted Search Path

CWE-502: Deserialization of Untrusted Data

CWE-532: Insertion of Sensitive Information into Log File

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-770: Allocation of Resources Without Limits or Throttling

CWE-787: Out-of-bounds Write

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-36944

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-502 - Deserialization of Untrusted Data

Affected products

Known affected 53 products

CVE-2023-6129

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

CWE-328 - Use of Weak Hash

Affected products

Known affected 31 products

CVE-2023-26031

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-426 - Untrusted Search Path

Affected products

Known affected 23 products

CVE-2023-34055

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Known affected 55 products

CVE-2023-44483

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-532 - Insertion of Sensitive Information into Log File

Affected products

Known affected 55 products

CVE-2023-47248

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Known affected 47 products

CVE-2023-50447

9.0 (Critical)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected products

Known affected 23 products

CVE-2023-51074

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-121 - Stack-based Buffer Overflow

Affected products

Known affected 31 products

CVE-2023-52425

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Known affected 23 products

CVE-2024-2511

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-404 - Improper Resource Shutdown or Release

Affected products

Known affected 23 products

CVE-2024-21188

Affected products

Known affected 24 products

CVE-2024-22201

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Known affected 31 products

CVE-2024-22262

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Affected products

Known affected 23 products

CVE-2024-23807

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Known affected 23 products

CVE-2024-24549

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Known affected 31 products

CVE-2024-24816

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Known affected 31 products

CVE-2024-25062

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Known affected 31 products

CVE-2024-26308

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Known affected 31 products

CVE-2024-29025

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Known affected 23 products

CVE-2024-29133

CWE-787 - Out-of-bounds Write

Affected products

Known affected 23 products

CVE-2024-32114

8.5 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H

CWE-306 - Missing Authentication for Critical Function

Affected products

Known affected 23 products

References

44 references

URL	Category
https://nvd.nist.gov/vuln/detail/CVE-2022-36944	external
https://nvd.nist.gov/vuln/detail/CVE-2023-26031	external
https://nvd.nist.gov/vuln/detail/CVE-2023-34055	external
https://nvd.nist.gov/vuln/detail/CVE-2023-44483	external
https://nvd.nist.gov/vuln/detail/CVE-2023-47248	external
https://nvd.nist.gov/vuln/detail/CVE-2023-50447	external
https://nvd.nist.gov/vuln/detail/CVE-2023-51074	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52425	external
https://nvd.nist.gov/vuln/detail/CVE-2023-6129	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21188	external
https://nvd.nist.gov/vuln/detail/CVE-2024-22201	external
https://nvd.nist.gov/vuln/detail/CVE-2024-22262	external
https://nvd.nist.gov/vuln/detail/CVE-2024-23807	external
https://nvd.nist.gov/vuln/detail/CVE-2024-24549	external
https://nvd.nist.gov/vuln/detail/CVE-2024-24816	external
https://nvd.nist.gov/vuln/detail/CVE-2024-25062	external
https://nvd.nist.gov/vuln/detail/CVE-2024-2511	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26308	external
https://nvd.nist.gov/vuln/detail/CVE-2024-29025	external
https://nvd.nist.gov/vuln/detail/CVE-2024-29133	external
https://nvd.nist.gov/vuln/detail/CVE-2024-32114	external
https://www.oracle.com/docs/tech/security-alerts/…	external
https://www.oracle.com/security-alerts/cpujul2024.html	external
https://api.ncsc.nl/velma/v1/vulnerabilities/2022…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2023…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2023…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2023…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2023…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2023…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2023…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2023…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2023…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Er zijn kwetsbaarheden verholpen in Oracle Financial Services Applications.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorie\u00ebn schade:\n\n* Denial-of-Service (DoS)\n* Toegang tot gevoelige gegevens\n* Toegang tot systeemgegevens\n* Manipulatie van gegevens\n* (Remote) code execution (Gebruikersrechten)",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Oracle heeft updates beschikbaar gesteld om de kwetsbaarheden te verhelpen. Zie de referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Initialization of a Resource with an Insecure Default",
        "title": "CWE-1188"
      },
      {
        "category": "general",
        "text": "Stack-based Buffer Overflow",
        "title": "CWE-121"
      },
      {
        "category": "general",
        "text": "Improper Input Validation",
        "title": "CWE-20"
      },
      {
        "category": "general",
        "text": "Missing Authentication for Critical Function",
        "title": "CWE-306"
      },
      {
        "category": "general",
        "text": "Use of Weak Hash",
        "title": "CWE-328"
      },
      {
        "category": "general",
        "text": "Uncontrolled Resource Consumption",
        "title": "CWE-400"
      },
      {
        "category": "general",
        "text": "Improper Resource Shutdown or Release",
        "title": "CWE-404"
      },
      {
        "category": "general",
        "text": "Use After Free",
        "title": "CWE-416"
      },
      {
        "category": "general",
        "text": "Untrusted Search Path",
        "title": "CWE-426"
      },
      {
        "category": "general",
        "text": "Deserialization of Untrusted Data",
        "title": "CWE-502"
      },
      {
        "category": "general",
        "text": "Insertion of Sensitive Information into Log File",
        "title": "CWE-532"
      },
      {
        "category": "general",
        "text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
        "title": "CWE-601"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
        "title": "CWE-77"
      },
      {
        "category": "general",
        "text": "Allocation of Resources Without Limits or Throttling",
        "title": "CWE-770"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Write",
        "title": "CWE-787"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
        "title": "CWE-79"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36944"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26031"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34055"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44483"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47248"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50447"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51074"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52425"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6129"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21188"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22201"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22262"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23807"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24549"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24816"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25062"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2511"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26308"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29025"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29133"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32114"
      },
      {
        "category": "external",
        "summary": "Reference - oracle",
        "url": "https://www.oracle.com/docs/tech/security-alerts/cpujul2024csaf.json"
      },
      {
        "category": "external",
        "summary": "Reference - cveprojectv5; ibm; nvd; oracle",
        "url": "https://www.oracle.com/security-alerts/cpujul2024.html"
      }
    ],
    "title": " Kwetsbaarheden verholpen in Oracle Financial Services Applications",
    "tracking": {
      "current_release_date": "2024-07-17T13:53:54.655859Z",
      "id": "NCSC-2024-0297",
      "initial_release_date": "2024-07-17T13:53:54.655859Z",
      "revision_history": [
        {
          "date": "2024-07-17T13:53:54.655859Z",
          "number": "0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-9711",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-9300",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.8:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-9522",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.9:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-8848",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-189066",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-189065",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_basel_regulatory_capital_basic",
            "product": {
              "name": "financial_services_basel_regulatory_capital_basic",
              "product_id": "CSAFPID-1503626",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.0.7.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_basel_regulatory_capital_basic",
            "product": {
              "name": "financial_services_basel_regulatory_capital_basic",
              "product_id": "CSAFPID-1503627",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.0.8.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_basel_regulatory_capital_internal_ratings_based_approach",
            "product": {
              "name": "financial_services_basel_regulatory_capital_internal_ratings_based_approach",
              "product_id": "CSAFPID-1503628",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.0.7.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_basel_regulatory_capital_internal_ratings_based_approach",
            "product": {
              "name": "financial_services_basel_regulatory_capital_internal_ratings_based_approach",
              "product_id": "CSAFPID-1503629",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.0.8.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-189067",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.8.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-93307",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-219772",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-219770",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-816828",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.6:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-1503630",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.7:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_cash_flow_engine",
            "product": {
              "name": "financial_services_cash_flow_engine",
              "product_id": "CSAFPID-764273",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_cash_flow_engine:8.1.2.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_compliance_studio",
            "product": {
              "name": "financial_services_compliance_studio",
              "product_id": "CSAFPID-345047",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_compliance_studio:8.1.2.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_compliance_studio",
            "product": {
              "name": "financial_services_compliance_studio",
              "product_id": "CSAFPID-816829",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_compliance_studio:8.1.2.5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_compliance_studio",
            "product": {
              "name": "financial_services_compliance_studio",
              "product_id": "CSAFPID-1503631",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_compliance_studio:8.1.2.6:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_compliance_studio",
            "product": {
              "name": "financial_services_compliance_studio",
              "product_id": "CSAFPID-1503632",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_compliance_studio:8.1.2.7:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-219774",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-1503633",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.2.8:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-180190",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-1503634",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1.18:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-219773",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-219771",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-816830",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.6:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-1503635",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.6.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-1503636",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.7.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_lending_and_leasing",
            "product": {
              "name": "financial_services_lending_and_leasing",
              "product_id": "CSAFPID-816831",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_lending_and_leasing:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_model_management_and_governance",
            "product": {
              "name": "financial_services_model_management_and_governance",
              "product_id": "CSAFPID-611392",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_model_management_and_governance",
            "product": {
              "name": "financial_services_model_management_and_governance",
              "product_id": "CSAFPID-611391",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_model_management_and_governance",
            "product": {
              "name": "financial_services_model_management_and_governance",
              "product_id": "CSAFPID-1503319",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_model_management_and_governance",
