Vulnerability-Lookup

NCSC-2025-0025

Vulnerability from csaf_ncscnl - Published: 2025-01-22 13:33 - Updated: 2025-01-22 13:33

Summary

Kwetsbaarheden verholpen in Oracle Financial Services

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten: Oracle heeft meerdere kwetsbaarheden verholpen in Financial Services en componenten.

Interpretaties: De kwetsbaarheden stellen ongeauthenticeerde aanvallers in staat om toegang te krijgen tot kritieke gegevens en de systeemintegriteit in gevaar te brengen. Specifieke kwetsbaarheden kunnen leiden tot compromittering van vertrouwelijkheid, integriteit en beschikbaarheid, met schadeclassificaties variërend van gemiddeld tot hoog. Sommige kwetsbaarheden kunnen op afstand worden uitgebuit zonder gebruikersinteractie, wat het risico op privilege-escalatie en denial-of-service vergroot.

Oplossingen: Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Kans: medium

Schade: high

CWE-681: Incorrect Conversion between Numeric Types

CWE-20: Improper Input Validation

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-131: Incorrect Calculation of Buffer Size

CWE-178: Improper Handling of Case Sensitivity

CWE-284: Improper Access Control

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-611: Improper Restriction of XML External Entity Reference

CWE-670: Always-Incorrect Control Flow Implementation

CWE-192: Integer Coercion Error

CWE-676: Use of Potentially Dangerous Function

CWE-222: Truncation of Security-relevant Information

CWE-755: Improper Handling of Exceptional Conditions

CWE-704: Incorrect Type Conversion or Cast

CWE-680: Integer Overflow to Buffer Overflow

CWE-426: Untrusted Search Path

CWE-354: Improper Validation of Integrity Check Value

CWE-190: Integer Overflow or Wraparound

CWE-532: Insertion of Sensitive Information into Log File

CWE-639: Authorization Bypass Through User-Controlled Key

CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

CWE-400: Uncontrolled Resource Consumption

CWE-502: Deserialization of Untrusted Data

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-121: Stack-based Buffer Overflow

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2022-34169

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-192 - Integer Coercion Error

Affected products

Known affected 155 products

CVE-2023-26031

CWE-426 - Untrusted Search Path

Affected products

Known affected 34 products

CVE-2023-33201

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Affected products

Known affected 74 products

CVE-2023-39410

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-502 - Deserialization of Untrusted Data

Affected products

Known affected 40 products

CVE-2023-44483

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-532 - Insertion of Sensitive Information into Log File

Affected products

Known affected 69 products

CVE-2023-48795

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-222 - Truncation of Security-relevant Information

Affected products

Known affected 69 products

CVE-2023-51074

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-121 - Stack-based Buffer Overflow

Affected products

Known affected 45 products

CVE-2023-52070

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
financial_services_revenue_management_and_billing oracle	`cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.9.0.0.0-7.0.0.0.0:::::::*`	—

CVE-2024-28219

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
financial_services_compliance_studio oracle	`cpe:2.3:a:oracle:financial_services_compliance_studio:8.1.2.6:::::::*`	—
banking_liquidity_management oracle	`cpe:2.3:a:oracle:banking_liquidity_management:14.7.5.0.0:::::::*`	—

CVE-2024-34064

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Known affected 36 products

CVE-2024-34750

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-755 - Improper Handling of Exceptional Conditions

Affected products

Known affected 3 products

Product	Identifier	Version
financial_services_model_management_and_governance oracle	`cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.7:::::::*`	—
financial_services_model_management_and_governance oracle	`cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.3.0:::::::*`	—
financial_services_model_management_and_governance oracle	`cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.6:::::::*`	—

CVE-2024-35195

5.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

CWE-670 - Always-Incorrect Control Flow Implementation

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
banking_liquidity_management oracle	`cpe:2.3:a:oracle:banking_liquidity_management:14.7.5.0.0:::::::*`	—
financial_services_compliance_studio oracle	`cpe:2.3:a:oracle:financial_services_compliance_studio:8.1.2.6:::::::*`	—

CVE-2024-38819

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Known affected 9 products

Product	Identifier	Version
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7.8:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.7:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.8:::::::*`	—
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.5:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.8.1:::::::*`	—
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.8.6:::::::*`	—
financial_services_model_management_and_governance oracle	`cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.3.0:::::::*`	—
financial_services_compliance_studio oracle	`cpe:2.3:a:oracle:financial_services_compliance_studio:8.1.2.6:::::::*`	—
financial_services_trade-based_anti_money_laundering oracle	`cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.8::::enterprise:::`	—

CVE-2024-38820

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-284 - Improper Access Control

Affected products

Known affected 9 products

Product	Identifier	Version
financial_services_trade-based_anti_money_laundering oracle	`cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.8::::enterprise:::`	—
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.8.6:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.7:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.8:::::::*`	—
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.5:::::::*`	—
financial_services_compliance_studio oracle	`cpe:2.3:a:oracle:financial_services_compliance_studio:8.1.2.6:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.8.1:::::::*`	—
financial_services_model_management_and_governance oracle	`cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.3.0:::::::*`	—
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7.8:::::::*`	—

CVE-2024-38827

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-639 - Authorization Bypass Through User-Controlled Key

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
financial_services_compliance_studio oracle	`cpe:2.3:a:oracle:financial_services_compliance_studio:8.1.2.6:::::::*`	—

CVE-2024-38998

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Affected products

Known affected 13 products

Product	Identifier	Version
financial_services_trade-based_anti_money_laundering oracle	`cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.8::::enterprise:::`	—
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.8.6:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.8.1:::::::*`	—
financial_services_model_management_and_governance oracle	`cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.6:::::::*`	—
financial_services_model_management_and_governance oracle	`cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.7:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.7:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.8:::::::*`	—
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.5:::::::*`	—
financial_services_regulatory_reporting oracle	`cpe:2.3:a:oracle:financial_services_regulatory_reporting:8.1.2.8:::::::*`	—
financial_services_regulatory_reporting oracle	`cpe:2.3:a:oracle:financial_services_regulatory_reporting:8.1.2.7:::::::*`	—
financial_services_enterprise_case_management oracle	`cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.2:::::::*`	—
financial_services_model_management_and_governance oracle	`cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.3.0:::::::*`	—
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7.8:::::::*`	—

CVE-2024-38999

10.0 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Affected products

Known affected 13 products

Product	Identifier	Version
financial_services_trade-based_anti_money_laundering oracle	`cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.8::::enterprise:::`	—
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.8.6:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.8.1:::::::*`	—
financial_services_model_management_and_governance oracle	`cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.6:::::::*`	—
financial_services_model_management_and_governance oracle	`cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.7:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.7:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.8:::::::*`	—
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.5:::::::*`	—
financial_services_regulatory_reporting oracle	`cpe:2.3:a:oracle:financial_services_regulatory_reporting:8.1.2.8:::::::*`	—
financial_services_regulatory_reporting oracle	`cpe:2.3:a:oracle:financial_services_regulatory_reporting:8.1.2.7:::::::*`	—
financial_services_enterprise_case_management oracle	`cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.2:::::::*`	—
financial_services_model_management_and_governance oracle	`cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.3.0:::::::*`	—
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7.8:::::::*`	—

CVE-2024-45490

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Known affected 4 products

Product	Identifier	Version
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.8.1:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.7:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.8:::::::*`	—
financial_services_trade-based_anti_money_laundering oracle	`cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.8::::enterprise:::`	—

CVE-2024-45491

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Known affected 4 products

Product	Identifier	Version
financial_services_trade-based_anti_money_laundering oracle	`cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.8::::enterprise:::`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.7:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.8.1:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.8:::::::*`	—

CVE-2024-45492

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Known affected 4 products

Product	Identifier	Version
financial_services_trade-based_anti_money_laundering oracle	`cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.8::::enterprise:::`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.7:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.8.1:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.8:::::::*`	—

CVE-2025-21550

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

Known affected 3 products

Product	Identifier	Version
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.8.1:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.7:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.8:::::::*`	—