            "product": {
              "name": "financial_services_model_management_and_governance",
              "product_id": "CSAFPID-1503318",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.6:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816833",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:_pricing_services___2.9.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816840",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:_security___5.1.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-765266",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-344846",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.7.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816832",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.8.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-912589",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.8.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816834",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.9.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-765264",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.9.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-765265",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.9.0.1.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-344845",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.9.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816835",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:3.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-400311",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:3.0.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816836",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:3.1.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-912590",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:3.1.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816837",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:3.2.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-400309",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:3.2.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816838",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:4.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-912591",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:4.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816839",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:5.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-912592",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:5.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816841",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:5.1.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816842",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:6.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-1503637",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:6.0.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-1503923",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:6.1.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-1503638",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:6.1.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_trade-based_anti_money_laundering_enterprise_edition",
            "product": {
              "name": "financial_services_trade-based_anti_money_laundering_enterprise_edition",
              "product_id": "CSAFPID-220374",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering_enterprise_edition:8.0.8:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_trade-based_anti_money_laundering_enterprise_edition",
            "product": {
              "name": "financial_services_trade-based_anti_money_laundering_enterprise_edition",
              "product_id": "CSAFPID-764926",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering_enterprise_edition:8.0.8.0:*:*:*:*:*:*:*"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "oracle"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-36944",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "notes": [
        {
          "category": "other",
          "text": "Deserialization of Untrusted Data",
          "title": "CWE-502"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-764273",
          "CSAFPID-611392",
          "CSAFPID-611391",
          "CSAFPID-9522",
          "CSAFPID-816828",
          "CSAFPID-816829",
          "CSAFPID-816830",
          "CSAFPID-816831",
          "CSAFPID-344846",
          "CSAFPID-816832",
          "CSAFPID-816833",
          "CSAFPID-816834",
          "CSAFPID-344845",
          "CSAFPID-816835",
          "CSAFPID-765266",
          "CSAFPID-816836",
          "CSAFPID-816837",
          "CSAFPID-816838",
          "CSAFPID-816839",
          "CSAFPID-816840",
          "CSAFPID-816841",
          "CSAFPID-816842",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926",
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-8848",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-219772",
          "CSAFPID-219770",
          "CSAFPID-345047",
          "CSAFPID-219774",
          "CSAFPID-180190",
          "CSAFPID-219773",
          "CSAFPID-219771",
          "CSAFPID-220374"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2022-36944",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-36944.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-764273",
            "CSAFPID-611392",
            "CSAFPID-611391",
            "CSAFPID-9522",
            "CSAFPID-816828",
            "CSAFPID-816829",
            "CSAFPID-816830",
            "CSAFPID-816831",
            "CSAFPID-344846",
            "CSAFPID-816832",
            "CSAFPID-816833",
            "CSAFPID-816834",
            "CSAFPID-344845",
            "CSAFPID-816835",
            "CSAFPID-765266",
            "CSAFPID-816836",
            "CSAFPID-816837",
            "CSAFPID-816838",
            "CSAFPID-816839",
            "CSAFPID-816840",
            "CSAFPID-816841",
            "CSAFPID-816842",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926",
            "CSAFPID-9711",
            "CSAFPID-9300",
            "CSAFPID-8848",
            "CSAFPID-189066",
            "CSAFPID-189065",
            "CSAFPID-189067",
            "CSAFPID-93307",
            "CSAFPID-219772",
            "CSAFPID-219770",
            "CSAFPID-345047",
            "CSAFPID-219774",
            "CSAFPID-180190",
            "CSAFPID-219773",
            "CSAFPID-219771",
            "CSAFPID-220374"
          ]
        }
      ],
      "title": "CVE-2022-36944"
    },
    {
      "cve": "CVE-2023-6129",
      "cwe": {
        "id": "CWE-328",
        "name": "Use of Weak Hash"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use of Weak Hash",
          "title": "CWE-328"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-400309",
          "CSAFPID-400311",
          "CSAFPID-765264",
          "CSAFPID-765265",
          "CSAFPID-912589",
          "CSAFPID-912590",
          "CSAFPID-912591",
          "CSAFPID-912592",
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-816828",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-6129",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-6129.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-400309",
            "CSAFPID-400311",
            "CSAFPID-765264",
            "CSAFPID-765265",
            "CSAFPID-912589",
            "CSAFPID-912590",
            "CSAFPID-912591",
            "CSAFPID-912592",
            "CSAFPID-9711",
            "CSAFPID-9300",
            "CSAFPID-189066",
            "CSAFPID-189065",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-189067",
            "CSAFPID-93307",
            "CSAFPID-816828",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926"
          ]
        }
      ],
      "title": "CVE-2023-6129"
    },
    {
      "cve": "CVE-2023-26031",
      "cwe": {
        "id": "CWE-426",
        "name": "Untrusted Search Path"
      },
      "notes": [
        {
          "category": "other",
          "text": "Untrusted Search Path",
          "title": "CWE-426"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-816828",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-26031",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-26031.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-9711",
            "CSAFPID-9300",
            "CSAFPID-189066",
            "CSAFPID-189065",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-189067",
            "CSAFPID-93307",
            "CSAFPID-816828",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926"
          ]
        }
      ],
      "title": "CVE-2023-26031"
    },
    {
      "cve": "CVE-2023-34055",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "other",
          "text": "Uncontrolled Resource Consumption",
          "title": "CWE-400"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-8848",
          "CSAFPID-9300",
          "CSAFPID-9522",
          "CSAFPID-9711",
          "CSAFPID-93307",
          "CSAFPID-180190",
          "CSAFPID-189065",
          "CSAFPID-189066",
          "CSAFPID-189067",
          "CSAFPID-219770",
          "CSAFPID-219771",
          "CSAFPID-219774",
          "CSAFPID-220374",
          "CSAFPID-344845",
          "CSAFPID-344846",
          "CSAFPID-765266",
          "CSAFPID-816828",
          "CSAFPID-816829",
          "CSAFPID-816830",
          "CSAFPID-816831",
          "CSAFPID-816832",
          "CSAFPID-816833",
          "CSAFPID-816834",
          "CSAFPID-816835",
          "CSAFPID-816836",
          "CSAFPID-816837",
          "CSAFPID-816838",
          "CSAFPID-816839",
          "CSAFPID-816840",
          "CSAFPID-816841",
          "CSAFPID-816842",
          "CSAFPID-400309",
          "CSAFPID-400311",
          "CSAFPID-765264",
          "CSAFPID-765265",
          "CSAFPID-912589",
          "CSAFPID-912590",
          "CSAFPID-912591",
          "CSAFPID-912592",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-34055",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-34055.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-8848",
            "CSAFPID-9300",
            "CSAFPID-9522",
            "CSAFPID-9711",
            "CSAFPID-93307",
            "CSAFPID-180190",
            "CSAFPID-189065",
            "CSAFPID-189066",
            "CSAFPID-189067",
            "CSAFPID-219770",
            "CSAFPID-219771",
            "CSAFPID-219774",
            "CSAFPID-220374",
            "CSAFPID-344845",
            "CSAFPID-344846",
            "CSAFPID-765266",
            "CSAFPID-816828",
            "CSAFPID-816829",
            "CSAFPID-816830",
            "CSAFPID-816831",
            "CSAFPID-816832",
            "CSAFPID-816833",
            "CSAFPID-816834",
            "CSAFPID-816835",
            "CSAFPID-816836",
            "CSAFPID-816837",
            "CSAFPID-816838",
            "CSAFPID-816839",
            "CSAFPID-816840",
            "CSAFPID-816841",
            "CSAFPID-816842",
            "CSAFPID-400309",
            "CSAFPID-400311",
            "CSAFPID-765264",
            "CSAFPID-765265",
            "CSAFPID-912589",
            "CSAFPID-912590",
            "CSAFPID-912591",
            "CSAFPID-912592",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926"
          ]
        }
      ],
      "title": "CVE-2023-34055"
    },
    {
      "cve": "CVE-2023-44483",
      "cwe": {
        "id": "CWE-532",
        "name": "Insertion of Sensitive Information into Log File"
      },
      "notes": [
        {
          "category": "other",
          "text": "Insertion of Sensitive Information into Log File",
          "title": "CWE-532"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-8848",
          "CSAFPID-9300",
          "CSAFPID-9522",
          "CSAFPID-9711",
          "CSAFPID-93307",
          "CSAFPID-180190",
          "CSAFPID-189065",
          "CSAFPID-189066",
          "CSAFPID-189067",
          "CSAFPID-219770",
          "CSAFPID-219771",
          "CSAFPID-219774",
          "CSAFPID-220374",
          "CSAFPID-344845",
          "CSAFPID-344846",
          "CSAFPID-765266",
          "CSAFPID-816828",
          "CSAFPID-816829",
          "CSAFPID-816830",
          "CSAFPID-816831",
          "CSAFPID-816832",
          "CSAFPID-816833",
          "CSAFPID-816834",
          "CSAFPID-816835",
          "CSAFPID-816836",
          "CSAFPID-816837",
          "CSAFPID-816838",
          "CSAFPID-816839",
          "CSAFPID-816840",
          "CSAFPID-816841",
          "CSAFPID-816842",
          "CSAFPID-400309",
          "CSAFPID-400311",
          "CSAFPID-765264",
          "CSAFPID-765265",
          "CSAFPID-912589",
          "CSAFPID-912590",
          "CSAFPID-912591",
          "CSAFPID-912592",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-44483",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-44483.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-8848",
            "CSAFPID-9300",
            "CSAFPID-9522",
            "CSAFPID-9711",
            "CSAFPID-93307",
            "CSAFPID-180190",
            "CSAFPID-189065",
            "CSAFPID-189066",
            "CSAFPID-189067",
            "CSAFPID-219770",
            "CSAFPID-219771",
            "CSAFPID-219774",
            "CSAFPID-220374",
            "CSAFPID-344845",
            "CSAFPID-344846",
            "CSAFPID-765266",
            "CSAFPID-816828",
            "CSAFPID-816829",
            "CSAFPID-816830",
            "CSAFPID-816831",
            "CSAFPID-816832",
            "CSAFPID-816833",
            "CSAFPID-816834",
            "CSAFPID-816835",
            "CSAFPID-816836",
            "CSAFPID-816837",
            "CSAFPID-816838",
            "CSAFPID-816839",
            "CSAFPID-816840",
            "CSAFPID-816841",
            "CSAFPID-816842",
            "CSAFPID-400309",
            "CSAFPID-400311",
            "CSAFPID-765264",
            "CSAFPID-765265",
            "CSAFPID-912589",
            "CSAFPID-912590",
            "CSAFPID-912591",
            "CSAFPID-912592",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926"
          ]
        }
      ],
      "title": "CVE-2023-44483"
    },
    {
      "cve": "CVE-2023-47248",
      "product_status": {
        "known_affected": [
          "CSAFPID-8848",
          "CSAFPID-9300",
          "CSAFPID-9522",
          "CSAFPID-9711",
          "CSAFPID-93307",
          "CSAFPID-180190",
          "CSAFPID-189065",
          "CSAFPID-189066",
          "CSAFPID-189067",
          "CSAFPID-219770",
          "CSAFPID-219771",
          "CSAFPID-219774",
          "CSAFPID-220374",
          "CSAFPID-344845",
          "CSAFPID-344846",
          "CSAFPID-765266",
          "CSAFPID-816828",
          "CSAFPID-816829",
          "CSAFPID-816830",
          "CSAFPID-816831",
          "CSAFPID-816832",
          "CSAFPID-816833",
          "CSAFPID-816834",
          "CSAFPID-816835",
          "CSAFPID-816836",
          "CSAFPID-816837",
          "CSAFPID-816838",
          "CSAFPID-816839",
          "CSAFPID-816840",
          "CSAFPID-816841",
          "CSAFPID-816842",
          "CSAFPID-1503318",
          "CSAFPID-1503319",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-47248",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-47248.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-8848",
            "CSAFPID-9300",
            "CSAFPID-9522",
            "CSAFPID-9711",
            "CSAFPID-93307",
            "CSAFPID-180190",
            "CSAFPID-189065",
            "CSAFPID-189066",
            "CSAFPID-189067",
            "CSAFPID-219770",
            "CSAFPID-219771",
            "CSAFPID-219774",
            "CSAFPID-220374",
            "CSAFPID-344845",
            "CSAFPID-344846",
            "CSAFPID-765266",
            "CSAFPID-816828",
            "CSAFPID-816829",
            "CSAFPID-816830",
            "CSAFPID-816831",
            "CSAFPID-816832",
            "CSAFPID-816833",
            "CSAFPID-816834",
            "CSAFPID-816835",
            "CSAFPID-816836",
            "CSAFPID-816837",
            "CSAFPID-816838",
            "CSAFPID-816839",
            "CSAFPID-816840",
            "CSAFPID-816841",
            "CSAFPID-816842",
            "CSAFPID-1503318",
            "CSAFPID-1503319",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926"
          ]
        }
      ],
      "title": "CVE-2023-47248"
    },
    {
      "cve": "CVE-2023-50447",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
          "title": "CWE-77"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-816828",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-50447",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-50447.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-9711",
            "CSAFPID-9300",
            "CSAFPID-189066",
            "CSAFPID-189065",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-189067",
            "CSAFPID-93307",
            "CSAFPID-816828",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926"
          ]
        }
      ],
      "title": "CVE-2023-50447"
    },
    {
      "cve": "CVE-2023-51074",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Stack-based Buffer Overflow",
          "title": "CWE-121"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-400309",
          "CSAFPID-400311",
          "CSAFPID-765264",
          "CSAFPID-765265",
          "CSAFPID-912589",
          "CSAFPID-912590",
          "CSAFPID-912591",
          "CSAFPID-912592",
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-816828",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-51074",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-51074.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-400309",
            "CSAFPID-400311",
            "CSAFPID-765264",
            "CSAFPID-765265",
            "CSAFPID-912589",
            "CSAFPID-912590",
            "CSAFPID-912591",
            "CSAFPID-912592",
            "CSAFPID-9711",
            "CSAFPID-9300",
            "CSAFPID-189066",
            "CSAFPID-189065",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-189067",
            "CSAFPID-93307",
            "CSAFPID-816828",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926"
          ]
        }
      ],
      "title": "CVE-2023-51074"
    },
    {
      "cve": "CVE-2023-52425",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "other",
          "text": "Uncontrolled Resource Consumption",
          "title": "CWE-400"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-816828",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-52425",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-52425.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-9711",
            "CSAFPID-9300",
            "CSAFPID-189066",
            "CSAFPID-189065",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-189067",
            "CSAFPID-93307",
            "CSAFPID-816828",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926"
          ]
        }
      ],
      "title": "CVE-2023-52425"
    },
    {
      "cve": "CVE-2024-2511",
      "cwe": {
        "id": "CWE-404",
        "name": "Improper Resource Shutdown or Release"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Resource Shutdown or Release",
          "title": "CWE-404"
        },
        {
          "category": "other",
          "text": "Uncontrolled Resource Consumption",
          "title": "CWE-400"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-816828",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-2511",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-2511.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-9711",
            "CSAFPID-9300",
            "CSAFPID-189066",
            "CSAFPID-189065",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-189067",
            "CSAFPID-93307",
            "CSAFPID-816828",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926"
          ]
        }
      ],
      "title": "CVE-2024-2511"
    },
    {
      "cve": "CVE-2024-21188",
      "product_status": {
        "known_affected": [
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-816828",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926",
          "CSAFPID-816842"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-21188",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21188.json"
        }
      ],
      "title": "CVE-2024-21188"
    },
    {
      "cve": "CVE-2024-22201",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "other",
          "text": "Uncontrolled Resource Consumption",
          "title": "CWE-400"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-400309",
          "CSAFPID-400311",
          "CSAFPID-765264",
          "CSAFPID-765265",
          "CSAFPID-912589",
          "CSAFPID-912590",
          "CSAFPID-912591",
          "CSAFPID-912592",
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-816828",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-22201",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22201.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-400309",
            "CSAFPID-400311",
            "CSAFPID-765264",
            "CSAFPID-765265",
            "CSAFPID-912589",
            "CSAFPID-912590",
            "CSAFPID-912591",
            "CSAFPID-912592",
            "CSAFPID-9711",
            "CSAFPID-9300",
            "CSAFPID-189066",
            "CSAFPID-189065",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-189067",
            "CSAFPID-93307",
            "CSAFPID-816828",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926"
          ]
        }
      ],
      "title": "CVE-2024-22201"
    },
    {
      "cve": "CVE-2024-22262",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
          "title": "CWE-601"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-816828",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-22262",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22262.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-9711",
            "CSAFPID-9300",
            "CSAFPID-189066",
            "CSAFPID-189065",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-189067",
            "CSAFPID-93307",
            "CSAFPID-816828",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926"
          ]
        }
      ],
      "title": "CVE-2024-22262"
    },
    {
      "cve": "CVE-2024-23807",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-816828",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-23807",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-23807.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-9711",
            "CSAFPID-9300",
            "CSAFPID-189066",
            "CSAFPID-189065",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-189067",
            "CSAFPID-93307",
            "CSAFPID-816828",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926"
          ]
        }
      ],
      "title": "CVE-2024-23807"
    },
    {
      "cve": "CVE-2024-24549",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Input Validation",
          "title": "CWE-20"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-400309",
          "CSAFPID-400311",
          "CSAFPID-765264",
          "CSAFPID-765265",
          "CSAFPID-912589",
          "CSAFPID-912590",
          "CSAFPID-912591",
          "CSAFPID-912592",
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-816828",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-24549",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-24549.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-400309",
            "CSAFPID-400311",
            "CSAFPID-765264",
            "CSAFPID-765265",
            "CSAFPID-912589",
            "CSAFPID-912590",
            "CSAFPID-912591",
            "CSAFPID-912592",
            "CSAFPID-9711",
            "CSAFPID-9300",
            "CSAFPID-189066",
            "CSAFPID-189065",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-189067",
            "CSAFPID-93307",
            "CSAFPID-816828",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926"
          ]
        }
      ],
      "title": "CVE-2024-24549"
    },
    {
      "cve": "CVE-2024-24816",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-400309",
          "CSAFPID-400311",
          "CSAFPID-765264",
          "CSAFPID-765265",
          "CSAFPID-912589",
          "CSAFPID-912590",
          "CSAFPID-912591",
          "CSAFPID-912592",
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-816828",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-24816",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-24816.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-400309",
            "CSAFPID-400311",
            "CSAFPID-765264",
            "CSAFPID-765265",
            "CSAFPID-912589",
            "CSAFPID-912590",
            "CSAFPID-912591",
            "CSAFPID-912592",
            "CSAFPID-9711",
            "CSAFPID-9300",
            "CSAFPID-189066",
            "CSAFPID-189065",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-189067",
            "CSAFPID-93307",
            "CSAFPID-816828",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926"
          ]
        }
      ],
      "title": "CVE-2024-24816"
    },
    {
      "cve": "CVE-2024-25062",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-400309",
          "CSAFPID-400311",
          "CSAFPID-765264",
          "CSAFPID-765265",
          "CSAFPID-912589",
          "CSAFPID-912590",
          "CSAFPID-912591",
          "CSAFPID-912592",
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-816828",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-25062",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-25062.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-400309",
            "CSAFPID-400311",
            "CSAFPID-765264",
            "CSAFPID-765265",
            "CSAFPID-912589",
            "CSAFPID-912590",
            "CSAFPID-912591",
            "CSAFPID-912592",
            "CSAFPID-9711",
            "CSAFPID-9300",
            "CSAFPID-189066",
            "CSAFPID-189065",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-189067",
            "CSAFPID-93307",
            "CSAFPID-816828",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926"
          ]
        }
      ],
      "title": "CVE-2024-25062"
    },
    {
      "cve": "CVE-2024-26308",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-400309",
          "CSAFPID-400311",
          "CSAFPID-765264",
          "CSAFPID-765265",
          "CSAFPID-912589",
          "CSAFPID-912590",
          "CSAFPID-912591",
          "CSAFPID-912592",
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-816828",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-26308",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-26308.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-400309",
            "CSAFPID-400311",
            "CSAFPID-765264",
            "CSAFPID-765265",
            "CSAFPID-912589",
            "CSAFPID-912590",
            "CSAFPID-912591",
            "CSAFPID-912592",
            "CSAFPID-9711",
            "CSAFPID-9300",
            "CSAFPID-189066",
            "CSAFPID-189065",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-189067",
            "CSAFPID-93307",
            "CSAFPID-816828",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926"
          ]
        }
      ],
      "title": "CVE-2024-26308"
    },
    {
      "cve": "CVE-2024-29025",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-816828",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-29025",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-29025.json"
        }
      ],
      "title": "CVE-2024-29025"
    },
    {
      "cve": "CVE-2024-29133",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-816828",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-29133",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-29133.json"
        }
      ],
      "title": "CVE-2024-29133"
    },
    {
      "cve": "CVE-2024-32114",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "notes": [
        {
          "category": "other",
          "text": "Missing Authentication for Critical Function",
          "title": "CWE-306"
        },
        {
          "category": "other",
          "text": "Initialization of a Resource with an Insecure Default",
          "title": "CWE-1188"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-816828",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-32114",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-32114.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-9711",
            "CSAFPID-9300",
            "CSAFPID-189066",
            "CSAFPID-189065",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-189067",
            "CSAFPID-93307",
            "CSAFPID-816828",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926"
          ]
        }
      ],
      "title": "CVE-2024-32114"
    }
  ]
}