References

22 references

URL	Category
https://www.oracle.com/security-alerts/cpujan2025.html	external
https://api.ncsc.nl/velma/v1/vulnerabilities/2022…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2023…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2023…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2023…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2023…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2023…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2023…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2023…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2025…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Oracle heeft meerdere kwetsbaarheden verholpen in Financial Services en componenten.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheden stellen ongeauthenticeerde aanvallers in staat om toegang te krijgen tot kritieke gegevens en de systeemintegriteit in gevaar te brengen. Specifieke kwetsbaarheden kunnen leiden tot compromittering van vertrouwelijkheid, integriteit en beschikbaarheid, met schadeclassificaties vari\u00ebrend van gemiddeld tot hoog. Sommige kwetsbaarheden kunnen op afstand worden uitgebuit zonder gebruikersinteractie, wat het risico op privilege-escalatie en denial-of-service vergroot.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Incorrect Conversion between Numeric Types",
        "title": "CWE-681"
      },
      {
        "category": "general",
        "text": "Improper Input Validation",
        "title": "CWE-20"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
        "title": "CWE-79"
      },
      {
        "category": "general",
        "text": "Incorrect Calculation of Buffer Size",
        "title": "CWE-131"
      },
      {
        "category": "general",
        "text": "Improper Handling of Case Sensitivity",
        "title": "CWE-178"
      },
      {
        "category": "general",
        "text": "Improper Access Control",
        "title": "CWE-284"
      },
      {
        "category": "general",
        "text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
        "title": "CWE-1321"
      },
      {
        "category": "general",
        "text": "Improper Restriction of XML External Entity Reference",
        "title": "CWE-611"
      },
      {
        "category": "general",
        "text": "Always-Incorrect Control Flow Implementation",
        "title": "CWE-670"
      },
      {
        "category": "general",
        "text": "Integer Coercion Error",
        "title": "CWE-192"
      },
      {
        "category": "general",
        "text": "Use of Potentially Dangerous Function",
        "title": "CWE-676"
      },
      {
        "category": "general",
        "text": "Truncation of Security-relevant Information",
        "title": "CWE-222"
      },
      {
        "category": "general",
        "text": "Improper Handling of Exceptional Conditions",
        "title": "CWE-755"
      },
      {
        "category": "general",
        "text": "Incorrect Type Conversion or Cast",
        "title": "CWE-704"
      },
      {
        "category": "general",
        "text": "Integer Overflow to Buffer Overflow",
        "title": "CWE-680"
      },
      {
        "category": "general",
        "text": "Untrusted Search Path",
        "title": "CWE-426"
      },
      {
        "category": "general",
        "text": "Improper Validation of Integrity Check Value",
        "title": "CWE-354"
      },
      {
        "category": "general",
        "text": "Integer Overflow or Wraparound",
        "title": "CWE-190"
      },
      {
        "category": "general",
        "text": "Insertion of Sensitive Information into Log File",
        "title": "CWE-532"
      },
      {
        "category": "general",
        "text": "Authorization Bypass Through User-Controlled Key",
        "title": "CWE-639"
      },
      {
        "category": "general",
        "text": "Selection of Less-Secure Algorithm During Negotiation (\u0027Algorithm Downgrade\u0027)",
        "title": "CWE-757"
      },
      {
        "category": "general",
        "text": "Uncontrolled Resource Consumption",
        "title": "CWE-400"
      },
      {
        "category": "general",
        "text": "Deserialization of Untrusted Data",
        "title": "CWE-502"
      },
      {
        "category": "general",
        "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
        "title": "CWE-22"
      },
      {
        "category": "general",
        "text": "Exposure of Sensitive Information to an Unauthorized Actor",
        "title": "CWE-200"
      },
      {
        "category": "general",
        "text": "Stack-based Buffer Overflow",
        "title": "CWE-121"
      },
      {
        "category": "general",
        "text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
        "title": "CWE-120"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference - cveprojectv5; nvd; oracle",
        "url": "https://www.oracle.com/security-alerts/cpujan2025.html"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Oracle Financial Services",
    "tracking": {
      "current_release_date": "2025-01-22T13:33:00.723963Z",
      "id": "NCSC-2025-0025",
      "initial_release_date": "2025-01-22T13:33:00.723963Z",
      "revision_history": [
        {
          "date": "2025-01-22T13:33:00.723963Z",
          "number": "0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-342808",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-345045",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-1751072",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7.8:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-9711",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-345044",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.8.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-1751083",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.8.6:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-9300",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.8:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-345043",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.9.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-9522",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.9:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-345042",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-8848",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-93309",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-189066",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-93305",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-189064",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-189063",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-1751078",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_infrastructure",
            "product": {
              "name": "financial_services_analytical_applications_infrastructure",
              "product_id": "CSAFPID-189065",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_reconciliation_framework",
            "product": {
              "name": "financial_services_analytical_applications_reconciliation_framework",
              "product_id": "CSAFPID-363146",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:8.0.7.1.2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_analytical_applications_reconciliation_framework",
            "product": {
              "name": "financial_services_analytical_applications_reconciliation_framework",
              "product_id": "CSAFPID-363129",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:8.1.1.1.7:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_asset_liability_management",
            "product": {
              "name": "financial_services_asset_liability_management",
              "product_id": "CSAFPID-363142",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.7.8.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_balance_computation_engine",
            "product": {
              "name": "financial_services_balance_computation_engine",
              "product_id": "CSAFPID-363130",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_balance_computation_engine:8.1.1.1.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_balance_sheet_planning",
            "product": {
              "name": "financial_services_balance_sheet_planning",
              "product_id": "CSAFPID-363135",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_balance_sheet_planning:8.0.8.1.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_basel_regulatory_capital_basic",
            "product": {
              "name": "financial_services_basel_regulatory_capital_basic",
              "product_id": "CSAFPID-1503626",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.0.7.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_basel_regulatory_capital_basic",
            "product": {
              "name": "financial_services_basel_regulatory_capital_basic",
              "product_id": "CSAFPID-1503627",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.0.8.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_basel_regulatory_capital_internal_ratings_based_approach",
            "product": {
              "name": "financial_services_basel_regulatory_capital_internal_ratings_based_approach",
              "product_id": "CSAFPID-1503628",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.0.7.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_basel_regulatory_capital_internal_ratings_based_approach",
            "product": {
              "name": "financial_services_basel_regulatory_capital_internal_ratings_based_approach",
              "product_id": "CSAFPID-1503629",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.0.8.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-765261",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-93312",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.7.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-220456",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.7.2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-93311",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.8.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-189067",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.8.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-93308",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-93307",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-93306",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-220368",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-220449",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-345041",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-219772",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-219770",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-816828",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.6:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-1503630",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.7:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_behavior_detection_platform",
            "product": {
              "name": "financial_services_behavior_detection_platform",
              "product_id": "CSAFPID-1751074",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.8:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_cash_flow_engine",
            "product": {
              "name": "financial_services_cash_flow_engine",
              "product_id": "CSAFPID-764273",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_cash_flow_engine:8.1.2.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_compliance_studio",
            "product": {
              "name": "financial_services_compliance_studio",
              "product_id": "CSAFPID-345047",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_compliance_studio:8.1.2.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_compliance_studio",
            "product": {
              "name": "financial_services_compliance_studio",
              "product_id": "CSAFPID-816829",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_compliance_studio:8.1.2.5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_compliance_studio",
            "product": {
              "name": "financial_services_compliance_studio",
              "product_id": "CSAFPID-1503631",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_compliance_studio:8.1.2.6:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_compliance_studio",
            "product": {
              "name": "financial_services_compliance_studio",
              "product_id": "CSAFPID-1503632",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_compliance_studio:8.1.2.7:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_crime_and_compliance_management_studio",
            "product": {
              "name": "financial_services_crime_and_compliance_management_studio",
              "product_id": "CSAFPID-93648",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_crime_and_compliance_management_studio",
            "product": {
              "name": "financial_services_crime_and_compliance_management_studio",
              "product_id": "CSAFPID-93647",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_crime_and_compliance_management_studio",
            "product": {
              "name": "financial_services_crime_and_compliance_management_studio",
              "product_id": "CSAFPID-764857",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_crime_and_compliance_management_studio",
            "product": {
              "name": "financial_services_crime_and_compliance_management_studio",
              "product_id": "CSAFPID-391382",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_crime_and_compliance_management_studio",
            "product": {
              "name": "financial_services_crime_and_compliance_management_studio",
              "product_id": "CSAFPID-765262",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:_studio___8.0.8.2.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_crime_and_compliance_management_studio",
            "product": {
              "name": "financial_services_crime_and_compliance_management_studio",
              "product_id": "CSAFPID-765263",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:_studio___8.0.8.3.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_currency_transaction_reporting",
            "product": {
              "name": "financial_services_currency_transaction_reporting",
              "product_id": "CSAFPID-493291",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_currency_transaction_reporting:8.0.8.1.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_currency_transaction_reporting",
            "product": {
              "name": "financial_services_currency_transaction_reporting",
              "product_id": "CSAFPID-493290",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_currency_transaction_reporting:8.1.1.1.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_currency_transaction_reporting",
            "product": {
              "name": "financial_services_currency_transaction_reporting",
              "product_id": "CSAFPID-493289",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_currency_transaction_reporting:8.1.2.3.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_currency_transaction_reporting",
            "product": {
              "name": "financial_services_currency_transaction_reporting",
              "product_id": "CSAFPID-493288",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_currency_transaction_reporting:8.1.2.4.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_data_governance_for_us_regulatory_reporting",
            "product": {
              "name": "financial_services_data_governance_for_us_regulatory_reporting",
              "product_id": "CSAFPID-363128",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_data_governance_for_us_regulatory_reporting:8.1.2.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_data_governance_for_us_regulatory_reporting",
            "product": {
              "name": "financial_services_data_governance_for_us_regulatory_reporting",
              "product_id": "CSAFPID-363127",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_data_governance_for_us_regulatory_reporting:8.1.2.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_data_integration_hub",
            "product": {
              "name": "financial_services_data_integration_hub",
              "product_id": "CSAFPID-363144",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.7.3.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_data_integration_hub",
            "product": {
              "name": "financial_services_data_integration_hub",
              "product_id": "CSAFPID-363131",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_data_integration_hub:8.1.0.1.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_data_integration_hub",
            "product": {
              "name": "financial_services_data_integration_hub",
              "product_id": "CSAFPID-363126",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_data_integration_hub:8.1.2.2.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_deposit_insurance_calculations_for_liquidity_risk_management",
            "product": {
              "name": "financial_services_deposit_insurance_calculations_for_liquidity_risk_management",
              "product_id": "CSAFPID-363143",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_deposit_insurance_calculations_for_liquidity_risk_management:8.0.7.3.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_deposit_insurance_calculations_for_liquidity_risk_management",
            "product": {
              "name": "financial_services_deposit_insurance_calculations_for_liquidity_risk_management",
              "product_id": "CSAFPID-363133",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_deposit_insurance_calculations_for_liquidity_risk_management:8.0.8.3.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-567702",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-220378",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-220377",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-220455",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-220607",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-220372",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-1503633",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.2.8:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-219774",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-180191",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-1503634",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1.18:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-180190",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-180189",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-220369",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-220448",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-345040",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-219773",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-219771",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-1503635",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.6.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-816830",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.6:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_case_management",
            "product": {
              "name": "financial_services_enterprise_case_management",
              "product_id": "CSAFPID-1503636",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.7.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_enterprise_financial_performance_analytics",
            "product": {
              "name": "financial_services_enterprise_financial_performance_analytics",
              "product_id": "CSAFPID-363141",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_enterprise_financial_performance_analytics:8.0.7.8.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_funds_transfer_pricing",
            "product": {
              "name": "financial_services_funds_transfer_pricing",
              "product_id": "CSAFPID-363138",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.7.8.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_institutional_performance_analytics",
            "product": {
              "name": "financial_services_institutional_performance_analytics",
              "product_id": "CSAFPID-363136",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.7.8.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_lending_and_leasing",
            "product": {
              "name": "financial_services_lending_and_leasing",
              "product_id": "CSAFPID-816831",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_lending_and_leasing:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_liquidity_risk_measurement_and_management",
            "product": {
              "name": "financial_services_liquidity_risk_measurement_and_management",
              "product_id": "CSAFPID-363145",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.7.3.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_liquidity_risk_measurement_and_management",
            "product": {
              "name": "financial_services_liquidity_risk_measurement_and_management",
              "product_id": "CSAFPID-363132",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.8.3.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_loan_loss_forecasting_and_provisioning",
            "product": {
              "name": "financial_services_loan_loss_forecasting_and_provisioning",
              "product_id": "CSAFPID-363140",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.0.7.8.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_loan_loss_forecasting_and_provisioning",
            "product": {
              "name": "financial_services_loan_loss_forecasting_and_provisioning",
              "product_id": "CSAFPID-363134",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.0.8.2.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_model_management_and_governance",
            "product": {
              "name": "financial_services_model_management_and_governance",
              "product_id": "CSAFPID-764923",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.0.8.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_model_management_and_governance",
            "product": {
              "name": "financial_services_model_management_and_governance",
              "product_id": "CSAFPID-396508",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_model_management_and_governance",
            "product": {
              "name": "financial_services_model_management_and_governance",
              "product_id": "CSAFPID-764924",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.1.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_model_management_and_governance",
            "product": {
              "name": "financial_services_model_management_and_governance",
              "product_id": "CSAFPID-396507",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_model_management_and_governance",
            "product": {
              "name": "financial_services_model_management_and_governance",
              "product_id": "CSAFPID-611392",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_model_management_and_governance",
            "product": {
              "name": "financial_services_model_management_and_governance",
              "product_id": "CSAFPID-611391",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_model_management_and_governance",
            "product": {
              "name": "financial_services_model_management_and_governance",
              "product_id": "CSAFPID-1503319",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_model_management_and_governance",
            "product": {
              "name": "financial_services_model_management_and_governance",
              "product_id": "CSAFPID-1503318",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.6:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_model_management_and_governance",
            "product": {
              "name": "financial_services_model_management_and_governance",
              "product_id": "CSAFPID-1751202",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.7:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_model_management_and_governance",
            "product": {
              "name": "financial_services_model_management_and_governance",
              "product_id": "CSAFPID-1751086",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.3.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_profitability_management",
            "product": {
              "name": "financial_services_profitability_management",
              "product_id": "CSAFPID-363139",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_profitability_management:8.0.7.8.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_regulatory_reporting",
            "product": {
              "name": "financial_services_regulatory_reporting",
              "product_id": "CSAFPID-570314",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_regulatory_reporting:8.0.8.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_regulatory_reporting",
            "product": {
              "name": "financial_services_regulatory_reporting",
              "product_id": "CSAFPID-570313",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_regulatory_reporting:8.1.1.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_regulatory_reporting",
            "product": {
              "name": "financial_services_regulatory_reporting",
              "product_id": "CSAFPID-570312",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_regulatory_reporting:8.1.2.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_regulatory_reporting",
            "product": {