CVE-2022-36944 (GCVE-0-2022-36944)

Vulnerability from cvelistv5 – Published: 2022-09-23 00:00 – Updated: 2025-05-27 14:56

Summary

Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Assigner

mitre

References

6 references

URL	Tags
https://www.scala-lang.org/download/
https://github.com/scala/scala/pull/10118
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://discuss.lightbend.com/t/impact-of-cve-202…
https://github.com/scala/scala-collection-compat/…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T10:21:31.984Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.scala-lang.org/download/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/scala/scala/pull/10118"
          },
          {
            "name": "FEDORA-2022-34acf878fb",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3WMKPFAMFQE3HJVRQ5KOJUTWG264SXI/"
          },
          {
            "name": "FEDORA-2022-07dd9375b2",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ZOZVWY3X72FZZCCRAKRJYTQOJ6LUD6Z/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://discuss.lightbend.com/t/impact-of-cve-2022-36944-on-akka-cluster-akka-actor-akka-remote/10007/2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/scala/scala-collection-compat/releases/tag/v2.9.0"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-36944",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-27T14:56:25.266129Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-502",
                "description": "CWE-502 Deserialization of Untrusted Data",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-27T14:56:43.802Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-06T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.scala-lang.org/download/"
        },
        {
          "url": "https://github.com/scala/scala/pull/10118"
        },
        {
          "name": "FEDORA-2022-34acf878fb",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3WMKPFAMFQE3HJVRQ5KOJUTWG264SXI/"
        },
        {
          "name": "FEDORA-2022-07dd9375b2",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ZOZVWY3X72FZZCCRAKRJYTQOJ6LUD6Z/"
        },
        {
          "url": "https://discuss.lightbend.com/t/impact-of-cve-2022-36944-on-akka-cluster-akka-actor-akka-remote/10007/2"
        },
        {
          "url": "https://github.com/scala/scala-collection-compat/releases/tag/v2.9.0"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-36944",
    "datePublished": "2022-09-23T00:00:00.000Z",
    "dateReserved": "2022-07-27T00:00:00.000Z",
    "dateUpdated": "2025-05-27T14:56:43.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-26031 (GCVE-0-2023-26031)

Vulnerability from cvelistv5 – Published: 2023-11-16 08:15 – Updated: 2025-02-13 16:44

Title

Privilege escalation in Apache Hadoop Yarn container-executor binary on Linux systems

Summary

Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN cluster is accepting work from remote (authenticated) users, this MAY permit remote users to gain root privileges. Hadoop 3.3.0 updated the " YARN Secure Containers https://hadoop.apache.org/docs/stable/hadoop-yarn/hadoop-yarn-site/SecureContainer.html " to add a feature for executing user-submitted applications in isolated linux containers. The native binary HADOOP_HOME/bin/container-executor is used to launch these containers; it must be owned by root and have the suid bit set in order for the YARN processes to run the containers as the specific users submitting the jobs. The patch " YARN-10495 https://issues.apache.org/jira/browse/YARN-10495 . make the rpath of container-executor configurable" modified the library loading path for loading .so files from "$ORIGIN/" to ""$ORIGIN/:../lib/native/". This is the a path through which libcrypto.so is located. Thus it is is possible for a user with reduced privileges to install a malicious libcrypto library into a path to which they have write access, invoke the container-executor command, and have their modified library executed as root. If the YARN cluster is accepting work from remote (authenticated) users, and these users' submitted job are executed in the physical host, rather than a container, then the CVE permits remote users to gain root privileges. The fix for the vulnerability is to revert the change, which is done in YARN-11441 https://issues.apache.org/jira/browse/YARN-11441 , "Revert YARN-10495". This patch is in hadoop-3.3.5. To determine whether a version of container-executor is vulnerable, use the readelf command. If the RUNPATH or RPATH value contains the relative path "./lib/native/" then it is at risk $ readelf -d container-executor|grep 'RUNPATH\|RPATH' 0x000000000000001d (RUNPATH) Library runpath: [$ORIGIN/:../lib/native/] If it does not, then it is safe: $ readelf -d container-executor|grep 'RUNPATH\|RPATH' 0x000000000000001d (RUNPATH) Library runpath: [$ORIGIN/] For an at-risk version of container-executor to enable privilege escalation, the owner must be root and the suid bit must be set $ ls -laF /opt/hadoop/bin/container-executor ---Sr-s---. 1 root hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor A safe installation lacks the suid bit; ideally is also not owned by root. $ ls -laF /opt/hadoop/bin/container-executor -rwxr-xr-x. 1 yarn hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor This configuration does not support Yarn Secure Containers, but all other hadoop services, including YARN job execution outside secure containers continue to work.

Severity

No CVSS data available.