              "name": "financial_services_regulatory_reporting",
              "product_id": "CSAFPID-570311",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_regulatory_reporting:8.1.2.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_regulatory_reporting",
            "product": {
              "name": "financial_services_regulatory_reporting",
              "product_id": "CSAFPID-1751214",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_regulatory_reporting:8.1.2.7:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_regulatory_reporting",
            "product": {
              "name": "financial_services_regulatory_reporting",
              "product_id": "CSAFPID-1751213",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_regulatory_reporting:8.1.2.8:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_regulatory_reporting_with_agilereporter",
            "product": {
              "name": "financial_services_regulatory_reporting_with_agilereporter",
              "product_id": "CSAFPID-611433",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_regulatory_reporting_with_agilereporter:8.1.1.2.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_retail_performance_analytics",
            "product": {
              "name": "financial_services_retail_performance_analytics",
              "product_id": "CSAFPID-363137",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_retail_performance_analytics:8.0.7.8.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-765266",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-344846",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.7.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-219833",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.7:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-912589",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.8.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816832",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.8.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-219832",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.8:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-1751215",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.9.0.0.0-7.0.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-765264",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.9.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-765265",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.9.0.1.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816834",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.9.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-344845",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.9.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-219831",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.9:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-400311",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:3.0.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816835",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:3.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-219830",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:3.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-912590",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:3.1.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816836",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:3.1.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-219829",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:3.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-400309",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:3.2.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816837",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:3.2.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-219828",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:3.2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-400307",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:4.0.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-912591",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:4.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816838",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:4.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-219827",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:4.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-912592",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:5.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816839",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:5.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816841",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:5.1.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-1503637",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:6.0.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816842",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:6.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-1503638",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:6.1.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816833",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:_pricing_services___2.9.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_revenue_management_and_billing",
            "product": {
              "name": "financial_services_revenue_management_and_billing",
              "product_id": "CSAFPID-816840",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:_security___5.1.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_trade-based_anti_money_laundering",
            "product": {
              "name": "financial_services_trade-based_anti_money_laundering",
              "product_id": "CSAFPID-1751087",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.8:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_trade-based_anti_money_laundering",
            "product": {
              "name": "financial_services_trade-based_anti_money_laundering",
              "product_id": "CSAFPID-220375",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.8:*:*:*:enterprise:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_trade-based_anti_money_laundering_enterprise_edition",
            "product": {
              "name": "financial_services_trade-based_anti_money_laundering_enterprise_edition",
              "product_id": "CSAFPID-764925",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering_enterprise_edition:8.0.7.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_trade-based_anti_money_laundering_enterprise_edition",
            "product": {
              "name": "financial_services_trade-based_anti_money_laundering_enterprise_edition",
              "product_id": "CSAFPID-764796",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering_enterprise_edition:8.0.8.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_trade-based_anti_money_laundering_enterprise_edition",
            "product": {
              "name": "financial_services_trade-based_anti_money_laundering_enterprise_edition",
              "product_id": "CSAFPID-764926",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering_enterprise_edition:8.0.8.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_services_trade-based_anti_money_laundering_enterprise_edition",
            "product": {
              "name": "financial_services_trade-based_anti_money_laundering_enterprise_edition",
              "product_id": "CSAFPID-220374",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering_enterprise_edition:8.0.8:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "banking_liquidity_management",
            "product": {
              "name": "banking_liquidity_management",
              "product_id": "CSAFPID-764262",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:banking_liquidity_management:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "banking_liquidity_management",
            "product": {
              "name": "banking_liquidity_management",
              "product_id": "CSAFPID-180213",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:banking_liquidity_management:14.2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "banking_liquidity_management",
            "product": {
              "name": "banking_liquidity_management",
              "product_id": "CSAFPID-180207",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:banking_liquidity_management:14.5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "banking_liquidity_management",
            "product": {
              "name": "banking_liquidity_management",
              "product_id": "CSAFPID-912094",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:banking_liquidity_management:14.5.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "banking_liquidity_management",
            "product": {
              "name": "banking_liquidity_management",
              "product_id": "CSAFPID-912093",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:banking_liquidity_management:14.6.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "banking_liquidity_management",
            "product": {
              "name": "banking_liquidity_management",
              "product_id": "CSAFPID-912092",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:banking_liquidity_management:14.7.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "banking_liquidity_management",
            "product": {
              "name": "banking_liquidity_management",
              "product_id": "CSAFPID-816824",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:banking_liquidity_management:14.7.0.3.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "banking_liquidity_management",
            "product": {
              "name": "banking_liquidity_management",
              "product_id": "CSAFPID-1673499",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:banking_liquidity_management:14.7.5.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "banking_origination",
            "product": {
              "name": "banking_origination",
              "product_id": "CSAFPID-764263",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:banking_origination:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "banking_origination",
            "product": {
              "name": "banking_origination",
              "product_id": "CSAFPID-180208",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:banking_origination:14.5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "banking_origination",
            "product": {
              "name": "banking_origination",
              "product_id": "CSAFPID-1751207",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:banking_origination:14.5.0.0.0-14.7.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "banking_origination",
            "product": {
              "name": "banking_origination",
              "product_id": "CSAFPID-912064",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:banking_origination:14.5.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "banking_origination",
            "product": {
              "name": "banking_origination",
              "product_id": "CSAFPID-912063",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:banking_origination:14.6.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "banking_origination",
            "product": {
              "name": "banking_origination",
              "product_id": "CSAFPID-912062",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:banking_origination:14.7.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "banking_corporate_lending_process_management",
            "product": {
              "name": "banking_corporate_lending_process_management",
              "product_id": "CSAFPID-764259",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:banking_corporate_lending_process_management:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "banking_corporate_lending_process_management",
            "product": {
              "name": "banking_corporate_lending_process_management",
              "product_id": "CSAFPID-1751206",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.4.0.0.0-14.7.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "banking_corporate_lending_process_management",
            "product": {
              "name": "banking_corporate_lending_process_management",
              "product_id": "CSAFPID-1503614",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.4.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "banking_corporate_lending_process_management",
            "product": {
              "name": "banking_corporate_lending_process_management",
              "product_id": "CSAFPID-180204",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "banking_corporate_lending_process_management",
            "product": {
              "name": "banking_corporate_lending_process_management",
              "product_id": "CSAFPID-1503615",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "banking_corporate_lending_process_management",
            "product": {
              "name": "banking_corporate_lending_process_management",
              "product_id": "CSAFPID-1503616",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.6.0.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "banking_corporate_lending_process_management",
            "product": {
              "name": "banking_corporate_lending_process_management",
              "product_id": "CSAFPID-1503617",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.7.0.0.0:*:*:*:*:*:*:*"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "oracle"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-34169",
      "cwe": {
        "id": "CWE-192",
        "name": "Integer Coercion Error"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Coercion Error",
          "title": "CWE-192"
        },
        {
          "category": "other",
          "text": "Incorrect Conversion between Numeric Types",
          "title": "CWE-681"
        },
        {
          "category": "other",
          "text": "Incorrect Type Conversion or Cast",
          "title": "CWE-704"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-219827",
          "CSAFPID-219828",
          "CSAFPID-219829",
          "CSAFPID-219830",
          "CSAFPID-344845",
          "CSAFPID-219831",
          "CSAFPID-219832",
          "CSAFPID-344846",
          "CSAFPID-219833",
          "CSAFPID-764259",
          "CSAFPID-345045",
          "CSAFPID-345044",
          "CSAFPID-345043",
          "CSAFPID-345042",
          "CSAFPID-93309",
          "CSAFPID-93305",
          "CSAFPID-189064",
          "CSAFPID-189063",
          "CSAFPID-363146",
          "CSAFPID-363129",
          "CSAFPID-363142",
          "CSAFPID-363130",
          "CSAFPID-363135",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-345041",
          "CSAFPID-219772",
          "CSAFPID-345047",
          "CSAFPID-391382",
          "CSAFPID-493291",
          "CSAFPID-493290",
          "CSAFPID-493289",
          "CSAFPID-493288",
          "CSAFPID-363128",
          "CSAFPID-363127",
          "CSAFPID-363144",
          "CSAFPID-363131",
          "CSAFPID-363126",
          "CSAFPID-363143",
          "CSAFPID-363133",
          "CSAFPID-219774",
          "CSAFPID-180190",
          "CSAFPID-345040",
          "CSAFPID-219773",
          "CSAFPID-363141",
          "CSAFPID-363138",
          "CSAFPID-363136",
          "CSAFPID-363145",
          "CSAFPID-363132",
          "CSAFPID-363140",
          "CSAFPID-363134",
          "CSAFPID-396508",
          "CSAFPID-396507",
          "CSAFPID-363139",
          "CSAFPID-570314",
          "CSAFPID-570313",
          "CSAFPID-570312",
          "CSAFPID-570311",
          "CSAFPID-611433",
          "CSAFPID-363137",
          "CSAFPID-764796",
          "CSAFPID-764857",
          "CSAFPID-342808",
          "CSAFPID-220456",
          "CSAFPID-93308",
          "CSAFPID-93306",
          "CSAFPID-220368",
          "CSAFPID-220449",
          "CSAFPID-220455",
          "CSAFPID-180191",
          "CSAFPID-180189",
          "CSAFPID-220369",
          "CSAFPID-220448",
          "CSAFPID-764923",
          "CSAFPID-764924",
          "CSAFPID-764925",
          "CSAFPID-764926",
          "CSAFPID-764262",
          "CSAFPID-816824",
          "CSAFPID-764263",
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-9522",
          "CSAFPID-180204",
          "CSAFPID-180213",
          "CSAFPID-180207",
          "CSAFPID-180208",
          "CSAFPID-93312",
          "CSAFPID-93311",
          "CSAFPID-765261",
          "CSAFPID-765262",
          "CSAFPID-93648",
          "CSAFPID-765263",
          "CSAFPID-93647",
          "CSAFPID-220378",
          "CSAFPID-220377",
          "CSAFPID-220607",
          "CSAFPID-220372",
          "CSAFPID-567702",
          "CSAFPID-765264",
          "CSAFPID-765265",
          "CSAFPID-765266",
          "CSAFPID-400307",
          "CSAFPID-8848",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-219770",
          "CSAFPID-816828",
          "CSAFPID-816829",
          "CSAFPID-219771",
          "CSAFPID-816830",
          "CSAFPID-816831",
          "CSAFPID-816832",
          "CSAFPID-816833",
          "CSAFPID-816834",
          "CSAFPID-816835",
          "CSAFPID-816836",
          "CSAFPID-816837",
          "CSAFPID-816838",
          "CSAFPID-816839",
          "CSAFPID-816840",
          "CSAFPID-816841",
          "CSAFPID-816842",
          "CSAFPID-220374",
          "CSAFPID-912094",
          "CSAFPID-912093",
          "CSAFPID-912092",
          "CSAFPID-912064",
          "CSAFPID-912063",
          "CSAFPID-912062",
          "CSAFPID-912589",
          "CSAFPID-400311",
          "CSAFPID-912590",
          "CSAFPID-400309",
          "CSAFPID-912591",
          "CSAFPID-912592",
          "CSAFPID-1503614",
          "CSAFPID-1503615",
          "CSAFPID-1503616",
          "CSAFPID-1503617",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2022-34169",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-34169.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-219827",
            "CSAFPID-219828",
            "CSAFPID-219829",
            "CSAFPID-219830",
            "CSAFPID-344845",
            "CSAFPID-219831",
            "CSAFPID-219832",
            "CSAFPID-344846",
            "CSAFPID-219833",
            "CSAFPID-764259",
            "CSAFPID-345045",
            "CSAFPID-345044",
            "CSAFPID-345043",
            "CSAFPID-345042",
            "CSAFPID-93309",
            "CSAFPID-93305",
            "CSAFPID-189064",
            "CSAFPID-189063",
            "CSAFPID-363146",
            "CSAFPID-363129",
            "CSAFPID-363142",
            "CSAFPID-363130",
            "CSAFPID-363135",
            "CSAFPID-189067",
            "CSAFPID-93307",
            "CSAFPID-345041",
            "CSAFPID-219772",
            "CSAFPID-345047",
            "CSAFPID-391382",
            "CSAFPID-493291",
            "CSAFPID-493290",
            "CSAFPID-493289",
            "CSAFPID-493288",
            "CSAFPID-363128",
            "CSAFPID-363127",
            "CSAFPID-363144",
            "CSAFPID-363131",
            "CSAFPID-363126",
            "CSAFPID-363143",
            "CSAFPID-363133",
            "CSAFPID-219774",
            "CSAFPID-180190",
            "CSAFPID-345040",
            "CSAFPID-219773",
            "CSAFPID-363141",
            "CSAFPID-363138",
            "CSAFPID-363136",
            "CSAFPID-363145",
            "CSAFPID-363132",
            "CSAFPID-363140",
            "CSAFPID-363134",
            "CSAFPID-396508",
            "CSAFPID-396507",
            "CSAFPID-363139",
            "CSAFPID-570314",
            "CSAFPID-570313",
            "CSAFPID-570312",
            "CSAFPID-570311",
            "CSAFPID-611433",
            "CSAFPID-363137",
            "CSAFPID-764796",
            "CSAFPID-764857",
            "CSAFPID-342808",
            "CSAFPID-220456",
            "CSAFPID-93308",
            "CSAFPID-93306",
            "CSAFPID-220368",
            "CSAFPID-220449",
            "CSAFPID-220455",
            "CSAFPID-180191",
            "CSAFPID-180189",
            "CSAFPID-220369",
            "CSAFPID-220448",
            "CSAFPID-764923",
            "CSAFPID-764924",
            "CSAFPID-764925",
            "CSAFPID-764926",
            "CSAFPID-764262",
            "CSAFPID-816824",
            "CSAFPID-764263",
            "CSAFPID-9711",
            "CSAFPID-9300",
            "CSAFPID-9522",
            "CSAFPID-180204",
            "CSAFPID-180213",
            "CSAFPID-180207",
            "CSAFPID-180208",
            "CSAFPID-93312",
            "CSAFPID-93311",
            "CSAFPID-765261",
            "CSAFPID-765262",
            "CSAFPID-93648",
            "CSAFPID-765263",
            "CSAFPID-93647",
            "CSAFPID-220378",
            "CSAFPID-220377",
            "CSAFPID-220607",
            "CSAFPID-220372",
            "CSAFPID-567702",
            "CSAFPID-765264",
            "CSAFPID-765265",
            "CSAFPID-765266",
            "CSAFPID-400307",
            "CSAFPID-8848",
            "CSAFPID-189066",
            "CSAFPID-189065",
            "CSAFPID-219770",
            "CSAFPID-816828",
            "CSAFPID-816829",
            "CSAFPID-219771",
            "CSAFPID-816830",
            "CSAFPID-816831",
            "CSAFPID-816832",
            "CSAFPID-816833",
            "CSAFPID-816834",
            "CSAFPID-816835",
            "CSAFPID-816836",
            "CSAFPID-816837",
            "CSAFPID-816838",
            "CSAFPID-816839",
            "CSAFPID-816840",
            "CSAFPID-816841",
            "CSAFPID-816842",
            "CSAFPID-220374",
            "CSAFPID-912094",
            "CSAFPID-912093",
            "CSAFPID-912092",
            "CSAFPID-912064",
            "CSAFPID-912063",
            "CSAFPID-912062",
            "CSAFPID-912589",
            "CSAFPID-400311",
            "CSAFPID-912590",
            "CSAFPID-400309",
            "CSAFPID-912591",
            "CSAFPID-912592",
            "CSAFPID-1503614",
            "CSAFPID-1503615",
            "CSAFPID-1503616",
            "CSAFPID-1503617",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638"
          ]
        }
      ],
      "title": "CVE-2022-34169"
    },
    {
      "cve": "CVE-2023-26031",
      "cwe": {
        "id": "CWE-426",
        "name": "Untrusted Search Path"
      },
      "notes": [
        {
          "category": "other",
          "text": "Untrusted Search Path",
          "title": "CWE-426"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1503614",
          "CSAFPID-1503615",
          "CSAFPID-1503616",
          "CSAFPID-1503617",
          "CSAFPID-912094",
          "CSAFPID-912093",
          "CSAFPID-912092",
          "CSAFPID-912064",
          "CSAFPID-912063",
          "CSAFPID-912062",
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-816828",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926",
          "CSAFPID-816829"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-26031",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-26031.json"
        }
      ],
      "title": "CVE-2023-26031"
    },
    {
      "cve": "CVE-2023-33201",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-611391",
          "CSAFPID-611392",
          "CSAFPID-764259",
          "CSAFPID-764262",
          "CSAFPID-764263",
          "CSAFPID-764273",
          "CSAFPID-8848",
          "CSAFPID-9300",
          "CSAFPID-9522",
          "CSAFPID-9711",
          "CSAFPID-93307",
          "CSAFPID-180190",
          "CSAFPID-189065",
          "CSAFPID-189066",
          "CSAFPID-189067",
          "CSAFPID-219770",
          "CSAFPID-219771",
          "CSAFPID-219774",
          "CSAFPID-220374",
          "CSAFPID-344845",
          "CSAFPID-344846",
          "CSAFPID-765266",
          "CSAFPID-816824",
          "CSAFPID-816828",
          "CSAFPID-816829",
          "CSAFPID-816830",
          "CSAFPID-816831",
          "CSAFPID-816832",
          "CSAFPID-816833",
          "CSAFPID-816834",
          "CSAFPID-816835",
          "CSAFPID-816836",
          "CSAFPID-816837",
          "CSAFPID-816838",
          "CSAFPID-816839",
          "CSAFPID-816840",
          "CSAFPID-816841",
          "CSAFPID-816842",
          "CSAFPID-400309",
          "CSAFPID-400311",
          "CSAFPID-765264",
          "CSAFPID-765265",
          "CSAFPID-912062",
          "CSAFPID-912063",
          "CSAFPID-912064",
          "CSAFPID-912092",
          "CSAFPID-912093",
          "CSAFPID-912094",
          "CSAFPID-912589",
          "CSAFPID-912590",
          "CSAFPID-912591",
          "CSAFPID-912592",
          "CSAFPID-1503614",
          "CSAFPID-1503615",
          "CSAFPID-1503616",
          "CSAFPID-1503617",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926",
          "CSAFPID-1751202",
          "CSAFPID-1751086"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-33201",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-33201.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-611391",
            "CSAFPID-611392",
            "CSAFPID-764259",
            "CSAFPID-764262",
            "CSAFPID-764263",
            "CSAFPID-764273",
            "CSAFPID-8848",
            "CSAFPID-9300",
            "CSAFPID-9522",
            "CSAFPID-9711",
            "CSAFPID-93307",
            "CSAFPID-180190",
            "CSAFPID-189065",
            "CSAFPID-189066",
            "CSAFPID-189067",
            "CSAFPID-219770",
            "CSAFPID-219771",
            "CSAFPID-219774",
            "CSAFPID-220374",
            "CSAFPID-344845",
            "CSAFPID-344846",
            "CSAFPID-765266",
            "CSAFPID-816824",
            "CSAFPID-816828",
            "CSAFPID-816829",
            "CSAFPID-816830",
            "CSAFPID-816831",