CWE

CWE-426 - Untrusted Search Path

Assigner

apache

References

4 references

URL	Tags
https://issues.apache.org/jira/browse/YARN-11441	issue-tracking
https://hadoop.apache.org/cve_list.html	vendor-advisory
https://lists.apache.org/thread/q9qpdlv952gb4kphp…	vendor-advisory
https://security.netapp.com/advisory/ntap-2024011…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Hadoop	Affected: 3.3.1 , < 3.3.5 (semver)

Credits

Esa Hiltunen Mikko Kortelainen The Teragrep Project

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apache:hadoop:3.3.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "hadoop",
            "vendor": "apache",
            "versions": [
              {
                "lessThan": "3.3.5",
                "status": "affected",
                "version": "3.3.1",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-26031",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-19T03:55:27.490258Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-29T13:09:24.015Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T11:39:06.596Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "issue-tracking",
              "x_transferred"
            ],
            "url": "https://issues.apache.org/jira/browse/YARN-11441"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://hadoop.apache.org/cve_list.html"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/q9qpdlv952gb4kphpndd5phvl7fkh71r"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240112-0001/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Hadoop",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "3.3.5",
              "status": "affected",
              "version": "3.3.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The owner of the\u0026nbsp;container-executor binary must be set to \"root\" and suid set bit such that callers would execute the binary as root. These operations are a requirement for \"YARN Secure Containers\".\u003cbr\u003e \u003cbr\u003eIn an installation using the hadoop.tar.gz file the binary\u0027s owner is that of the installing user, and without the suid permission is not at risk. \u003cbr\u003e\u003cbr\u003eHowever, Apache BIgtop installations set the owner and permissions such that installations may be vulnerable\u003cbr\u003e\u003cbr\u003eThe container-executor\u0026nbsp;binary is only vulnerable on some Hadoop/Bigtop releases. It is possible to verify whether a version is vulnerable using the readelf command."
            }
          ],
          "value": "The owner of the\u00a0container-executor binary must be set to \"root\" and suid set bit such that callers would execute the binary as root. These operations are a requirement for \"YARN Secure Containers\".\n \nIn an installation using the hadoop.tar.gz file the binary\u0027s owner is that of the installing user, and without the suid permission is not at risk. \n\nHowever, Apache BIgtop installations set the owner and permissions such that installations may be vulnerable\n\nThe container-executor\u00a0binary is only vulnerable on some Hadoop/Bigtop releases. It is possible to verify whether a version is vulnerable using the readelf command."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Esa Hiltunen"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Mikko Kortelainen"
        },
        {
          "lang": "en",
          "type": "sponsor",
          "value": "The Teragrep Project"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cbr\u003eRelative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN cluster is accepting work from remote (authenticated) users, this MAY permit remote users to gain root privileges.\u003cbr\u003e\u003cbr\u003eHadoop 3.3.0 updated the \"\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://hadoop.apache.org/docs/stable/hadoop-yarn/hadoop-yarn-site/SecureContainer.html\"\u003eYARN Secure Containers\u003c/a\u003e\" to add a feature for executing user-submitted applications in isolated linux containers.\u003cbr\u003e\u003cbr\u003eThe native binary HADOOP_HOME/bin/container-executor is used to launch these containers; it must be owned by root and have the suid bit set in order for the YARN processes to run the containers as the specific users submitting the jobs.\u003cbr\u003e\u003cbr\u003eThe patch \"\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://issues.apache.org/jira/browse/YARN-10495\"\u003eYARN-10495\u003c/a\u003e. make the rpath of container-executor configurable\" modified the library loading path for loading .so files from \"$ORIGIN/\" to \"\"$ORIGIN/:../lib/native/\". This is the a path through which libcrypto.so is located. Thus it is is possible for a user with reduced privileges to install a malicious libcrypto library into a path to which they have write access, invoke the container-executor command, and have their modified library executed as root.\u003cbr\u003eIf the YARN cluster is accepting work from remote (authenticated) users, and these users\u0027 submitted job are executed in the physical host, rather than a container, then the CVE permits remote users to gain root privileges.\u003cbr\u003e\u003cbr\u003eThe fix for the vulnerability is to revert the change, which is done in \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://issues.apache.org/jira/browse/YARN-11441\"\u003eYARN-11441\u003c/a\u003e, \"Revert YARN-10495\". This patch is in hadoop-3.3.5.\u003cbr\u003e\u003cbr\u003eTo determine whether a version of container-executor is vulnerable, use the readelf command. If the RUNPATH or RPATH value contains the relative path \"./lib/native/\" then it  is at risk\u003cbr\u003e\u003cbr\u003e\u003ctt\u003e$ readelf -d container-executor|grep \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0027RUNPATH\\|RPATH\u0027\u003c/span\u003e \u003cbr\u003e0x000000000000001d (RUNPATH)  \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; Library runpath: [$ORIGIN/:../lib/native/]\u003c/tt\u003e\u003cbr\u003e\u003cbr\u003eIf it does not, then it is safe:\u003cbr\u003e\u003cbr\u003e\u003ctt\u003e$ readelf -d container-executor|grep \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0027RUNPATH\\|RPATH\u0027\u003c/span\u003e \u003cbr\u003e0x000000000000001d (RUNPATH)  \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; Library runpath: [$ORIGIN/]\u003c/tt\u003e\u003cbr\u003e\u003cbr\u003eFor an at-risk version of container-executor to enable privilege escalation, the owner must be root and the suid bit must be set\u003cbr\u003e\u003ctt\u003e\u003cbr\u003e$ ls -laF /opt/hadoop/bin/container-executor\u003cbr\u003e---Sr-s---. 1 root hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor\u003c/tt\u003e\u003cbr\u003e\u003cbr\u003eA safe installation lacks the suid bit; ideally is also not owned by root.\u003cbr\u003e\u003cbr\u003e\u003ctt\u003e$ ls -laF /opt/hadoop/bin/container-executor\u003cbr\u003e-rwxr-xr-x. 1 yarn hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor\u003c/tt\u003e\u003cbr\u003e\u003cbr\u003eThis configuration does not support Yarn Secure Containers, but all other hadoop services, including YARN job execution outside secure containers continue to work.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN cluster is accepting work from remote (authenticated) users, this MAY permit remote users to gain root privileges.\n\nHadoop 3.3.0 updated the \" YARN Secure Containers https://hadoop.apache.org/docs/stable/hadoop-yarn/hadoop-yarn-site/SecureContainer.html \" to add a feature for executing user-submitted applications in isolated linux containers.\n\nThe native binary HADOOP_HOME/bin/container-executor is used to launch these containers; it must be owned by root and have the suid bit set in order for the YARN processes to run the containers as the specific users submitting the jobs.\n\nThe patch \" YARN-10495 https://issues.apache.org/jira/browse/YARN-10495 . make the rpath of container-executor configurable\" modified the library loading path for loading .so files from \"$ORIGIN/\" to \"\"$ORIGIN/:../lib/native/\". This is the a path through which libcrypto.so is located. Thus it is is possible for a user with reduced privileges to install a malicious libcrypto library into a path to which they have write access, invoke the container-executor command, and have their modified library executed as root.\nIf the YARN cluster is accepting work from remote (authenticated) users, and these users\u0027 submitted job are executed in the physical host, rather than a container, then the CVE permits remote users to gain root privileges.\n\nThe fix for the vulnerability is to revert the change, which is done in  YARN-11441 https://issues.apache.org/jira/browse/YARN-11441 , \"Revert YARN-10495\". This patch is in hadoop-3.3.5.\n\nTo determine whether a version of container-executor is vulnerable, use the readelf command. If the RUNPATH or RPATH value contains the relative path \"./lib/native/\" then it  is at risk\n\n$ readelf -d container-executor|grep \u0027RUNPATH\\|RPATH\u0027 \n0x000000000000001d (RUNPATH)  \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Library runpath: [$ORIGIN/:../lib/native/]\n\nIf it does not, then it is safe:\n\n$ readelf -d container-executor|grep \u0027RUNPATH\\|RPATH\u0027 \n0x000000000000001d (RUNPATH)  \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Library runpath: [$ORIGIN/]\n\nFor an at-risk version of container-executor to enable privilege escalation, the owner must be root and the suid bit must be set\n\n$ ls -laF /opt/hadoop/bin/container-executor\n---Sr-s---. 1 root hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor\n\nA safe installation lacks the suid bit; ideally is also not owned by root.\n\n$ ls -laF /opt/hadoop/bin/container-executor\n-rwxr-xr-x. 1 yarn hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor\n\nThis configuration does not support Yarn Secure Containers, but all other hadoop services, including YARN job execution outside secure containers continue to work."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "critical"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-426",
              "description": "CWE-426 Untrusted Search Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-12T14:06:17.973Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://issues.apache.org/jira/browse/YARN-11441"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://hadoop.apache.org/cve_list.html"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/q9qpdlv952gb4kphpndd5phvl7fkh71r"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240112-0001/"
        }
      ],
      "source": {
        "defect": [
          "YARN-11441"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Privilege escalation in Apache Hadoop Yarn container-executor binary on Linux systems",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003col\u003e\u003cli\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eUpgrade to Apache Hadoop 3.3.5\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eIf\u0026nbsp;Yarn Secure Containers are not required, remove all execute permissions on bin/container-executor ; change its owner from root, or simply delete it.\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eIf Yarn Secure Containers are required on a vulnerable release and upgrade is not possible, replace the container-executor\u0026nbsp;binary with that of the 3.3.5 release.\u003c/span\u003e\u003cbr\u003e\u003c/li\u003e\u003c/ol\u003eAs most Hadoop installations do not use Yarn Secure Containers, removing execute permissions from the container-executor binary a is sufficient to secure the systems; deletion ensures that no security scanners will report the issue."
            }
          ],
          "value": "*  Upgrade to Apache Hadoop 3.3.5\n  *  If\u00a0Yarn Secure Containers are not required, remove all execute permissions on bin/container-executor ; change its owner from root, or simply delete it.\n  *  If Yarn Secure Containers are required on a vulnerable release and upgrade is not possible, replace the container-executor\u00a0binary with that of the 3.3.5 release.\n\nAs most Hadoop installations do not use Yarn Secure Containers, removing execute permissions from the container-executor binary a is sufficient to secure the systems; deletion ensures that no security scanners will report the issue."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2023-26031",
    "datePublished": "2023-11-16T08:15:50.808Z",
    "dateReserved": "2023-02-17T19:39:48.891Z",
    "dateUpdated": "2025-02-13T16:44:42.474Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-34055 (GCVE-0-2023-34055)