            "CSAFPID-816832",
            "CSAFPID-816833",
            "CSAFPID-816834",
            "CSAFPID-816835",
            "CSAFPID-816836",
            "CSAFPID-816837",
            "CSAFPID-816838",
            "CSAFPID-816839",
            "CSAFPID-816840",
            "CSAFPID-816841",
            "CSAFPID-816842",
            "CSAFPID-400309",
            "CSAFPID-400311",
            "CSAFPID-765264",
            "CSAFPID-765265",
            "CSAFPID-912062",
            "CSAFPID-912063",
            "CSAFPID-912064",
            "CSAFPID-912092",
            "CSAFPID-912093",
            "CSAFPID-912094",
            "CSAFPID-912589",
            "CSAFPID-912590",
            "CSAFPID-912591",
            "CSAFPID-912592",
            "CSAFPID-1503614",
            "CSAFPID-1503615",
            "CSAFPID-1503616",
            "CSAFPID-1503617",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926",
            "CSAFPID-1751202",
            "CSAFPID-1751086"
          ]
        }
      ],
      "title": "CVE-2023-33201"
    },
    {
      "cve": "CVE-2023-39410",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "notes": [
        {
          "category": "other",
          "text": "Deserialization of Untrusted Data",
          "title": "CWE-502"
        },
        {
          "category": "other",
          "text": "Improper Input Validation",
          "title": "CWE-20"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-8848",
          "CSAFPID-9300",
          "CSAFPID-9522",
          "CSAFPID-9711",
          "CSAFPID-93307",
          "CSAFPID-180190",
          "CSAFPID-189065",
          "CSAFPID-189066",
          "CSAFPID-189067",
          "CSAFPID-219770",
          "CSAFPID-219771",
          "CSAFPID-219774",
          "CSAFPID-220374",
          "CSAFPID-344845",
          "CSAFPID-344846",
          "CSAFPID-764259",
          "CSAFPID-764262",
          "CSAFPID-764263",
          "CSAFPID-765266",
          "CSAFPID-816824",
          "CSAFPID-816828",
          "CSAFPID-816829",
          "CSAFPID-816830",
          "CSAFPID-816831",
          "CSAFPID-816832",
          "CSAFPID-816833",
          "CSAFPID-816834",
          "CSAFPID-816835",
          "CSAFPID-816836",
          "CSAFPID-816837",
          "CSAFPID-816838",
          "CSAFPID-816839",
          "CSAFPID-816840",
          "CSAFPID-816841",
          "CSAFPID-816842",
          "CSAFPID-1751202",
          "CSAFPID-1751206",
          "CSAFPID-1751086",
          "CSAFPID-1751207",
          "CSAFPID-1503318"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-39410",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-39410.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-8848",
            "CSAFPID-9300",
            "CSAFPID-9522",
            "CSAFPID-9711",
            "CSAFPID-93307",
            "CSAFPID-180190",
            "CSAFPID-189065",
            "CSAFPID-189066",
            "CSAFPID-189067",
            "CSAFPID-219770",
            "CSAFPID-219771",
            "CSAFPID-219774",
            "CSAFPID-220374",
            "CSAFPID-344845",
            "CSAFPID-344846",
            "CSAFPID-764259",
            "CSAFPID-764262",
            "CSAFPID-764263",
            "CSAFPID-765266",
            "CSAFPID-816824",
            "CSAFPID-816828",
            "CSAFPID-816829",
            "CSAFPID-816830",
            "CSAFPID-816831",
            "CSAFPID-816832",
            "CSAFPID-816833",
            "CSAFPID-816834",
            "CSAFPID-816835",
            "CSAFPID-816836",
            "CSAFPID-816837",
            "CSAFPID-816838",
            "CSAFPID-816839",
            "CSAFPID-816840",
            "CSAFPID-816841",
            "CSAFPID-816842",
            "CSAFPID-1751202",
            "CSAFPID-1751206",
            "CSAFPID-1751086",
            "CSAFPID-1751207",
            "CSAFPID-1503318"
          ]
        }
      ],
      "title": "CVE-2023-39410"
    },
    {
      "cve": "CVE-2023-44483",
      "cwe": {
        "id": "CWE-532",
        "name": "Insertion of Sensitive Information into Log File"
      },
      "notes": [
        {
          "category": "other",
          "text": "Insertion of Sensitive Information into Log File",
          "title": "CWE-532"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-8848",
          "CSAFPID-9300",
          "CSAFPID-9522",
          "CSAFPID-9711",
          "CSAFPID-93307",
          "CSAFPID-180190",
          "CSAFPID-189065",
          "CSAFPID-189066",
          "CSAFPID-189067",
          "CSAFPID-219770",
          "CSAFPID-219771",
          "CSAFPID-219774",
          "CSAFPID-220374",
          "CSAFPID-344845",
          "CSAFPID-344846",
          "CSAFPID-764259",
          "CSAFPID-764262",
          "CSAFPID-764263",
          "CSAFPID-765266",
          "CSAFPID-816824",
          "CSAFPID-816828",
          "CSAFPID-816829",
          "CSAFPID-816830",
          "CSAFPID-816831",
          "CSAFPID-816832",
          "CSAFPID-816833",
          "CSAFPID-816834",
          "CSAFPID-816835",
          "CSAFPID-816836",
          "CSAFPID-816837",
          "CSAFPID-816838",
          "CSAFPID-816839",
          "CSAFPID-816840",
          "CSAFPID-816841",
          "CSAFPID-816842",
          "CSAFPID-400309",
          "CSAFPID-400311",
          "CSAFPID-765264",
          "CSAFPID-765265",
          "CSAFPID-912062",
          "CSAFPID-912063",
          "CSAFPID-912064",
          "CSAFPID-912092",
          "CSAFPID-912093",
          "CSAFPID-912094",
          "CSAFPID-912589",
          "CSAFPID-912590",
          "CSAFPID-912591",
          "CSAFPID-912592",
          "CSAFPID-1503614",
          "CSAFPID-1503615",
          "CSAFPID-1503616",
          "CSAFPID-1503617",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-44483",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-44483.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-8848",
            "CSAFPID-9300",
            "CSAFPID-9522",
            "CSAFPID-9711",
            "CSAFPID-93307",
            "CSAFPID-180190",
            "CSAFPID-189065",
            "CSAFPID-189066",
            "CSAFPID-189067",
            "CSAFPID-219770",
            "CSAFPID-219771",
            "CSAFPID-219774",
            "CSAFPID-220374",
            "CSAFPID-344845",
            "CSAFPID-344846",
            "CSAFPID-764259",
            "CSAFPID-764262",
            "CSAFPID-764263",
            "CSAFPID-765266",
            "CSAFPID-816824",
            "CSAFPID-816828",
            "CSAFPID-816829",
            "CSAFPID-816830",
            "CSAFPID-816831",
            "CSAFPID-816832",
            "CSAFPID-816833",
            "CSAFPID-816834",
            "CSAFPID-816835",
            "CSAFPID-816836",
            "CSAFPID-816837",
            "CSAFPID-816838",
            "CSAFPID-816839",
            "CSAFPID-816840",
            "CSAFPID-816841",
            "CSAFPID-816842",
            "CSAFPID-400309",
            "CSAFPID-400311",
            "CSAFPID-765264",
            "CSAFPID-765265",
            "CSAFPID-912062",
            "CSAFPID-912063",
            "CSAFPID-912064",
            "CSAFPID-912092",
            "CSAFPID-912093",
            "CSAFPID-912094",
            "CSAFPID-912589",
            "CSAFPID-912590",
            "CSAFPID-912591",
            "CSAFPID-912592",
            "CSAFPID-1503614",
            "CSAFPID-1503615",
            "CSAFPID-1503616",
            "CSAFPID-1503617",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926"
          ]
        }
      ],
      "title": "CVE-2023-44483"
    },
    {
      "cve": "CVE-2023-48795",
      "cwe": {
        "id": "CWE-222",
        "name": "Truncation of Security-relevant Information"
      },
      "notes": [
        {
          "category": "other",
          "text": "Truncation of Security-relevant Information",
          "title": "CWE-222"
        },
        {
          "category": "other",
          "text": "Selection of Less-Secure Algorithm During Negotiation (\u0027Algorithm Downgrade\u0027)",
          "title": "CWE-757"
        },
        {
          "category": "other",
          "text": "Improper Validation of Integrity Check Value",
          "title": "CWE-354"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-8848",
          "CSAFPID-9300",
          "CSAFPID-9522",
          "CSAFPID-9711",
          "CSAFPID-93307",
          "CSAFPID-180190",
          "CSAFPID-189065",
          "CSAFPID-189066",
          "CSAFPID-189067",
          "CSAFPID-219770",
          "CSAFPID-219771",
          "CSAFPID-219774",
          "CSAFPID-220374",
          "CSAFPID-344845",
          "CSAFPID-344846",
          "CSAFPID-764259",
          "CSAFPID-764262",
          "CSAFPID-764263",
          "CSAFPID-765266",
          "CSAFPID-816824",
          "CSAFPID-816828",
          "CSAFPID-816829",
          "CSAFPID-816830",
          "CSAFPID-816831",
          "CSAFPID-816832",
          "CSAFPID-816833",
          "CSAFPID-816834",
          "CSAFPID-816835",
          "CSAFPID-816836",
          "CSAFPID-816837",
          "CSAFPID-816838",
          "CSAFPID-816839",
          "CSAFPID-816840",
          "CSAFPID-816841",
          "CSAFPID-816842",
          "CSAFPID-400309",
          "CSAFPID-400311",
          "CSAFPID-765264",
          "CSAFPID-765265",
          "CSAFPID-912062",
          "CSAFPID-912063",
          "CSAFPID-912064",
          "CSAFPID-912092",
          "CSAFPID-912093",
          "CSAFPID-912094",
          "CSAFPID-912589",
          "CSAFPID-912590",
          "CSAFPID-912591",
          "CSAFPID-912592",
          "CSAFPID-1503614",
          "CSAFPID-1503615",
          "CSAFPID-1503616",
          "CSAFPID-1503617",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-48795",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-48795.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-8848",
            "CSAFPID-9300",
            "CSAFPID-9522",
            "CSAFPID-9711",
            "CSAFPID-93307",
            "CSAFPID-180190",
            "CSAFPID-189065",
            "CSAFPID-189066",
            "CSAFPID-189067",
            "CSAFPID-219770",
            "CSAFPID-219771",
            "CSAFPID-219774",
            "CSAFPID-220374",
            "CSAFPID-344845",
            "CSAFPID-344846",
            "CSAFPID-764259",
            "CSAFPID-764262",
            "CSAFPID-764263",
            "CSAFPID-765266",
            "CSAFPID-816824",
            "CSAFPID-816828",
            "CSAFPID-816829",
            "CSAFPID-816830",
            "CSAFPID-816831",
            "CSAFPID-816832",
            "CSAFPID-816833",
            "CSAFPID-816834",
            "CSAFPID-816835",
            "CSAFPID-816836",
            "CSAFPID-816837",
            "CSAFPID-816838",
            "CSAFPID-816839",
            "CSAFPID-816840",
            "CSAFPID-816841",
            "CSAFPID-816842",
            "CSAFPID-400309",
            "CSAFPID-400311",
            "CSAFPID-765264",
            "CSAFPID-765265",
            "CSAFPID-912062",
            "CSAFPID-912063",
            "CSAFPID-912064",
            "CSAFPID-912092",
            "CSAFPID-912093",
            "CSAFPID-912094",
            "CSAFPID-912589",
            "CSAFPID-912590",
            "CSAFPID-912591",
            "CSAFPID-912592",
            "CSAFPID-1503614",
            "CSAFPID-1503615",
            "CSAFPID-1503616",
            "CSAFPID-1503617",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926"
          ]
        }
      ],
      "title": "CVE-2023-48795"
    },
    {
      "cve": "CVE-2023-51074",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Stack-based Buffer Overflow",
          "title": "CWE-121"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-400309",
          "CSAFPID-400311",
          "CSAFPID-765264",
          "CSAFPID-765265",
          "CSAFPID-912062",
          "CSAFPID-912063",
          "CSAFPID-912064",
          "CSAFPID-912092",
          "CSAFPID-912093",
          "CSAFPID-912094",
          "CSAFPID-912589",
          "CSAFPID-912590",
          "CSAFPID-912591",
          "CSAFPID-912592",
          "CSAFPID-1503614",
          "CSAFPID-1503615",
          "CSAFPID-1503616",
          "CSAFPID-1503617",
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-816828",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926",
          "CSAFPID-1751213",
          "CSAFPID-220375",
          "CSAFPID-1751214",
          "CSAFPID-1751074"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-51074",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-51074.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-400309",
            "CSAFPID-400311",
            "CSAFPID-765264",
            "CSAFPID-765265",
            "CSAFPID-912062",
            "CSAFPID-912063",
            "CSAFPID-912064",
            "CSAFPID-912092",
            "CSAFPID-912093",
            "CSAFPID-912094",
            "CSAFPID-912589",
            "CSAFPID-912590",
            "CSAFPID-912591",
            "CSAFPID-912592",
            "CSAFPID-1503614",
            "CSAFPID-1503615",
            "CSAFPID-1503616",
            "CSAFPID-1503617",
            "CSAFPID-9711",
            "CSAFPID-9300",
            "CSAFPID-189066",
            "CSAFPID-189065",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-189067",
            "CSAFPID-93307",
            "CSAFPID-816828",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926",
            "CSAFPID-1751213",
            "CSAFPID-220375",
            "CSAFPID-1751214",
            "CSAFPID-1751074"
          ]
        }
      ],
      "title": "CVE-2023-51074"
    },
    {
      "cve": "CVE-2023-52070",
      "product_status": {
        "known_affected": [
          "CSAFPID-1751215"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-52070",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-52070.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1751215"
          ]
        }
      ],
      "title": "CVE-2023-52070"
    },
    {
      "cve": "CVE-2024-28219",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
          "title": "CWE-120"
        },
        {
          "category": "other",
          "text": "Use of Potentially Dangerous Function",
          "title": "CWE-676"
        },
        {
          "category": "other",
          "text": "Integer Overflow to Buffer Overflow",
          "title": "CWE-680"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1503631",
          "CSAFPID-1673499"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-28219",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-28219.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1503631",
            "CSAFPID-1673499"
          ]
        }
      ],
      "title": "CVE-2024-28219"
    },
    {
      "cve": "CVE-2024-34064",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1503614",
          "CSAFPID-1503615",
          "CSAFPID-1503616",
          "CSAFPID-1503617",
          "CSAFPID-912094",
          "CSAFPID-912093",
          "CSAFPID-912092",
          "CSAFPID-912064",
          "CSAFPID-912063",
          "CSAFPID-912062",
          "CSAFPID-9711",
          "CSAFPID-9300",
          "CSAFPID-189066",
          "CSAFPID-189065",
          "CSAFPID-1503626",
          "CSAFPID-1503627",
          "CSAFPID-1503628",
          "CSAFPID-1503629",
          "CSAFPID-189067",
          "CSAFPID-93307",
          "CSAFPID-816828",
          "CSAFPID-1503630",
          "CSAFPID-1503631",
          "CSAFPID-1503632",
          "CSAFPID-1503633",
          "CSAFPID-1503634",
          "CSAFPID-1503635",
          "CSAFPID-1503636",
          "CSAFPID-1503319",
          "CSAFPID-1503318",
          "CSAFPID-1503637",
          "CSAFPID-1503638",
          "CSAFPID-764926",
          "CSAFPID-1673499",
          "CSAFPID-1751206",
          "CSAFPID-1751207"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-34064",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-34064.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1503614",
            "CSAFPID-1503615",
            "CSAFPID-1503616",
            "CSAFPID-1503617",
            "CSAFPID-912094",
            "CSAFPID-912093",
            "CSAFPID-912092",
            "CSAFPID-912064",
            "CSAFPID-912063",
            "CSAFPID-912062",
            "CSAFPID-9711",
            "CSAFPID-9300",
            "CSAFPID-189066",
            "CSAFPID-189065",
            "CSAFPID-1503626",
            "CSAFPID-1503627",
            "CSAFPID-1503628",
            "CSAFPID-1503629",
            "CSAFPID-189067",
            "CSAFPID-93307",
            "CSAFPID-816828",
            "CSAFPID-1503630",
            "CSAFPID-1503631",
            "CSAFPID-1503632",
            "CSAFPID-1503633",
            "CSAFPID-1503634",
            "CSAFPID-1503635",
            "CSAFPID-1503636",
            "CSAFPID-1503319",
            "CSAFPID-1503318",
            "CSAFPID-1503637",
            "CSAFPID-1503638",
            "CSAFPID-764926",
            "CSAFPID-1673499",
            "CSAFPID-1751206",
            "CSAFPID-1751207"
          ]
        }
      ],
      "title": "CVE-2024-34064"
    },
    {
      "cve": "CVE-2024-34750",
      "cwe": {
        "id": "CWE-755",
        "name": "Improper Handling of Exceptional Conditions"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Handling of Exceptional Conditions",
          "title": "CWE-755"
        },
        {
          "category": "other",
          "text": "Uncontrolled Resource Consumption",
          "title": "CWE-400"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1751202",
          "CSAFPID-1751086",
          "CSAFPID-1503318"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-34750",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-34750.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1751202",
            "CSAFPID-1751086",
            "CSAFPID-1503318"
          ]
        }
      ],
      "title": "CVE-2024-34750"
    },
    {
      "cve": "CVE-2024-35195",
      "cwe": {
        "id": "CWE-670",
        "name": "Always-Incorrect Control Flow Implementation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Always-Incorrect Control Flow Implementation",
          "title": "CWE-670"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1673499",
          "CSAFPID-1503631"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-35195",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-35195.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1673499",
            "CSAFPID-1503631"
          ]
        }
      ],
      "title": "CVE-2024-35195"
    },
    {
      "cve": "CVE-2024-38819",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "title": "CWE-22"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1751072",
          "CSAFPID-1503630",
          "CSAFPID-1751074",
          "CSAFPID-1751078",
          "CSAFPID-189067",
          "CSAFPID-1751083",
          "CSAFPID-1751086",
          "CSAFPID-1503631",
          "CSAFPID-220375"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-38819",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-38819.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1751072",
            "CSAFPID-1503630",
            "CSAFPID-1751074",
            "CSAFPID-1751078",
            "CSAFPID-189067",
            "CSAFPID-1751083",
            "CSAFPID-1751086",
            "CSAFPID-1503631",
            "CSAFPID-220375"
          ]
        }
      ],
      "title": "CVE-2024-38819"
    },
    {
      "cve": "CVE-2024-38820",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Access Control",
          "title": "CWE-284"
        },
        {
          "category": "other",
          "text": "Improper Handling of Case Sensitivity",
          "title": "CWE-178"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-220375",
          "CSAFPID-1751083",
          "CSAFPID-1503630",
          "CSAFPID-1751074",
          "CSAFPID-1751078",
          "CSAFPID-1503631",
          "CSAFPID-189067",
          "CSAFPID-1751086",
          "CSAFPID-1751072"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-38820",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-38820.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-220375",
            "CSAFPID-1751083",
            "CSAFPID-1503630",
            "CSAFPID-1751074",
            "CSAFPID-1751078",
            "CSAFPID-1503631",
            "CSAFPID-189067",
            "CSAFPID-1751086",
            "CSAFPID-1751072"
          ]
        }
      ],
      "title": "CVE-2024-38820"
    },
    {
      "cve": "CVE-2024-38827",
      "cwe": {
        "id": "CWE-639",
        "name": "Authorization Bypass Through User-Controlled Key"
      },
      "notes": [
        {
          "category": "other",
          "text": "Authorization Bypass Through User-Controlled Key",
          "title": "CWE-639"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1503631"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-38827",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-38827.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1503631"
          ]
        }
      ],
      "title": "CVE-2024-38827"
    },
    {
      "cve": "CVE-2024-38998",
      "cwe": {
        "id": "CWE-1321",
        "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
          "title": "CWE-1321"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-220375",
          "CSAFPID-1751083",
          "CSAFPID-189067",
          "CSAFPID-1503318",
          "CSAFPID-1751202",
          "CSAFPID-1503630",
          "CSAFPID-1751074",
          "CSAFPID-1751078",
          "CSAFPID-1751213",
          "CSAFPID-1751214",
          "CSAFPID-219774",
          "CSAFPID-1751086",
          "CSAFPID-1751072"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-38998",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-38998.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-220375",
            "CSAFPID-1751083",
            "CSAFPID-189067",
            "CSAFPID-1503318",
            "CSAFPID-1751202",
            "CSAFPID-1503630",
            "CSAFPID-1751074",
            "CSAFPID-1751078",
            "CSAFPID-1751213",
            "CSAFPID-1751214",
            "CSAFPID-219774",
            "CSAFPID-1751086",
            "CSAFPID-1751072"
          ]
        }
      ],
      "title": "CVE-2024-38998"
    },
    {
      "cve": "CVE-2024-38999",
      "cwe": {
        "id": "CWE-1321",
        "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
          "title": "CWE-1321"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-220375",
          "CSAFPID-1751083",
          "CSAFPID-189067",
          "CSAFPID-1503318",
          "CSAFPID-1751202",
          "CSAFPID-1503630",
          "CSAFPID-1751074",
          "CSAFPID-1751078",
          "CSAFPID-1751213",
          "CSAFPID-1751214",
          "CSAFPID-219774",
          "CSAFPID-1751086",
          "CSAFPID-1751072"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-38999",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-38999.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-220375",
            "CSAFPID-1751083",
            "CSAFPID-189067",
            "CSAFPID-1503318",
            "CSAFPID-1751202",
            "CSAFPID-1503630",
            "CSAFPID-1751074",
            "CSAFPID-1751078",
            "CSAFPID-1751213",
            "CSAFPID-1751214",
            "CSAFPID-219774",
            "CSAFPID-1751086",
            "CSAFPID-1751072"
          ]
        }
      ],
      "title": "CVE-2024-38999"
    },
    {
      "cve": "CVE-2024-45490",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "other",
          "text": "Incorrect Calculation of Buffer Size",
          "title": "CWE-131"
        },
        {
          "category": "other",
          "text": "Improper Restriction of XML External Entity Reference",
          "title": "CWE-611"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-189067",
          "CSAFPID-1503630",
          "CSAFPID-1751074",
          "CSAFPID-220375"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-45490",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-45490.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-189067",
            "CSAFPID-1503630",
            "CSAFPID-1751074",
            "CSAFPID-220375"
          ]
        }
      ],
      "title": "CVE-2024-45490"
    },
    {
      "cve": "CVE-2024-45491",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-220375",
          "CSAFPID-1503630",
          "CSAFPID-189067",
          "CSAFPID-1751074"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-45491",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-45491.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-220375",
            "CSAFPID-1503630",
            "CSAFPID-189067",
            "CSAFPID-1751074"
          ]
        }
      ],
      "title": "CVE-2024-45491"
    },
    {
      "cve": "CVE-2024-45492",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-220375",
          "CSAFPID-1503630",
          "CSAFPID-189067",
          "CSAFPID-1751074"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-45492",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-45492.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-220375",
            "CSAFPID-1503630",
            "CSAFPID-189067",
            "CSAFPID-1751074"
          ]
        }
      ],
      "title": "CVE-2024-45492"
    },
    {
      "cve": "CVE-2025-21550",
      "product_status": {
        "known_affected": [
          "CSAFPID-189067",
          "CSAFPID-1503630",
          "CSAFPID-1751074"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-21550",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21550.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-189067",
            "CSAFPID-1503630",
            "CSAFPID-1751074"
          ]
        }
      ],
      "title": "CVE-2025-21550"
    }
  ]
}