Vulnerability from cvelistv5 – Published: 2023-11-28 08:27 – Updated: 2025-02-13 16:55

Title

Spring Boot server Web Observations DoS Vulnerability

Summary

In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC or Spring WebFlux * org.springframework.boot:spring-boot-actuator is on the classpath

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Assigner

vmware

References

2 references

URL	Tags
https://spring.io/security/cve-2023-34055
https://security.netapp.com/advisory/ntap-2023122…

Impacted products

1 product

Vendor	Product	Version
Spring	Spring Boot	Affected: 2.7.0 , < 2.7.18 (2.7.18) Affected: 3.0.0 , < 3.0.13 (3.0.13) Affected: 3.1.0 , < 3.1.6 (3.1.6) Affected: older unsupported versions

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:01:52.436Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://spring.io/security/cve-2023-34055"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20231221-0010/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "MacOS",
            "Linux"
          ],
          "product": "Spring Boot",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "2.7.18",
              "status": "affected",
              "version": "2.7.0",
              "versionType": "2.7.18"
            },
            {
              "lessThan": "3.0.13",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "3.0.13"
            },
            {
              "lessThan": "3.1.6",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "3.1.6"
            },
            {
              "status": "affected",
              "version": "older unsupported versions"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\u003c/p\u003e\u003cp\u003eSpecifically, an application is vulnerable when all of the following are true:\u003c/p\u003e\u003cul\u003e\u003cli\u003ethe application uses Spring MVC or Spring WebFlux\u003c/li\u003e\u003cli\u003e\u003ccode\u003eorg.springframework.boot:spring-boot-actuator\u003c/code\u003e\u0026nbsp;is on the classpath\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e"
            }
          ],
          "value": "In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nSpecifically, an application is vulnerable when all of the following are true:\n\n  *  the application uses Spring MVC or Spring WebFlux\n  *  org.springframework.boot:spring-boot-actuator\u00a0is on the classpath"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-21T22:06:28.480Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2023-34055"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231221-0010/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring Boot server Web Observations DoS Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2023-34055",
    "datePublished": "2023-11-28T08:27:25.132Z",
    "dateReserved": "2023-05-25T17:21:56.203Z",
    "dateUpdated": "2025-02-13T16:55:15.158Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-44483 (GCVE-0-2023-44483)

Vulnerability from cvelistv5 – Published: 2023-10-20 09:23 – Updated: 2025-11-03 21:49

Title

Apache Santuario: Private Key disclosure in debug-log output

Summary

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.

Severity

No CVSS data available.

CWE

CWE-532 - Insertion of Sensitive Information into Log File

Assigner

apache

References

2 references

URL	Tags
https://lists.apache.org/thread/vmqbp9mfxtrf0kmbn…	vendor-advisory
http://www.openwall.com/lists/oss-security/2023/10/20/5

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Santuario	Affected: 2.2 , < 2.2.6 (semver) Affected: 2.3 , < 2.3.4 (semver) Affected: 3.0 , < 3.0.3 (semver)

Credits

Apache Santuario would like to thank Max Fichtelmann for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:49:47.169Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/vmqbp9mfxtrf0kmbnnmbn3h9j6dr9q55"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/10/20/5"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20241108-0002/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-44483",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-12T14:33:15.116438Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T14:36:02.225Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Santuario",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "2.2.6",
              "status": "affected",
              "version": "2.2",
              "versionType": "semver"
            },
            {
              "lessThan": "2.3.4",
              "status": "affected",
              "version": "2.3",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.3",
              "status": "affected",
              "version": "3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apache Santuario would like to thank Max Fichtelmann for reporting this issue."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled.\u0026nbsp;Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.\u003cbr\u003e"
            }
          ],
          "value": "All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled.\u00a0Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532 Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-20T09:25:12.008Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/vmqbp9mfxtrf0kmbnnmbn3h9j6dr9q55"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2023/10/20/5"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Santuario: Private Key disclosure in debug-log output",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2023-44483",
    "datePublished": "2023-10-20T09:23:53.483Z",
    "dateReserved": "2023-09-29T15:05:04.230Z",
    "dateUpdated": "2025-11-03T21:49:47.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-47248 (GCVE-0-2023-47248)

Vulnerability from cvelistv5 – Published: 2023-11-09 08:17 – Updated: 2025-02-13 17:17

Title

PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file

Summary

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files). This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings. It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon. If it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions.

Severity

No CVSS data available.

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

apache

References

6 references

URL	Tags
https://lists.apache.org/thread/yhy7tdfjf9hrl9vfr…	vendor-advisory
https://github.com/apache/arrow/commit/f141709763…	patch
https://pypi.org/project/pyarrow-hotfix/	mitigation
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…

Impacted products

2 products

Vendor	Product	Version
Apache Software Foundation	PyArrow	Affected: 0.14.0 , ≤ 14.0.0 (semver)
Apache Software Foundation	PyArrow	Affected: 0.14.0 , ≤ 14.0.0 (semver)

Credits

Li Jiakun - laoquanshi

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T21:09:35.873Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7n"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/apache/arrow/commit/f14170976372436ec1d03a724d8d3f3925484ecf"
          },
          {
            "tags": [
              "mitigation",
              "x_transferred"
            ],
            "url": "https://pypi.org/project/pyarrow-hotfix/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FR34AIPXVTMB3XPRU5ULV5HHWPMRE33X/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MAGWEAJDWO2ACYATUQCPXLSYY5C3L3XU/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWFYXLVBTBHNKYRXI572RFX7IJDDQGBL/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.org/",
          "defaultStatus": "unaffected",
          "packageName": "pyarrow",
          "product": "PyArrow",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "14.0.0",
              "status": "affected",
              "version": "0.14.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://conda-forge.org/",
          "defaultStatus": "unaffected",
          "packageName": "pyarrow",
          "product": "PyArrow",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "14.0.0",
              "status": "affected",
              "version": "0.14.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Li Jiakun - laoquanshi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eDeserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThis vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eIt is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eIf it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://pypi.org/project/pyarrow-hotfix/\"\u003ehttps://pypi.org/project/pyarrow-hotfix/\u003c/a\u003e for instructions.\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e"
            }
          ],
          "value": "Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).\n\nThis vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.\n\nIt is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.\n\nIf it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See  https://pypi.org/project/pyarrow-hotfix/  for instructions."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "critical"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-29T02:06:17.530Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7n"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/arrow/commit/f14170976372436ec1d03a724d8d3f3925484ecf"
        },
        {
          "tags": [
            "mitigation"
          ],
          "url": "https://pypi.org/project/pyarrow-hotfix/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FR34AIPXVTMB3XPRU5ULV5HHWPMRE33X/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MAGWEAJDWO2ACYATUQCPXLSYY5C3L3XU/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWFYXLVBTBHNKYRXI572RFX7IJDDQGBL/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2023-47248",
    "datePublished": "2023-11-09T08:17:08.431Z",
    "dateReserved": "2023-11-04T18:51:21.216Z",
    "dateUpdated": "2025-02-13T17:17:56.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-50447 (GCVE-0-2023-50447)

Vulnerability from cvelistv5 – Published: 2024-01-19 00:00 – Updated: 2024-08-02 22:16