CVE-2022-34169 (GCVE-0-2022-34169)

Vulnerability from cvelistv5 – Published: 2022-07-19 00:00 – Updated: 2026-05-27 12:51

Title

Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

Summary

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE

integer truncation

Assigner

apache

References

24 references

URL	Tags
https://lists.apache.org/thread/2qvl7r43wb4t8p9dd…
https://lists.apache.org/thread/12pxy4phsry6c34x2…
http://www.openwall.com/lists/oss-security/2022/07/19/5	mailing-list
https://www.oracle.com/security-alerts/cpujul2022.html
http://www.openwall.com/lists/oss-security/2022/07/19/6	mailing-list
http://www.openwall.com/lists/oss-security/2022/07/20/2	mailing-list
http://www.openwall.com/lists/oss-security/2022/07/20/3	mailing-list
https://www.debian.org/security/2022/dsa-5188	vendor-advisory
https://www.debian.org/security/2022/dsa-5192	vendor-advisory
https://security.netapp.com/advisory/ntap-2022072…
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
http://packetstormsecurity.com/files/168186/Xalan…
http://www.openwall.com/lists/oss-security/2022/10/18/2	mailing-list
https://lists.debian.org/debian-lts-announce/2022…	mailing-list
https://www.debian.org/security/2022/dsa-5256	vendor-advisory
http://www.openwall.com/lists/oss-security/2022/11/04/8	mailing-list
http://www.openwall.com/lists/oss-security/2022/11/07/2	mailing-list
https://security.gentoo.org/glsa/202401-25
https://security.netapp.com/advisory/ntap-2024062…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Xalan-J	Affected: Xalan-J , ≤ 2.7.2 (custom)

Credits

Reported by Felix Wilhelm, Google Project Zero

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T08:16:17.277Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw"
          },
          {
            "name": "[oss-security] 20220719 CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/19/5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          },
          {
            "name": "[oss-security] 20220719 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/19/6"
          },
          {
            "name": "[oss-security] 20220719 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/20/2"
          },
          {
            "name": "[oss-security] 20220720 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/20/3"
          },
          {
            "name": "DSA-5188",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5188"
          },
          {
            "name": "DSA-5192",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5192"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220729-0009/"
          },
          {
            "name": "FEDORA-2022-19b6f21746",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/"
          },
          {
            "name": "FEDORA-2022-ae563934f7",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/"
          },
          {
            "name": "FEDORA-2022-e573851f56",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/"
          },
          {
            "name": "FEDORA-2022-d26586b419",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/"
          },
          {
            "name": "FEDORA-2022-80afe2304a",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/"
          },
          {
            "name": "FEDORA-2022-b76ab52e73",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html"
          },
          {
            "name": "[oss-security] 20221017 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/10/18/2"
          },
          {
            "name": "[debian-lts-announce] 20221018 [SECURITY] [DLA 3155-1] bcel security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html"
          },
          {
            "name": "DSA-5256",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5256"
          },
          {
            "name": "[oss-security] 20221104 Re: CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/11/04/8"
          },
          {
            "name": "[oss-security] 20221107 Re: CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/11/07/2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202401-25"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-34169",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-20T16:24:49.067251Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-681",
                "description": "CWE-681 Incorrect Conversion between Numeric Types",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T12:51:15.955Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Xalan-J",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.7.2",
              "status": "affected",
              "version": "Xalan-J",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Reported by Felix Wilhelm, Google Project Zero"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "integer truncation",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:07:47.103Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "url": "https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8"
        },
        {
          "url": "https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw"
        },
        {
          "name": "[oss-security] 20220719 CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/19/5"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        },
        {
          "name": "[oss-security] 20220719 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/19/6"
        },
        {
          "name": "[oss-security] 20220719 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/20/2"
        },
        {
          "name": "[oss-security] 20220720 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/20/3"
        },
        {
          "name": "DSA-5188",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5188"
        },
        {
          "name": "DSA-5192",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5192"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20220729-0009/"
        },
        {
          "name": "FEDORA-2022-19b6f21746",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/"
        },
        {
          "name": "FEDORA-2022-ae563934f7",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/"
        },
        {
          "name": "FEDORA-2022-e573851f56",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/"
        },
        {
          "name": "FEDORA-2022-d26586b419",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/"
        },
        {
          "name": "FEDORA-2022-80afe2304a",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/"
        },
        {
          "name": "FEDORA-2022-b76ab52e73",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/"
        },
        {
          "url": "http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html"
        },
        {
          "name": "[oss-security] 20221017 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/10/18/2"
        },
        {
          "name": "[debian-lts-announce] 20221018 [SECURITY] [DLA 3155-1] bcel security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html"
        },
        {
          "name": "DSA-5256",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5256"
        },
        {
          "name": "[oss-security] 20221104 Re: CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/11/04/8"
        },
        {
          "name": "[oss-security] 20221107 Re: CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/11/07/2"
        },
        {
          "url": "https://security.gentoo.org/glsa/202401-25"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2022-34169",
    "datePublished": "2022-07-19T00:00:00.000Z",
    "dateReserved": "2022-06-21T00:00:00.000Z",
    "dateUpdated": "2026-05-27T12:51:15.955Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-26031 (GCVE-0-2023-26031)

Vulnerability from cvelistv5 – Published: 2023-11-16 08:15 – Updated: 2025-02-13 16:44

Title

Privilege escalation in Apache Hadoop Yarn container-executor binary on Linux systems

Summary

Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN cluster is accepting work from remote (authenticated) users, this MAY permit remote users to gain root privileges. Hadoop 3.3.0 updated the " YARN Secure Containers https://hadoop.apache.org/docs/stable/hadoop-yarn/hadoop-yarn-site/SecureContainer.html " to add a feature for executing user-submitted applications in isolated linux containers. The native binary HADOOP_HOME/bin/container-executor is used to launch these containers; it must be owned by root and have the suid bit set in order for the YARN processes to run the containers as the specific users submitting the jobs. The patch " YARN-10495 https://issues.apache.org/jira/browse/YARN-10495 . make the rpath of container-executor configurable" modified the library loading path for loading .so files from "$ORIGIN/" to ""$ORIGIN/:../lib/native/". This is the a path through which libcrypto.so is located. Thus it is is possible for a user with reduced privileges to install a malicious libcrypto library into a path to which they have write access, invoke the container-executor command, and have their modified library executed as root. If the YARN cluster is accepting work from remote (authenticated) users, and these users' submitted job are executed in the physical host, rather than a container, then the CVE permits remote users to gain root privileges. The fix for the vulnerability is to revert the change, which is done in YARN-11441 https://issues.apache.org/jira/browse/YARN-11441 , "Revert YARN-10495". This patch is in hadoop-3.3.5. To determine whether a version of container-executor is vulnerable, use the readelf command. If the RUNPATH or RPATH value contains the relative path "./lib/native/" then it is at risk $ readelf -d container-executor|grep 'RUNPATH\|RPATH' 0x000000000000001d (RUNPATH) Library runpath: [$ORIGIN/:../lib/native/] If it does not, then it is safe: $ readelf -d container-executor|grep 'RUNPATH\|RPATH' 0x000000000000001d (RUNPATH) Library runpath: [$ORIGIN/] For an at-risk version of container-executor to enable privilege escalation, the owner must be root and the suid bit must be set $ ls -laF /opt/hadoop/bin/container-executor ---Sr-s---. 1 root hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor A safe installation lacks the suid bit; ideally is also not owned by root. $ ls -laF /opt/hadoop/bin/container-executor -rwxr-xr-x. 1 yarn hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor This configuration does not support Yarn Secure Containers, but all other hadoop services, including YARN job execution outside secure containers continue to work.

Severity

No CVSS data available.

CWE

CWE-426 - Untrusted Search Path

Assigner

apache

References

4 references

URL	Tags
https://issues.apache.org/jira/browse/YARN-11441	issue-tracking
https://hadoop.apache.org/cve_list.html	vendor-advisory
https://lists.apache.org/thread/q9qpdlv952gb4kphp…	vendor-advisory
https://security.netapp.com/advisory/ntap-2024011…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Hadoop	Affected: 3.3.1 , < 3.3.5 (semver)

Credits

Esa Hiltunen Mikko Kortelainen The Teragrep Project

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apache:hadoop:3.3.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "hadoop",
            "vendor": "apache",
            "versions": [
              {
                "lessThan": "3.3.5",
                "status": "affected",
                "version": "3.3.1",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-26031",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-19T03:55:27.490258Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-29T13:09:24.015Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T11:39:06.596Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "issue-tracking",
              "x_transferred"
            ],
            "url": "https://issues.apache.org/jira/browse/YARN-11441"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://hadoop.apache.org/cve_list.html"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/q9qpdlv952gb4kphpndd5phvl7fkh71r"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240112-0001/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Hadoop",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "3.3.5",
              "status": "affected",
              "version": "3.3.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The owner of the\u0026nbsp;container-executor binary must be set to \"root\" and suid set bit such that callers would execute the binary as root. These operations are a requirement for \"YARN Secure Containers\".\u003cbr\u003e \u003cbr\u003eIn an installation using the hadoop.tar.gz file the binary\u0027s owner is that of the installing user, and without the suid permission is not at risk. \u003cbr\u003e\u003cbr\u003eHowever, Apache BIgtop installations set the owner and permissions such that installations may be vulnerable\u003cbr\u003e\u003cbr\u003eThe container-executor\u0026nbsp;binary is only vulnerable on some Hadoop/Bigtop releases. It is possible to verify whether a version is vulnerable using the readelf command."
            }
          ],
          "value": "The owner of the\u00a0container-executor binary must be set to \"root\" and suid set bit such that callers would execute the binary as root. These operations are a requirement for \"YARN Secure Containers\".\n \nIn an installation using the hadoop.tar.gz file the binary\u0027s owner is that of the installing user, and without the suid permission is not at risk. \n\nHowever, Apache BIgtop installations set the owner and permissions such that installations may be vulnerable\n\nThe container-executor\u00a0binary is only vulnerable on some Hadoop/Bigtop releases. It is possible to verify whether a version is vulnerable using the readelf command."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Esa Hiltunen"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Mikko Kortelainen"
        },
        {
          "lang": "en",
          "type": "sponsor",
          "value": "The Teragrep Project"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cbr\u003eRelative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN cluster is accepting work from remote (authenticated) users, this MAY permit remote users to gain root privileges.\u003cbr\u003e\u003cbr\u003eHadoop 3.3.0 updated the \"\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://hadoop.apache.org/docs/stable/hadoop-yarn/hadoop-yarn-site/SecureContainer.html\"\u003eYARN Secure Containers\u003c/a\u003e\" to add a feature for executing user-submitted applications in isolated linux containers.\u003cbr\u003e\u003cbr\u003eThe native binary HADOOP_HOME/bin/container-executor is used to launch these containers; it must be owned by root and have the suid bit set in order for the YARN processes to run the containers as the specific users submitting the jobs.\u003cbr\u003e\u003cbr\u003eThe patch \"\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://issues.apache.org/jira/browse/YARN-10495\"\u003eYARN-10495\u003c/a\u003e. make the rpath of container-executor configurable\" modified the library loading path for loading .so files from \"$ORIGIN/\" to \"\"$ORIGIN/:../lib/native/\". This is the a path through which libcrypto.so is located. Thus it is is possible for a user with reduced privileges to install a malicious libcrypto library into a path to which they have write access, invoke the container-executor command, and have their modified library executed as root.\u003cbr\u003eIf the YARN cluster is accepting work from remote (authenticated) users, and these users\u0027 submitted job are executed in the physical host, rather than a container, then the CVE permits remote users to gain root privileges.\u003cbr\u003e\u003cbr\u003eThe fix for the vulnerability is to revert the change, which is done in \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://issues.apache.org/jira/browse/YARN-11441\"\u003eYARN-11441\u003c/a\u003e, \"Revert YARN-10495\". This patch is in hadoop-3.3.5.\u003cbr\u003e\u003cbr\u003eTo determine whether a version of container-executor is vulnerable, use the readelf command. If the RUNPATH or RPATH value contains the relative path \"./lib/native/\" then it  is at risk\u003cbr\u003e\u003cbr\u003e\u003ctt\u003e$ readelf -d container-executor|grep \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0027RUNPATH\\|RPATH\u0027\u003c/span\u003e \u003cbr\u003e0x000000000000001d (RUNPATH)  \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; Library runpath: [$ORIGIN/:../lib/native/]\u003c/tt\u003e\u003cbr\u003e\u003cbr\u003eIf it does not, then it is safe:\u003cbr\u003e\u003cbr\u003e\u003ctt\u003e$ readelf -d container-executor|grep \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0027RUNPATH\\|RPATH\u0027\u003c/span\u003e \u003cbr\u003e0x000000000000001d (RUNPATH)  \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; Library runpath: [$ORIGIN/]\u003c/tt\u003e\u003cbr\u003e\u003cbr\u003eFor an at-risk version of container-executor to enable privilege escalation, the owner must be root and the suid bit must be set\u003cbr\u003e\u003ctt\u003e\u003cbr\u003e$ ls -laF /opt/hadoop/bin/container-executor\u003cbr\u003e---Sr-s---. 1 root hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor\u003c/tt\u003e\u003cbr\u003e\u003cbr\u003eA safe installation lacks the suid bit; ideally is also not owned by root.\u003cbr\u003e\u003cbr\u003e\u003ctt\u003e$ ls -laF /opt/hadoop/bin/container-executor\u003cbr\u003e-rwxr-xr-x. 1 yarn hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor\u003c/tt\u003e\u003cbr\u003e\u003cbr\u003eThis configuration does not support Yarn Secure Containers, but all other hadoop services, including YARN job execution outside secure containers continue to work.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN cluster is accepting work from remote (authenticated) users, this MAY permit remote users to gain root privileges.\n\nHadoop 3.3.0 updated the \" YARN Secure Containers https://hadoop.apache.org/docs/stable/hadoop-yarn/hadoop-yarn-site/SecureContainer.html \" to add a feature for executing user-submitted applications in isolated linux containers.\n\nThe native binary HADOOP_HOME/bin/container-executor is used to launch these containers; it must be owned by root and have the suid bit set in order for the YARN processes to run the containers as the specific users submitting the jobs.\n\nThe patch \" YARN-10495 https://issues.apache.org/jira/browse/YARN-10495 . make the rpath of container-executor configurable\" modified the library loading path for loading .so files from \"$ORIGIN/\" to \"\"$ORIGIN/:../lib/native/\". This is the a path through which libcrypto.so is located. Thus it is is possible for a user with reduced privileges to install a malicious libcrypto library into a path to which they have write access, invoke the container-executor command, and have their modified library executed as root.\nIf the YARN cluster is accepting work from remote (authenticated) users, and these users\u0027 submitted job are executed in the physical host, rather than a container, then the CVE permits remote users to gain root privileges.\n\nThe fix for the vulnerability is to revert the change, which is done in  YARN-11441 https://issues.apache.org/jira/browse/YARN-11441 , \"Revert YARN-10495\". This patch is in hadoop-3.3.5.\n\nTo determine whether a version of container-executor is vulnerable, use the readelf command. If the RUNPATH or RPATH value contains the relative path \"./lib/native/\" then it  is at risk\n\n$ readelf -d container-executor|grep \u0027RUNPATH\\|RPATH\u0027 \n0x000000000000001d (RUNPATH)  \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Library runpath: [$ORIGIN/:../lib/native/]\n\nIf it does not, then it is safe:\n\n$ readelf -d container-executor|grep \u0027RUNPATH\\|RPATH\u0027 \n0x000000000000001d (RUNPATH)  \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Library runpath: [$ORIGIN/]\n\nFor an at-risk version of container-executor to enable privilege escalation, the owner must be root and the suid bit must be set\n\n$ ls -laF /opt/hadoop/bin/container-executor\n---Sr-s---. 1 root hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor\n\nA safe installation lacks the suid bit; ideally is also not owned by root.\n\n$ ls -laF /opt/hadoop/bin/container-executor\n-rwxr-xr-x. 1 yarn hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor\n\nThis configuration does not support Yarn Secure Containers, but all other hadoop services, including YARN job execution outside secure containers continue to work."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "critical"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-426",
              "description": "CWE-426 Untrusted Search Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-12T14:06:17.973Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://issues.apache.org/jira/browse/YARN-11441"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://hadoop.apache.org/cve_list.html"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/q9qpdlv952gb4kphpndd5phvl7fkh71r"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240112-0001/"
        }
      ],
      "source": {
        "defect": [
          "YARN-11441"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Privilege escalation in Apache Hadoop Yarn container-executor binary on Linux systems",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003col\u003e\u003cli\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eUpgrade to Apache Hadoop 3.3.5\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eIf\u0026nbsp;Yarn Secure Containers are not required, remove all execute permissions on bin/container-executor ; change its owner from root, or simply delete it.\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eIf Yarn Secure Containers are required on a vulnerable release and upgrade is not possible, replace the container-executor\u0026nbsp;binary with that of the 3.3.5 release.\u003c/span\u003e\u003cbr\u003e\u003c/li\u003e\u003c/ol\u003eAs most Hadoop installations do not use Yarn Secure Containers, removing execute permissions from the container-executor binary a is sufficient to secure the systems; deletion ensures that no security scanners will report the issue."
            }
          ],
          "value": "*  Upgrade to Apache Hadoop 3.3.5\n  *  If\u00a0Yarn Secure Containers are not required, remove all execute permissions on bin/container-executor ; change its owner from root, or simply delete it.\n  *  If Yarn Secure Containers are required on a vulnerable release and upgrade is not possible, replace the container-executor\u00a0binary with that of the 3.3.5 release.\n\nAs most Hadoop installations do not use Yarn Secure Containers, removing execute permissions from the container-executor binary a is sufficient to secure the systems; deletion ensures that no security scanners will report the issue."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2023-26031",
    "datePublished": "2023-11-16T08:15:50.808Z",
    "dateReserved": "2023-02-17T19:39:48.891Z",
    "dateUpdated": "2025-02-13T16:44:42.474Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-33201 (GCVE-0-2023-33201)

Vulnerability from cvelistv5 – Published: 2023-07-05 00:00 – Updated: 2024-12-04 15:48

Summary

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

5 references

URL	Tags
https://bouncycastle.org
https://github.com/bcgit/bc-java/commit/e8c409a83…
https://github.com/bcgit/bc-java/wiki/CVE-2023-33201
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://security.netapp.com/advisory/ntap-2023082…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T15:39:35.708Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bouncycastle.org"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201"
          },
          {
            "name": "[debian-lts-announce] 20230802 [SECURITY] [DLA 3514-1] bouncycastle security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230824-0008/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-33201",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-04T15:47:56.732893Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-04T15:48:15.487Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate\u0027s Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-24T18:06:18.676Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://bouncycastle.org"
        },
        {
          "url": "https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc"
        },
        {
          "url": "https://github.com/bcgit/bc-java/wiki/CVE-2023-33201"
        },
        {
          "name": "[debian-lts-announce] 20230802 [SECURITY] [DLA 3514-1] bouncycastle security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230824-0008/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-33201",
    "datePublished": "2023-07-05T00:00:00.000Z",
    "dateReserved": "2023-05-18T00:00:00.000Z",
    "dateUpdated": "2024-12-04T15:48:15.487Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-39410 (GCVE-0-2023-39410)

Vulnerability from cvelistv5 – Published: 2023-09-29 16:23 – Updated: 2025-02-13 17:03

Title

Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK

Summary

When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro version 1.11.3 which addresses this issue.

Severity

No CVSS data available.

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

apache

References

3 references

URL	Tags
https://lists.apache.org/thread/q142wj99cwdd0jo5l…	vendor-advisory
https://www.openwall.com/lists/oss-security/2023/…
https://security.netapp.com/advisory/ntap-2024062…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Avro Java SDK	Affected: 0 , < 1.11.3 (semver)

Credits

Adam Korczynski at ADA Logics Ltd

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apache:avro:-:*:*:*:*:rust:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "avro",
            "vendor": "apache",
            "versions": [
              {
                "lessThan": "1.11.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-39410",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-26T19:07:20.270770Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-26T19:09:26.935Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:10:20.868Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/q142wj99cwdd0jo5lvdoxzoymlqyjdds"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2023/09/29/6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Avro Java SDK",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "1.11.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Adam Korczynski at ADA Logics Ltd"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eWhen deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThis issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2.  Users should update to apache-avro version 1.11.3 which addresses this issue.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e"
            }
          ],
          "value": "When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.\n\nThis issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2.  Users should update to apache-avro version 1.11.3 which addresses this issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:06:21.390Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/q142wj99cwdd0jo5lvdoxzoymlqyjdds"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2023/09/29/6"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ],
      "source": {
        "defect": [
          "AVRO-3819"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2023-39410",
    "datePublished": "2023-09-29T16:23:34.021Z",
    "dateReserved": "2023-07-31T17:55:21.702Z",
    "dateUpdated": "2025-02-13T17:03:03.075Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-44483 (GCVE-0-2023-44483)

Vulnerability from cvelistv5 – Published: 2023-10-20 09:23 – Updated: 2025-11-03 21:49

Title

Apache Santuario: Private Key disclosure in debug-log output

Summary

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.

Severity

No CVSS data available.

CWE

CWE-532 - Insertion of Sensitive Information into Log File

Assigner

apache

References

2 references

URL	Tags
https://lists.apache.org/thread/vmqbp9mfxtrf0kmbn…	vendor-advisory
http://www.openwall.com/lists/oss-security/2023/10/20/5

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Santuario	Affected: 2.2 , < 2.2.6 (semver) Affected: 2.3 , < 2.3.4 (semver) Affected: 3.0 , < 3.0.3 (semver)

Credits

Apache Santuario would like to thank Max Fichtelmann for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:49:47.169Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/vmqbp9mfxtrf0kmbnnmbn3h9j6dr9q55"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/10/20/5"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20241108-0002/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-44483",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-12T14:33:15.116438Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T14:36:02.225Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Santuario",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "2.2.6",
              "status": "affected",
              "version": "2.2",
              "versionType": "semver"
            },
            {
              "lessThan": "2.3.4",
              "status": "affected",
              "version": "2.3",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.3",
              "status": "affected",
              "version": "3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apache Santuario would like to thank Max Fichtelmann for reporting this issue."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled.\u0026nbsp;Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.\u003cbr\u003e"
            }
          ],
          "value": "All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled.\u00a0Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532 Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-20T09:25:12.008Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/vmqbp9mfxtrf0kmbnnmbn3h9j6dr9q55"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2023/10/20/5"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Santuario: Private Key disclosure in debug-log output",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2023-44483",
    "datePublished": "2023-10-20T09:23:53.483Z",
    "dateReserved": "2023-09-29T15:05:04.230Z",
    "dateUpdated": "2025-11-03T21:49:47.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-48795 (GCVE-0-2023-48795)

Vulnerability from cvelistv5 – Published: 2023-12-18 00:00 – Updated: 2026-05-12 11:02