Summary

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Assigner

mitre

References

5 references

URL	Tags
https://github.com/python-pillow/Pillow/releases
https://devhub.checkmarx.com/cve-details/CVE-2023…
http://www.openwall.com/lists/oss-security/2024/01/20/1	mailing-list
https://lists.debian.org/debian-lts-announce/2024…	mailing-list
https://duartecsantos.github.io/2024-01-02-CVE-20…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "pillow",
            "vendor": "python",
            "versions": [
              {
                "lessThanOrEqual": "10.1.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-50447",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-19T03:55:36.638240Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-95",
                "description": "CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-19T14:47:58.764Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:16:46.654Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/python-pillow/Pillow/releases"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://devhub.checkmarx.com/cve-details/CVE-2023-50447/"
          },
          {
            "name": "[oss-security] 20240120 Pillow 10.2.0 released, fixes CVE-2023-50447",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/01/20/1"
          },
          {
            "name": "[debian-lts-announce] 20240129 [SECURITY] [DLA 3724-1] pillow security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00019.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://duartecsantos.github.io/2024-01-02-CVE-2023-50447/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-27T20:43:48.418Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/python-pillow/Pillow/releases"
        },
        {
          "url": "https://devhub.checkmarx.com/cve-details/CVE-2023-50447/"
        },
        {
          "name": "[oss-security] 20240120 Pillow 10.2.0 released, fixes CVE-2023-50447",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2024/01/20/1"
        },
        {
          "name": "[debian-lts-announce] 20240129 [SECURITY] [DLA 3724-1] pillow security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00019.html"
        },
        {
          "url": "https://duartecsantos.github.io/2024-01-02-CVE-2023-50447/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-50447",
    "datePublished": "2024-01-19T00:00:00.000Z",
    "dateReserved": "2023-12-10T00:00:00.000Z",
    "dateUpdated": "2024-08-02T22:16:46.654Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-51074 (GCVE-0-2023-51074)

Vulnerability from cvelistv5 – Published: 2023-12-27 00:00 – Updated: 2024-08-02 22:32

Summary

json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

1 reference

URL	Tags
https://github.com/json-path/JsonPath/issues/973

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:32:08.933Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/json-path/JsonPath/issues/973"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-27T20:56:22.383Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/json-path/JsonPath/issues/973"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-51074",
    "datePublished": "2023-12-27T00:00:00.000Z",
    "dateReserved": "2023-12-18T00:00:00.000Z",
    "dateUpdated": "2024-08-02T22:32:08.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-52425 (GCVE-0-2023-52425)

Vulnerability from cvelistv5 – Published: 2024-02-04 00:00 – Updated: 2025-11-04 18:21

Summary

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

Assigner

mitre

References

6 references

URL	Tags
https://github.com/libexpat/libexpat/pull/789
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2024…	mailing-list
http://www.openwall.com/lists/oss-security/2024/03/20/5	mailing-list
https://security.netapp.com/advisory/ntap-2024061…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:21:45.774Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/libexpat/libexpat/pull/789"
          },
          {
            "name": "FEDORA-2024-fbe1f0c1aa",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/"
          },
          {
            "name": "FEDORA-2024-b8656bc059",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/"
          },
          {
            "name": "[debian-lts-announce] 20240409 [SECURITY] [DLA 3783-1] expat security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00006.html"
          },
          {
            "name": "[oss-security] 20240320 Security fixes in Python 3.10.14, 3.9.19, and 3.8.19 (CVE-2023-6597 \u0026 CVE-2024-0450)",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/03/20/5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240614-0003/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "libexpat",
            "vendor": "libexpat_project",
            "versions": [
              {
                "lessThanOrEqual": "2.5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-52425",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-26T19:20:56.852251Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-26T19:22:48.969Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-14T13:06:11.482Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/libexpat/libexpat/pull/789"
        },
        {
          "name": "FEDORA-2024-fbe1f0c1aa",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/"
        },
        {
          "name": "FEDORA-2024-b8656bc059",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/"
        },
        {
          "name": "[debian-lts-announce] 20240409 [SECURITY] [DLA 3783-1] expat security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00006.html"
        },
        {
          "name": "[oss-security] 20240320 Security fixes in Python 3.10.14, 3.9.19, and 3.8.19 (CVE-2023-6597 \u0026 CVE-2024-0450)",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2024/03/20/5"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240614-0003/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-52425",
    "datePublished": "2024-02-04T00:00:00.000Z",
    "dateReserved": "2024-02-04T00:00:00.000Z",
    "dateUpdated": "2025-11-04T18:21:45.774Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-6129 (GCVE-0-2023-6129)

Vulnerability from cvelistv5 – Published: 2024-01-09 16:36 – Updated: 2026-05-12 10:36

Title

POLY1305 MAC implementation corrupts vector registers on PowerPC

Summary

Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL for PowerPC CPUs restores the contents of vector registers in a different order than they are saved. Thus the contents of some of these vector registers are corrupted when returning to the caller. The vulnerable code is used only on newer PowerPC processors supporting the PowerISA 2.07 instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However unless the compiler uses the vector registers for storing pointers, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3. If this cipher is enabled on the server a malicious client can influence whether this AEAD cipher is used. This implies that TLS server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue.

Severity

No CVSS data available.

CWE

CWE-440 - Expected Behavior Violation

Assigner

openssl

References

4 references

URL	Tags
https://www.openssl.org/news/secadv/20240109.txt	vendor-advisory
https://github.com/openssl/openssl/commit/5b139f9…	patch
https://github.com/openssl/openssl/commit/f3fc580…	patch
https://github.com/openssl/openssl/commit/050d263…	patch

Impacted products

1 product

Vendor	Product	Version
OpenSSL	OpenSSL	Affected: 3.2.0 , < 3.2.1 (semver) Affected: 3.1.0 , < 3.1.5 (semver) Affected: 3.0.0 , < 3.0.13 (semver)

Date Public

2024-01-09 00:00

Credits

Sverker Eriksson Rohan McLure

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:21:17.314Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "OpenSSL Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20240109.txt"
          },
          {
            "name": "3.2.1 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/5b139f95c9a47a55a0c54100f3837b1eee942b04"
          },
          {
            "name": "3.1.5 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/f3fc5808fe9ff74042d639839610d03b8fdcc015"
          },
          {
            "name": "3.0.13 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/050d26383d4e264966fb83428e72d5d48f402d35"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240216-0009/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240426-0013/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240426-0008/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/03/11/1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240503-0011/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-6129",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-22T14:31:57.012999Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-20T15:28:07.908Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SINEC NMS",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.0 SP1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T10:36:44.839Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-331112.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-915275.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "3.2.1",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.1.5",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.13",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Sverker Eriksson"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Rohan McLure"
        }
      ],
      "datePublic": "2024-01-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: The POLY1305 MAC (message authentication code) implementation\u003cbr\u003econtains a bug that might corrupt the internal state of applications running\u003cbr\u003eon PowerPC CPU based platforms if the CPU provides vector instructions.\u003cbr\u003e\u003cbr\u003eImpact summary: If an attacker can influence whether the POLY1305 MAC\u003cbr\u003ealgorithm is used, the application state might be corrupted with various\u003cbr\u003eapplication dependent consequences.\u003cbr\u003e\u003cbr\u003eThe POLY1305 MAC (message authentication code) implementation in OpenSSL for\u003cbr\u003ePowerPC CPUs restores the contents of vector registers in a different order\u003cbr\u003ethan they are saved. Thus the contents of some of these vector registers\u003cbr\u003eare corrupted when returning to the caller. The vulnerable code is used only\u003cbr\u003eon newer PowerPC processors supporting the PowerISA 2.07 instructions.\u003cbr\u003e\u003cbr\u003eThe consequences of this kind of internal application state corruption can\u003cbr\u003ebe various - from no consequences, if the calling application does not\u003cbr\u003edepend on the contents of non-volatile XMM registers at all, to the worst\u003cbr\u003econsequences, where the attacker could get complete control of the application\u003cbr\u003eprocess. However unless the compiler uses the vector registers for storing\u003cbr\u003epointers, the most likely consequence, if any, would be an incorrect result\u003cbr\u003eof some application dependent calculations or a crash leading to a denial of\u003cbr\u003eservice.\u003cbr\u003e\u003cbr\u003eThe POLY1305 MAC algorithm is most frequently used as part of the\u003cbr\u003eCHACHA20-POLY1305 AEAD (authenticated encryption with associated data)\u003cbr\u003ealgorithm. The most common usage of this AEAD cipher is with TLS protocol\u003cbr\u003eversions 1.2 and 1.3. If this cipher is enabled on the server a malicious\u003cbr\u003eclient can influence whether this AEAD cipher is used. This implies that\u003cbr\u003eTLS server applications using OpenSSL can be potentially impacted. However\u003cbr\u003ewe are currently not aware of any concrete application that would be affected\u003cbr\u003eby this issue therefore we consider this a Low severity security issue."
            }
          ],
          "value": "Issue summary: The POLY1305 MAC (message authentication code) implementation\ncontains a bug that might corrupt the internal state of applications running\non PowerPC CPU based platforms if the CPU provides vector instructions.\n\nImpact summary: If an attacker can influence whether the POLY1305 MAC\nalgorithm is used, the application state might be corrupted with various\napplication dependent consequences.\n\nThe POLY1305 MAC (message authentication code) implementation in OpenSSL for\nPowerPC CPUs restores the contents of vector registers in a different order\nthan they are saved. Thus the contents of some of these vector registers\nare corrupted when returning to the caller. The vulnerable code is used only\non newer PowerPC processors supporting the PowerISA 2.07 instructions.\n\nThe consequences of this kind of internal application state corruption can\nbe various - from no consequences, if the calling application does not\ndepend on the contents of non-volatile XMM registers at all, to the worst\nconsequences, where the attacker could get complete control of the application\nprocess. However unless the compiler uses the vector registers for storing\npointers, the most likely consequence, if any, would be an incorrect result\nof some application dependent calculations or a crash leading to a denial of\nservice.\n\nThe POLY1305 MAC algorithm is most frequently used as part of the\nCHACHA20-POLY1305 AEAD (authenticated encryption with associated data)\nalgorithm. The most common usage of this AEAD cipher is with TLS protocol\nversions 1.2 and 1.3. If this cipher is enabled on the server a malicious\nclient can influence whether this AEAD cipher is used. This implies that\nTLS server applications using OpenSSL can be potentially impacted. However\nwe are currently not aware of any concrete application that would be affected\nby this issue therefore we consider this a Low severity security issue."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://www.openssl.org/policies/secpolicy.html"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-440",
              "description": "CWE-440 Expected Behavior Violation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-14T14:55:55.315Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.openssl.org/news/secadv/20240109.txt"
        },
        {
          "name": "3.2.1 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/5b139f95c9a47a55a0c54100f3837b1eee942b04"
        },
        {
          "name": "3.1.5 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/f3fc5808fe9ff74042d639839610d03b8fdcc015"
        },
        {
          "name": "3.0.13 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/050d26383d4e264966fb83428e72d5d48f402d35"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "POLY1305 MAC implementation corrupts vector registers on PowerPC",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2023-6129",
    "datePublished": "2024-01-09T16:36:58.860Z",
    "dateReserved": "2023-11-14T16:12:12.656Z",
    "dateUpdated": "2026-05-12T10:36:44.839Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-21188 (GCVE-0-2024-21188)