Summary

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE

Assigner

mitre

References

118 references

URL	Tags
https://www.chiark.greenend.org.uk/~sgtatham/putt…
https://matt.ucc.asn.au/dropbear/CHANGES
https://github.com/proftpd/proftpd/blob/master/RE…
https://www.netsarang.com/en/xshell-update-history/
https://www.paramiko.org/changelog.html
https://www.openssh.com/openbsd.html
https://github.com/openssh/openssh-portable/commi…
https://groups.google.com/g/golang-announce/c/-n5…
https://www.bitvise.com/ssh-server-version-history
https://github.com/ronf/asyncssh/tags
https://gitlab.com/libssh/libssh-mirror/-/tags
https://www.reddit.com/r/sysadmin/comments/18idv5…
https://github.com/erlang/otp/blob/d1b43dc0f1361d…
https://www.openssh.com/txt/release-9.6
https://jadaptive.com/important-java-ssh-security…
https://www.terrapin-attack.com
https://github.com/mkj/dropbear/blob/17657c36cce6…
https://github.com/ronf/asyncssh/blob/develop/doc…
https://thorntech.com/cve-2023-48795-and-sftp-gateway/
https://github.com/warp-tech/russh/releases/tag/v0.40.2
https://github.com/TeraTermProject/teraterm/commi…
https://www.openwall.com/lists/oss-security/2023/…
https://twitter.com/TrueSkrillor/status/173677438…
https://github.com/golang/crypto/commit/9d2ee975e…
https://github.com/paramiko/paramiko/issues/2337
https://groups.google.com/g/golang-announce/c/qA3…
https://news.ycombinator.com/item?id=38684904
https://news.ycombinator.com/item?id=38685286
http://www.openwall.com/lists/oss-security/2023/12/18/3	mailing-list
https://github.com/mwiede/jsch/issues/457
https://git.libssh.org/projects/libssh.git/commit…
https://github.com/erlang/otp/releases/tag/OTP-26.2.1
https://github.com/advisories/GHSA-45x7-px36-x8w8
https://security-tracker.debian.org/tracker/sourc…
https://security-tracker.debian.org/tracker/sourc…
https://security-tracker.debian.org/tracker/CVE-2…
https://bugzilla.suse.com/show_bug.cgi?id=1217950
https://bugzilla.redhat.com/show_bug.cgi?id=2254210
https://bugs.gentoo.org/920280
https://ubuntu.com/security/CVE-2023-48795
https://www.suse.com/c/suse-addresses-the-ssh-v2-…
https://access.redhat.com/security/cve/cve-2023-48795
https://github.com/mwiede/jsch/pull/461
https://github.com/drakkan/sftpgo/releases/tag/v2.5.6
https://github.com/libssh2/libssh2/pull/1291
https://forum.netgate.com/topic/184941/terrapin-s…
https://github.com/jtesta/ssh-audit/commit/8e972c…
https://github.com/rapier1/hpn-ssh/releases
https://github.com/proftpd/proftpd/issues/456
https://github.com/TeraTermProject/teraterm/relea…
https://github.com/mwiede/jsch/compare/jsch-0.2.1…
https://oryx-embedded.com/download/#changelog
https://www.crushftp.com/crush10wiki/Wiki.jsp?pag…
https://github.com/connectbot/sshlib/compare/2.2.…
https://github.com/connectbot/sshlib/commit/5c8b5…
https://github.com/mscdex/ssh2/commit/97b223f8891…
https://nest.pijul.com/pijul/thrussh/changes/D6H7…
https://crates.io/crates/thrussh/versions
https://github.com/NixOS/nixpkgs/pull/275249
http://www.openwall.com/lists/oss-security/2023/12/19/5	mailing-list
https://www.freebsd.org/security/advisories/FreeB…
https://arstechnica.com/security/2023/12/hackers-…
http://www.openwall.com/lists/oss-security/2023/12/20/3	mailing-list
http://packetstormsecurity.com/files/176280/Terra…
https://github.com/proftpd/proftpd/blob/d21e7a2e4…
https://github.com/proftpd/proftpd/blob/0a7ea9b0b…
https://github.com/apache/mina-sshd/issues/445
https://github.com/hierynomus/sshj/issues/916
https://github.com/janmojzis/tinyssh/issues/81
https://www.openwall.com/lists/oss-security/2023/…
https://security-tracker.debian.org/tracker/sourc…
https://github.com/net-ssh/net-ssh/blob/2e65064a5…
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://www.debian.org/security/2023/dsa-5586	vendor-advisory
https://www.lancom-systems.de/service-support/all…
https://www.theregister.com/2023/12/20/terrapin_a…
https://filezilla-project.org/versions.php
https://nova.app/releases/#v11.8
https://roumenpetrov.info/secsh/#news20231220
https://www.vandyke.com/products/securecrt/history.txt
https://help.panic.com/releasenotes/transmit5/
https://github.com/PowerShell/Win32-OpenSSH/relea…
https://github.com/PowerShell/Win32-OpenSSH/issues/2189
https://winscp.net/eng/docs/history#6.2.2
https://www.bitvise.com/ssh-client-version-history#933
https://github.com/cyd01/KiTTY/issues/520
https://www.debian.org/security/2023/dsa-5588	vendor-advisory
https://github.com/ssh-mitm/ssh-mitm/issues/165
https://news.ycombinator.com/item?id=38732005
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://security.gentoo.org/glsa/202312-16	vendor-advisory
https://security.gentoo.org/glsa/202312-17	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://security.netapp.com/advisory/ntap-2024010…
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://psirt.global.sonicwall.com/vuln-detail/SN…
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2024…	mailing-list
https://lists.debian.org/debian-lts-announce/2024…	mailing-list
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://support.apple.com/kb/HT214084
http://seclists.org/fulldisclosure/2024/Mar/21	mailing-list
https://lists.debian.org/debian-lts-announce/2024…	mailing-list
http://www.openwall.com/lists/oss-security/2024/04/17/8	mailing-list
http://www.openwall.com/lists/oss-security/2024/03/06/3	mailing-list

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T22:05:21.417Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.vicarius.io/vsociety/posts/cve-2023-48795-detect-openssh-vulnerabilit"
          },
          {
            "url": "https://www.vicarius.io/vsociety/posts/cve-2023-48795-mitigate-openssh-vulnerability"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://matt.ucc.asn.au/dropbear/CHANGES"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.netsarang.com/en/xshell-update-history/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.paramiko.org/changelog.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openssh.com/openbsd.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/openssh/openssh-portable/commits/master"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.bitvise.com/ssh-server-version-history"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/ronf/asyncssh/tags"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gitlab.com/libssh/libssh-mirror/-/tags"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.reddit.com/r/sysadmin/comments/18idv52/cve202348795_why_is_this_cve_still_undisclosed/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L39-L42"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openssh.com/txt/release-9.6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jadaptive.com/important-java-ssh-security-update-new-ssh-vulnerability-discovered-cve-2023-48795/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.terrapin-attack.com"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/mkj/dropbear/blob/17657c36cce6df7716d5ff151ec09a665382d5dd/CHANGES#L25"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://thorntech.com/cve-2023-48795-and-sftp-gateway/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/russh/releases/tag/v0.40.2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2023/12/18/2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://twitter.com/TrueSkrillor/status/1736774389725565005"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/paramiko/paramiko/issues/2337"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://news.ycombinator.com/item?id=38684904"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://news.ycombinator.com/item?id=38685286"
          },
          {
            "name": "[oss-security] 20231218 CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack)",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/12/18/3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/mwiede/jsch/issues/457"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.10\u0026id=10e09e273f69e149389b3e0e5d44b8c221c2e7f6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/erlang/otp/releases/tag/OTP-26.2.1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/advisories/GHSA-45x7-px36-x8w8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security-tracker.debian.org/tracker/source-package/libssh2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security-tracker.debian.org/tracker/source-package/proftpd-dfsg"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security-tracker.debian.org/tracker/CVE-2023-48795"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1217950"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254210"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugs.gentoo.org/920280"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://ubuntu.com/security/CVE-2023-48795"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.suse.com/c/suse-addresses-the-ssh-v2-protocol-terrapin-attack-aka-cve-2023-48795/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/cve-2023-48795"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/mwiede/jsch/pull/461"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/drakkan/sftpgo/releases/tag/v2.5.6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/libssh2/libssh2/pull/1291"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://forum.netgate.com/topic/184941/terrapin-ssh-attack"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/jtesta/ssh-audit/commit/8e972c5e94b460379fe0c7d20209c16df81538a5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/rapier1/hpn-ssh/releases"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/proftpd/proftpd/issues/456"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/TeraTermProject/teraterm/releases/tag/v5.1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/mwiede/jsch/compare/jsch-0.2.14...jsch-0.2.15"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://oryx-embedded.com/download/#changelog"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/connectbot/sshlib/compare/2.2.21...2.2.22"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/connectbot/sshlib/commit/5c8b534f6e97db7ac0e0e579331213aa25c173ab"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/mscdex/ssh2/commit/97b223f8891b96d6fc054df5ab1d5a1a545da2a3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://nest.pijul.com/pijul/thrussh/changes/D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://crates.io/crates/thrussh/versions"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/NixOS/nixpkgs/pull/275249"
          },
          {
            "name": "[oss-security] 20231219 Re: CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack)",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/12/19/5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/"
          },
          {
            "name": "[oss-security] 20231220 Re: CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack)",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/12/20/3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/proftpd/proftpd/blob/d21e7a2e47e9b38f709bec58e3fa711f759ad0e1/RELEASE_NOTES"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/proftpd/proftpd/blob/0a7ea9b0ba9fcdf368374a226370d08f10397d99/RELEASE_NOTES"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/apache/mina-sshd/issues/445"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/hierynomus/sshj/issues/916"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/janmojzis/tinyssh/issues/81"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2023/12/20/3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security-tracker.debian.org/tracker/source-package/trilead-ssh2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/net-ssh/net-ssh/blob/2e65064a52d73396bfc3806c9196fc8108f33cd8/CHANGES.txt#L14-L16"
          },
          {
            "name": "FEDORA-2023-0733306be9",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/"
          },
          {
            "name": "DSA-5586",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5586"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise#c243508"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.theregister.com/2023/12/20/terrapin_attack_ssh"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://filezilla-project.org/versions.php"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://nova.app/releases/#v11.8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://roumenpetrov.info/secsh/#news20231220"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.vandyke.com/products/securecrt/history.txt"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://help.panic.com/releasenotes/transmit5/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v9.5.0.0p1-Beta"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/PowerShell/Win32-OpenSSH/issues/2189"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://winscp.net/eng/docs/history#6.2.2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.bitvise.com/ssh-client-version-history#933"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/cyd01/KiTTY/issues/520"
          },
          {
            "name": "DSA-5588",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5588"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/ssh-mitm/ssh-mitm/issues/165"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://news.ycombinator.com/item?id=38732005"
          },
          {
            "name": "[debian-lts-announce] 20231226 [SECURITY] [DLA 3694-1] openssh security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html"
          },
          {
            "name": "GLSA-202312-16",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202312-16"
          },
          {
            "name": "GLSA-202312-17",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202312-17"
          },
          {
            "name": "FEDORA-2023-20feb865d8",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/"
          },
          {
            "name": "FEDORA-2023-cb8c606fbb",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7EYCFQCTSGJXWO3ZZ44MGKFC5HA7G3Y/"
          },
          {
            "name": "FEDORA-2023-e77300e4b5",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/"
          },
          {
            "name": "FEDORA-2023-b87ec6cf47",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QI3EHAHABFQK7OABNCSF5GMYP6TONTI7/"
          },
          {
            "name": "FEDORA-2023-153404713b",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KMZCVGUGJZZVDPCVDA7TEB22VUCNEXDD/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240105-0004/"
          },
          {
            "name": "FEDORA-2024-3bb23c77f3",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CAYYW35MUTNO65RVAELICTNZZFMT2XS/"
          },
          {
            "name": "FEDORA-2023-55800423a8",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/"
          },
          {
            "name": "FEDORA-2024-d946b9ad25",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/"
          },
          {
            "name": "FEDORA-2024-71c2c6526c",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BL5KTLOSLH2KHRN4HCXJPK3JUVLDGEL6/"
          },
          {
            "name": "FEDORA-2024-39a8c72ea9",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0002"
          },
          {
            "name": "FEDORA-2024-ae653fb07b",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/"
          },
          {
            "name": "FEDORA-2024-2705241461",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/"
          },
          {
            "name": "FEDORA-2024-fb32950d11",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/"
          },
          {
            "name": "FEDORA-2024-7b08207cdb",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/"
          },
          {
            "name": "FEDORA-2024-06ebb70bdd",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/"
          },
          {
            "name": "[debian-lts-announce] 20240125 [SECURITY] [DLA 3718-1] php-phpseclib security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00013.html"
          },
          {
            "name": "[debian-lts-announce] 20240125 [SECURITY] [DLA 3719-1] phpseclib security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00014.html"
          },
          {
            "name": "FEDORA-2024-a53b24023d",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/"
          },
          {
            "name": "FEDORA-2024-3fd1bc9276",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT214084"
          },
          {
            "name": "20240313 APPLE-SA-03-07-2024-2 macOS Sonoma 14.4",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Mar/21"
          },
          {
            "name": "[debian-lts-announce] 20240425 [SECURITY] [DLA 3794-1] putty security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html"
          },
          {
            "name": "[oss-security] 20240417 Terrapin vulnerability in Jenkins CLI client",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/04/17/8"
          },
          {
            "name": "[oss-security] 20240306 Multiple vulnerabilities in Jenkins plugins",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/03/06/3"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00028.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00032.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00042.html"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-48795",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2023-12-22T05:01:05.519910Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-354",
                "description": "CWE-354 Improper Validation of Integrity Check Value",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-27T20:45:57.733Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM APE1808",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:02:25.905Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-794697.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-364175.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-915275.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH\u0027s use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-01T18:06:23.972Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html"
        },
        {
          "url": "https://matt.ucc.asn.au/dropbear/CHANGES"
        },
        {
          "url": "https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES"
        },
        {
          "url": "https://www.netsarang.com/en/xshell-update-history/"
        },
        {
          "url": "https://www.paramiko.org/changelog.html"
        },
        {
          "url": "https://www.openssh.com/openbsd.html"
        },
        {
          "url": "https://github.com/openssh/openssh-portable/commits/master"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ"
        },
        {
          "url": "https://www.bitvise.com/ssh-server-version-history"
        },
        {
          "url": "https://github.com/ronf/asyncssh/tags"
        },
        {
          "url": "https://gitlab.com/libssh/libssh-mirror/-/tags"
        },
        {
          "url": "https://www.reddit.com/r/sysadmin/comments/18idv52/cve202348795_why_is_this_cve_still_undisclosed/"
        },
        {
          "url": "https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L39-L42"
        },
        {
          "url": "https://www.openssh.com/txt/release-9.6"
        },
        {
          "url": "https://jadaptive.com/important-java-ssh-security-update-new-ssh-vulnerability-discovered-cve-2023-48795/"
        },
        {
          "url": "https://www.terrapin-attack.com"
        },
        {
          "url": "https://github.com/mkj/dropbear/blob/17657c36cce6df7716d5ff151ec09a665382d5dd/CHANGES#L25"
        },
        {
          "url": "https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst"
        },
        {
          "url": "https://thorntech.com/cve-2023-48795-and-sftp-gateway/"
        },
        {
          "url": "https://github.com/warp-tech/russh/releases/tag/v0.40.2"
        },
        {
          "url": "https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2023/12/18/2"
        },
        {
          "url": "https://twitter.com/TrueSkrillor/status/1736774389725565005"
        },
        {
          "url": "https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d"
        },
        {
          "url": "https://github.com/paramiko/paramiko/issues/2337"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg"
        },
        {
          "url": "https://news.ycombinator.com/item?id=38684904"
        },
        {
          "url": "https://news.ycombinator.com/item?id=38685286"
        },
        {
          "name": "[oss-security] 20231218 CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack)",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2023/12/18/3"
        },
        {
          "url": "https://github.com/mwiede/jsch/issues/457"
        },
        {
          "url": "https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.10\u0026id=10e09e273f69e149389b3e0e5d44b8c221c2e7f6"
        },
        {
          "url": "https://github.com/erlang/otp/releases/tag/OTP-26.2.1"
        },
        {
          "url": "https://github.com/advisories/GHSA-45x7-px36-x8w8"
        },
        {
          "url": "https://security-tracker.debian.org/tracker/source-package/libssh2"
        },
        {
          "url": "https://security-tracker.debian.org/tracker/source-package/proftpd-dfsg"
        },
        {
          "url": "https://security-tracker.debian.org/tracker/CVE-2023-48795"
        },
        {
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1217950"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254210"
        },
        {
          "url": "https://bugs.gentoo.org/920280"
        },
        {
          "url": "https://ubuntu.com/security/CVE-2023-48795"
        },
        {
          "url": "https://www.suse.com/c/suse-addresses-the-ssh-v2-protocol-terrapin-attack-aka-cve-2023-48795/"
        },
        {
          "url": "https://access.redhat.com/security/cve/cve-2023-48795"
        },
        {
          "url": "https://github.com/mwiede/jsch/pull/461"
        },
        {
          "url": "https://github.com/drakkan/sftpgo/releases/tag/v2.5.6"
        },
        {
          "url": "https://github.com/libssh2/libssh2/pull/1291"
        },
        {
          "url": "https://forum.netgate.com/topic/184941/terrapin-ssh-attack"
        },
        {
          "url": "https://github.com/jtesta/ssh-audit/commit/8e972c5e94b460379fe0c7d20209c16df81538a5"
        },
        {
          "url": "https://github.com/rapier1/hpn-ssh/releases"
        },
        {
          "url": "https://github.com/proftpd/proftpd/issues/456"
        },
        {
          "url": "https://github.com/TeraTermProject/teraterm/releases/tag/v5.1"
        },
        {
          "url": "https://github.com/mwiede/jsch/compare/jsch-0.2.14...jsch-0.2.15"
        },
        {
          "url": "https://oryx-embedded.com/download/#changelog"
        },
        {
          "url": "https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update"
        },
        {
          "url": "https://github.com/connectbot/sshlib/compare/2.2.21...2.2.22"
        },
        {
          "url": "https://github.com/connectbot/sshlib/commit/5c8b534f6e97db7ac0e0e579331213aa25c173ab"
        },
        {
          "url": "https://github.com/mscdex/ssh2/commit/97b223f8891b96d6fc054df5ab1d5a1a545da2a3"
        },
        {
          "url": "https://nest.pijul.com/pijul/thrussh/changes/D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC"
        },
        {
          "url": "https://crates.io/crates/thrussh/versions"
        },
        {
          "url": "https://github.com/NixOS/nixpkgs/pull/275249"
        },
        {
          "name": "[oss-security] 20231219 Re: CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack)",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2023/12/19/5"
        },
        {
          "url": "https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc"
        },
        {
          "url": "https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/"
        },
        {
          "name": "[oss-security] 20231220 Re: CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack)",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2023/12/20/3"
        },
        {
          "url": "http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html"
        },
        {
          "url": "https://github.com/proftpd/proftpd/blob/d21e7a2e47e9b38f709bec58e3fa711f759ad0e1/RELEASE_NOTES"
        },
        {
          "url": "https://github.com/proftpd/proftpd/blob/0a7ea9b0ba9fcdf368374a226370d08f10397d99/RELEASE_NOTES"
        },
        {
          "url": "https://github.com/apache/mina-sshd/issues/445"
        },
        {
          "url": "https://github.com/hierynomus/sshj/issues/916"
        },
        {
          "url": "https://github.com/janmojzis/tinyssh/issues/81"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2023/12/20/3"
        },
        {
          "url": "https://security-tracker.debian.org/tracker/source-package/trilead-ssh2"
        },
        {
          "url": "https://github.com/net-ssh/net-ssh/blob/2e65064a52d73396bfc3806c9196fc8108f33cd8/CHANGES.txt#L14-L16"
        },
        {
          "name": "FEDORA-2023-0733306be9",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/"
        },
        {
          "name": "DSA-5586",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5586"
        },
        {
          "url": "https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise#c243508"
        },
        {
          "url": "https://www.theregister.com/2023/12/20/terrapin_attack_ssh"
        },
        {
          "url": "https://filezilla-project.org/versions.php"
        },
        {
          "url": "https://nova.app/releases/#v11.8"
        },
        {
          "url": "https://roumenpetrov.info/secsh/#news20231220"
        },
        {
          "url": "https://www.vandyke.com/products/securecrt/history.txt"
        },
        {
          "url": "https://help.panic.com/releasenotes/transmit5/"
        },
        {
          "url": "https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v9.5.0.0p1-Beta"
        },
        {
          "url": "https://github.com/PowerShell/Win32-OpenSSH/issues/2189"
        },
        {
          "url": "https://winscp.net/eng/docs/history#6.2.2"
        },
        {
          "url": "https://www.bitvise.com/ssh-client-version-history#933"
        },
        {
          "url": "https://github.com/cyd01/KiTTY/issues/520"
        },
        {
          "name": "DSA-5588",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5588"
        },
        {
          "url": "https://github.com/ssh-mitm/ssh-mitm/issues/165"
        },
        {
          "url": "https://news.ycombinator.com/item?id=38732005"
        },
        {
          "name": "[debian-lts-announce] 20231226 [SECURITY] [DLA 3694-1] openssh security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html"
        },
        {
          "name": "GLSA-202312-16",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202312-16"
        },
        {
          "name": "GLSA-202312-17",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202312-17"
        },
        {
          "name": "FEDORA-2023-20feb865d8",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/"
        },
        {
          "name": "FEDORA-2023-cb8c606fbb",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7EYCFQCTSGJXWO3ZZ44MGKFC5HA7G3Y/"
        },
        {
          "name": "FEDORA-2023-e77300e4b5",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/"
        },
        {
          "name": "FEDORA-2023-b87ec6cf47",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QI3EHAHABFQK7OABNCSF5GMYP6TONTI7/"
        },
        {
          "name": "FEDORA-2023-153404713b",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KMZCVGUGJZZVDPCVDA7TEB22VUCNEXDD/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240105-0004/"
        },
        {
          "name": "FEDORA-2024-3bb23c77f3",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CAYYW35MUTNO65RVAELICTNZZFMT2XS/"
        },
        {
          "name": "FEDORA-2023-55800423a8",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/"
        },
        {
          "name": "FEDORA-2024-d946b9ad25",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/"
        },
        {
          "name": "FEDORA-2024-71c2c6526c",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BL5KTLOSLH2KHRN4HCXJPK3JUVLDGEL6/"
        },
        {
          "name": "FEDORA-2024-39a8c72ea9",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/"
        },
        {
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0002"
        },
        {
          "name": "FEDORA-2024-ae653fb07b",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/"
        },
        {
          "name": "FEDORA-2024-2705241461",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/"
        },
        {
          "name": "FEDORA-2024-fb32950d11",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/"
        },
        {
          "name": "FEDORA-2024-7b08207cdb",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/"
        },
        {
          "name": "FEDORA-2024-06ebb70bdd",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/"
        },
        {
          "name": "[debian-lts-announce] 20240125 [SECURITY] [DLA 3718-1] php-phpseclib security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00013.html"
        },
        {
          "name": "[debian-lts-announce] 20240125 [SECURITY] [DLA 3719-1] phpseclib security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00014.html"
        },
        {
          "name": "FEDORA-2024-a53b24023d",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/"
        },
        {
          "name": "FEDORA-2024-3fd1bc9276",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/"
        },
        {
          "url": "https://support.apple.com/kb/HT214084"
        },
        {
          "name": "20240313 APPLE-SA-03-07-2024-2 macOS Sonoma 14.4",
          "tags": [
            "mailing-list"
          ],
          "url": "http://seclists.org/fulldisclosure/2024/Mar/21"
        },
        {
          "name": "[debian-lts-announce] 20240425 [SECURITY] [DLA 3794-1] putty security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html"
        },
        {
          "name": "[oss-security] 20240417 Terrapin vulnerability in Jenkins CLI client",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2024/04/17/8"
        },
        {
          "name": "[oss-security] 20240306 Multiple vulnerabilities in Jenkins plugins",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2024/03/06/3"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-48795",
    "datePublished": "2023-12-18T00:00:00.000Z",
    "dateReserved": "2023-11-20T00:00:00.000Z",
    "dateUpdated": "2026-05-12T11:02:25.905Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-51074 (GCVE-0-2023-51074)

Vulnerability from cvelistv5 – Published: 2023-12-27 00:00 – Updated: 2024-08-02 22:32

Summary

json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

1 reference

URL	Tags
https://github.com/json-path/JsonPath/issues/973

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:32:08.933Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/json-path/JsonPath/issues/973"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-27T20:56:22.383Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/json-path/JsonPath/issues/973"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-51074",
    "datePublished": "2023-12-27T00:00:00.000Z",
    "dateReserved": "2023-12-18T00:00:00.000Z",
    "dateUpdated": "2024-08-02T22:32:08.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-52070 (GCVE-0-2023-52070)

Vulnerability from cvelistv5 – Published: 2024-04-10 00:00 – Updated: 2024-08-16 15:10 Disputed

Summary

JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the 'setSeriesNeedle(int index, int type)' method. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Assigner

mitre

References

3 references

URL	Tags
http://jfreechart.com
http://jfreeorg.com
https://gist.github.com/LLM4IG/f55de46e65fb5a19b7…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:48:12.168Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://jfreechart.com"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://jfreeorg.com"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gist.github.com/LLM4IG/f55de46e65fb5a19b7815adb36fd858b"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:jfree:jfreechart:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jfreechart",
            "vendor": "jfree",
            "versions": [
              {
                "status": "affected",
                "version": "1.5.4"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-52070",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-10T19:34:05.407897Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-16T15:10:09.538Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the \u0027setSeriesNeedle(int index, int type)\u0027 method. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-11T18:58:08.870Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "http://jfreechart.com"
        },
        {
          "url": "http://jfreeorg.com"
        },
        {
          "url": "https://gist.github.com/LLM4IG/f55de46e65fb5a19b7815adb36fd858b"
        }
      ],
      "tags": [
        "disputed"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-52070",
    "datePublished": "2024-04-10T00:00:00.000Z",
    "dateReserved": "2023-12-26T00:00:00.000Z",
    "dateUpdated": "2024-08-16T15:10:09.538Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-28219 (GCVE-0-2024-28219)

Vulnerability from cvelistv5 – Published: 2024-04-03 00:00 – Updated: 2025-11-04 18:30

Summary

In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

Severity

6.7 (Medium)


                        
                          CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:R

CWE

Assigner

mitre

References

3 references

URL	Tags
https://pillow.readthedocs.io/en/stable/releaseno…
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2024…	mailing-list

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:30:27.655Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security"
          },
          {
            "name": "FEDORA-2024-e4b1b4eab1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M/"
          },
          {
            "name": "[debian-lts-announce] 20240410 [SECURITY] [DLA 3786-1] pillow security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00008.html"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "fedora",
            "vendor": "fedoraproject",
            "versions": [
              {
                "status": "affected",
                "version": "39"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "pillow",
            "vendor": "python",
            "versions": [
              {
                "lessThan": "10.3.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "debian_linux",
            "vendor": "debian",
            "versions": [
              {
                "status": "affected",
                "version": "10.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-28219",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-03T18:09:55.017027Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-680",
                "description": "CWE-680 Integer Overflow to Buffer Overflow",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-20T19:27:26.783Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:R",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-10T22:05:51.052Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security"
        },
        {
          "name": "FEDORA-2024-e4b1b4eab1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M/"
        },
        {
          "name": "[debian-lts-announce] 20240410 [SECURITY] [DLA 3786-1] pillow security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00008.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-28219",
    "datePublished": "2024-04-03T00:00:00.000Z",
    "dateReserved": "2024-03-07T00:00:00.000Z",
    "dateUpdated": "2025-11-04T18:30:27.655Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-34064 (GCVE-0-2024-34064)

Vulnerability from cvelistv5 – Published: 2024-05-06 14:41 – Updated: 2025-11-03 21:54

Title

Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

Summary

Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This vulnerability is fixed in 3.1.4.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

6 references

URL	Tags
https://github.com/pallets/jinja/security/advisor…	x_refsource_CONFIRM
https://github.com/pallets/jinja/commit/0668239dc…	x_refsource_MISC
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…

Impacted products

1 product

Vendor	Product	Version
pallets	jinja	Affected: < 3.1.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-34064",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-09T17:53:36.420762Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-27T21:13:00.297Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:54:48.796Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj"
          },
          {
            "name": "https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCLF44KY43BSVMTE6S53B4V5WP3FRRSE/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/567XIGSZMABG6TSMYWD7MIYNJSUQQRUC/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00009.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jinja",
          "vendor": "pallets",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.1.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `\u003e`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This vulnerability is fixed in 3.1.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-10T16:08:27.786Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj"
        },
        {
          "name": "https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCLF44KY43BSVMTE6S53B4V5WP3FRRSE/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/567XIGSZMABG6TSMYWD7MIYNJSUQQRUC/"
        }
      ],
      "source": {
        "advisory": "GHSA-h75v-3vvj-5mfj",
        "discovery": "UNKNOWN"
      },
      "title": "Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-34064",
    "datePublished": "2024-05-06T14:41:39.912Z",
    "dateReserved": "2024-04-30T06:56:33.380Z",
    "dateUpdated": "2025-11-03T21:54:48.796Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Product	Identifier	Version
banking_corporate_lending_process_management oracle	`cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.4.0.0.0:::::::*`	—
banking_corporate_lending_process_management oracle	`cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0.0.0:::::::*`	—
banking_corporate_lending_process_management oracle	`cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.6.0.0.0:::::::*`	—
banking_corporate_lending_process_management oracle	`cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.7.0.0.0:::::::*`	—
banking_liquidity_management oracle	`cpe:2.3:a:oracle:banking_liquidity_management:14.5.0.0.0:::::::*`	—
banking_liquidity_management oracle	`cpe:2.3:a:oracle:banking_liquidity_management:14.6.0.0.0:::::::*`	—
banking_liquidity_management oracle	`cpe:2.3:a:oracle:banking_liquidity_management:14.7.0.0.0:::::::*`	—
banking_origination oracle	`cpe:2.3:a:oracle:banking_origination:14.5.0.0.0:::::::*`	—
banking_origination oracle	`cpe:2.3:a:oracle:banking_origination:14.6.0.0.0:::::::*`	—
banking_origination oracle	`cpe:2.3:a:oracle:banking_origination:14.7.0.0.0:::::::*`	—
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7:::::::*`	—
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.8:::::::*`	—
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1:::::::*`	—
financial_services_analytical_applications_infrastructure oracle	`cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2:::::::*`	—
financial_services_basel_regulatory_capital_basic oracle	`cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.0.7.3:::::::*`	—
financial_services_basel_regulatory_capital_basic oracle	`cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.0.8.3:::::::*`	—
financial_services_basel_regulatory_capital_internal_ratings_based_approach oracle	`cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.0.7.3:::::::*`	—
financial_services_basel_regulatory_capital_internal_ratings_based_approach oracle	`cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.0.8.3:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.8.1:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.6:::::::*`	—
financial_services_behavior_detection_platform oracle	`cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.7:::::::*`	—
financial_services_compliance_studio oracle	`cpe:2.3:a:oracle:financial_services_compliance_studio:8.1.2.6:::::::*`	—
financial_services_compliance_studio oracle	`cpe:2.3:a:oracle:financial_services_compliance_studio:8.1.2.7:::::::*`	—
financial_services_enterprise_case_management oracle	`cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.2.8:::::::*`	—
financial_services_enterprise_case_management oracle	`cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1.18:::::::*`	—
financial_services_enterprise_case_management oracle	`cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.6.4:::::::*`	—
financial_services_enterprise_case_management oracle	`cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.7.3:::::::*`	—
financial_services_model_management_and_governance oracle	`cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.5:::::::*`	—
financial_services_model_management_and_governance oracle	`cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.2.6:::::::*`	—
financial_services_revenue_management_and_billing oracle	`cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:6.0.0.0.0:::::::*`	—
financial_services_revenue_management_and_billing oracle	`cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:6.1.0.0.0:::::::*`	—
financial_services_trade-based_anti_money_laundering_enterprise_edition oracle	`cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering_enterprise_edition:8.0.8.0:::::::*`	—
financial_services_compliance_studio oracle	`cpe:2.3:a:oracle:financial_services_compliance_studio:8.1.2.5:::::::*`	—

Action not permitted

NCSC-2025-0025

CVE-2022-34169 (GCVE-0-2022-34169)

CVE-2023-26031 (GCVE-0-2023-26031)

CVE-2023-33201 (GCVE-0-2023-33201)

CVE-2023-39410 (GCVE-0-2023-39410)

CVE-2023-44483 (GCVE-0-2023-44483)

CVE-2023-48795 (GCVE-0-2023-48795)

CVE-2023-51074 (GCVE-0-2023-51074)

CVE-2023-52070 (GCVE-0-2023-52070)

CVE-2024-28219 (GCVE-0-2024-28219)

CVE-2024-34064 (GCVE-0-2024-34064)

Tags

Sightings

Nomenclature