Vulnerability from cvelistv5 – Published: 2024-07-16 22:40 – Updated: 2025-03-13 20:03

Summary

Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Chatbot). Supported versions that are affected are 6.0.0.0.0 and 6.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Revenue Management and Billing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Revenue Management and Billing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Revenue Management and Billing accessible data as well as unauthorized read access to a subset of Oracle Financial Services Revenue Management and Billing accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Revenue Management and Billing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Revenue Management and Billing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Revenue Management and Billing accessible data as well as unauthorized read access to a subset of Oracle Financial Services Revenue Management and Billing accessible data.

Assigner

oracle

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpujul2024.html	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	Financial Services Revenue Management and Billing	Affected: 6.0.0.0.0 Affected: 6.1.0.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21188",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-17T14:36:56.506618Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-13T20:03:37.845Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:13:42.785Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Oracle Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2024.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Financial Services Revenue Management and Billing",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "6.0.0.0.0"
            },
            {
              "status": "affected",
              "version": "6.1.0.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Chatbot).  Supported versions that are affected are 6.0.0.0.0 and  6.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Revenue Management and Billing.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Revenue Management and Billing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Financial Services Revenue Management and Billing accessible data as well as  unauthorized read access to a subset of Oracle Financial Services Revenue Management and Billing accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Revenue Management and Billing.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Revenue Management and Billing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Financial Services Revenue Management and Billing accessible data as well as  unauthorized read access to a subset of Oracle Financial Services Revenue Management and Billing accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-16T22:40:12.391Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21188",
    "datePublished": "2024-07-16T22:40:12.391Z",
    "dateReserved": "2023-12-07T22:28:10.688Z",
    "dateUpdated": "2025-03-13T20:03:37.845Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Product	Identifier	Version
financial_services_cash_flow_engine oracle	`cpe:2.3:a:oracle:financial_services_cash_flow_engine:8.1.2.0.0:::::::*`	—
financial_services_model_management_and_governance oracle	`cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.3:::::::*`	—
financial_services_model_management_and_governance oracle	`cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.4:::::::*`	—
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.9:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.6:::::::*`	—
financial_services_compliance_studio oracle	`cpe:2.3:a:oracle:financial_services_compliance_studio:8.1.2.5:::::::*`	—
financial_services_enterprise_case_management oracle	`cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.6:::::::*`	—
financial_services_lending_and_leasing oracle	`cpe:2.3:a:oracle:financial_services_lending_and_leasing::::::::`	—
financial_services_revenue_management_and_billing oracle	`cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.7.1:::::::*`	—
financial_services_revenue_management_and_billing oracle	`cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.8.0:::::::*`	—
financial_services_revenue_management_and_billing oracle	`cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:_pricing_services___2.9.0:::::::*`	—
financial_services_revenue_management_and_billing oracle	`cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.9.0:::::::*`	—
financial_services_revenue_management_and_billing oracle	`cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.9.1:::::::*`	—
financial_services_revenue_management_and_billing oracle	`cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:3.0.0:::::::*`	—
financial_services_revenue_management_and_billing oracle	`cpe:2.3:a:oracle:financial_services_revenue_management_and_billing::::::::`	—
financial_services_revenue_management_and_billing oracle	`cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:3.1.0:::::::*`	—
financial_services_revenue_management_and_billing oracle	`cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:3.2.0:::::::*`	—
financial_services_revenue_management_and_billing oracle	`cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:4.0.0:::::::*`	—
financial_services_revenue_management_and_billing oracle	`cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:5.0.0:::::::*`	—
financial_services_revenue_management_and_billing oracle	`cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:_security___5.1.0:::::::*`	—
financial_services_revenue_management_and_billing oracle	`cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:5.1.0:::::::*`	—
financial_services_revenue_management_and_billing oracle	`cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:6.0.0:::::::*`	—
financial_services_model_management_and_governance oracle	`cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.5:::::::*`	—
financial_services_model_management_and_governance oracle	`cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.6:::::::*`	—
financial_services_basel_regulatory_capital_basic oracle	`cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.0.7.3:::::::*`	—
financial_services_basel_regulatory_capital_basic oracle	`cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.0.8.3:::::::*`	—
financial_services_basel_regulatory_capital_internal_ratings_based_approach oracle	`cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.0.7.3:::::::*`	—
financial_services_basel_regulatory_capital_internal_ratings_based_approach oracle	`cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.0.8.3:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.7:::::::*`	—
financial_services_compliance_studio oracle	`cpe:2.3:a:oracle:financial_services_compliance_studio:8.1.2.6:::::::*`	—
financial_services_compliance_studio oracle	`cpe:2.3:a:oracle:financial_services_compliance_studio:8.1.2.7:::::::*`	—
financial_services_enterprise_case_management oracle	`cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.2.8:::::::*`	—
financial_services_enterprise_case_management oracle	`cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1.18:::::::*`	—
financial_services_enterprise_case_management oracle	`cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.6.4:::::::*`	—
financial_services_enterprise_case_management oracle	`cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.7.3:::::::*`	—
financial_services_revenue_management_and_billing oracle	`cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:6.0.0.0.0:::::::*`	—
financial_services_revenue_management_and_billing oracle	`cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:6.1.0.0.0:::::::*`	—
financial_services_trade-based_anti_money_laundering_enterprise_edition oracle	`cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering_enterprise_edition:8.0.8.0:::::::*`	—
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7:::::::*`	—
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.8:::::::*`	—
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.0:::::::*`	—
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1:::::::*`	—
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.8.1:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.4:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.5:::::::*`	—
financial_services_compliance_studio oracle	`cpe:2.3:a:oracle:financial_services_compliance_studio:8.1.2.4:::::::*`	—
financial_services_enterprise_case_management oracle	`cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.2:::::::*`	—
financial_services_enterprise_case_management oracle	`cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:::::::*`	—
financial_services_enterprise_case_management oracle	`cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.4:::::::*`	—
financial_services_enterprise_case_management oracle	`cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.5:::::::*`	—
financial_services_trade-based_anti_money_laundering_enterprise_edition oracle	`cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering_enterprise_edition:8.0.8:::::::*`	—

Action not permitted

NCSC-2024-0297

CVE-2022-36944 (GCVE-0-2022-36944)

CVE-2023-26031 (GCVE-0-2023-26031)

CVE-2023-34055 (GCVE-0-2023-34055)

CVE-2023-44483 (GCVE-0-2023-44483)

CVE-2023-47248 (GCVE-0-2023-47248)

CVE-2023-50447 (GCVE-0-2023-50447)

CVE-2023-51074 (GCVE-0-2023-51074)

CVE-2023-52425 (GCVE-0-2023-52425)

CVE-2023-6129 (GCVE-0-2023-6129)

CVE-2024-21188 (GCVE-0-2024-21188)

Tags

Sightings

Nomenclature