BlackTreeIndependent security intelligence

← Back to the CVE catalogue

Full vulnerability report · 2023

CVE-2023-4807High confidence

POLY1305 MAC implementation corrupts XMM registers on Windows

OpenSSL · OpenSSL

7.8HighCVSS 3.1

Recommended action

Within 7 days

High technical severity; prioritise exposed affected systems while verifying vendor guidance.

Patch available

Direct vendor intelligence

Authoritative vendor CSAF and VEX advisories

Structured product status and remediation from the issuing vendor. Product-state explanations are always visible; large lists can be searched or downloaded.

6 current

SSA-398330 · CSAF 2.0 · revision 18 · interimSiemens ProductCERTSSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5

5 known affected

The vendor explicitly identifies these products as affected by this CVE.

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)

Summary: Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is used only on newer x86_64 processors supporting the AVX512-IFMA instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However given the contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3 and a malicious client can influence whether this AEAD cipher is used by the server. This implies that server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue. As a workaround the AVX512-IFMA instructions support can be disabled at runtime by setting the environment variable OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000 The FIPS provider is not affected by this issue.
Remediation: Update to V3.1.5 or later version

SSA-277137 · CSAF 2.0 · revision 1 · interimSiemens ProductCERTSSA-277137: Multiple Vulnerabilities in SIDIS Prime Before V4.0.700

1 known affected

The vendor explicitly identifies these products as affected by this CVE.

SIDIS Prime

Summary: Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is used only on newer x86_64 processors supporting the AVX512-IFMA instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However given the contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3 and a malicious client can influence whether this AEAD cipher is used by the server. This implies that server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue. As a workaround the AVX512-IFMA instructions support can be disabled at runtime by setting the environment variable OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000 The FIPS provider is not affected by this issue.
Remediation: Update to V4.0.700 or later version

SSA-331112 · CSAF 2.0 · revision 1 · interimSiemens ProductCERTSSA-331112: Multiple Vulnerabilities in SINEC NMS Before V3.0 SP1

1 known affected

The vendor explicitly identifies these products as affected by this CVE.

SINEC NMS

Summary: Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is used only on newer x86_64 processors supporting the AVX512-IFMA instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However given the contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3 and a malicious client can influence whether this AEAD cipher is used by the server. This implies that server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue. As a workaround the AVX512-IFMA instructions support can be disabled at runtime by setting the environment variable OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000 The FIPS provider is not affected by this issue.
Remediation: Update to V3.0 SP1 or later version

SSA-915275 · CSAF 2.0 · revision 1 · interimSiemens ProductCERTSSA-915275: Multiple Vulnerabilities in SINEC INS Before V1.0 SP2 Update 3

1 known affected

The vendor explicitly identifies these products as affected by this CVE.

SINEC INS

Summary: Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is used only on newer x86_64 processors supporting the AVX512-IFMA instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However given the contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3 and a malicious client can influence whether this AEAD cipher is used by the server. This implies that server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue. As a workaround the AVX512-IFMA instructions support can be disabled at runtime by setting the environment variable OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000 The FIPS provider is not affected by this issue.
Remediation: Update to V1.0 SP2 Update 3 or later version

SSA-093430 · CSAF 2.0 · revision 2 · interimSiemens ProductCERTSSA-093430: Multiple Vulnerabilities in SIMATIC RTLS Locating Manager before V3.0

7 known affected

The vendor explicitly identifies these products as affected by this CVE.

SIMATIC RTLS Locating Manager (6GT2780-0DA00)
SIMATIC RTLS Locating Manager (6GT2780-0DA10)
SIMATIC RTLS Locating Manager (6GT2780-0DA20)
SIMATIC RTLS Locating Manager (6GT2780-0DA30)
SIMATIC RTLS Locating Manager (6GT2780-1EA10)
SIMATIC RTLS Locating Manager (6GT2780-1EA20)
SIMATIC RTLS Locating Manager (6GT2780-1EA30)

Summary: Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is used only on newer x86_64 processors supporting the AVX512-IFMA instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However given the contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3 and a malicious client can influence whether this AEAD cipher is used by the server. This implies that server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue. As a workaround the AVX512-IFMA instructions support can be disabled at runtime by setting the environment variable OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000 The FIPS provider is not affected by this issue.
Remediation: Update to V3.0.1.1 or later version The update is available from Siemens Online Software Delivery (OSD).

SSA-556635 · CSAF 2.0 · revision 1 · interimSiemens ProductCERTSSA-556635: Multiple Vulnerabilities in Telecontrol Server Basic before V3.1.2.0

1 known affected

The vendor explicitly identifies these products as affected by this CVE.

TeleControl Server Basic V3

Summary: Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is used only on newer x86_64 processors supporting the AVX512-IFMA instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However given the contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3 and a malicious client can influence whether this AEAD cipher is used by the server. This implies that server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue. As a workaround the AVX512-IFMA instructions support can be disabled at runtime by setting the environment variable OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000 The FIPS provider is not affected by this issue.
Remediation: Update to V3.1.2 or later version

Official European source

ENISA European Vulnerability Database

Official EUVD identifiers, advisory evidence and known-exploited context. Missing fields are not treated as evidence of low risk.

1 current

ENISA EUVD identifier

EUVD-2023-54651

No EUVD known-exploited evidence

ENISA has published the identifier mapping but no EUVD description has been stored yet.

EUVD state: Present in the current official mapping
Known exploitation: Not present in the current ENISA EUVD known-exploited dataset. This is not proof of no exploitation.
ENISA score: Not supplied in the stored EUVD record
Advisory evidence: No linked advisory details stored yet

Recommended actionWithin 7 days

High technical severity; prioritise exposed affected systems while verifying vendor guidance.

Patch available

01

What, why and how

Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is used only on newer x86_64 processors supporting the AVX512-IFMA instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However given the contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3 and a malicious client can influence whether this AEAD cipher is used by the server. This implies that server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue. As a workaround the AVX512-IFMA instructions support can be disabled at runtime by setting the environment variable OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000 The FIPS provider is not affected by this issue.

What

Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is used only on newer x86_64 processors supporting the AVX512-IFMA instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However given the contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3 and a malicious client can influence whether this AEAD cipher is used by the server. This implies that server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue. As a workaround the AVX512-IFMA instructions support can be disabled at runtime by setting the environment variable OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000 The FIPS provider is not affected by this issue.

Why

A feature, API, or function does not perform according to its specification.

How

An attacker operating through local access may attempt exploitation with low privileges. If successful, the issue may disrupt the affected service.

What

Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is used only on newer x86_64 processors supporting the AVX512-IFMA instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However given the contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3 and a malicious client can influence whether this AEAD cipher is used by the server. This implies that server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue. As a workaround the AVX512-IFMA instructions support can be disabled at runtime by setting the environment variable OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000 The FIPS provider is not affected by this issue.

Why

A feature, API, or function does not perform according to its specification.

How

An attacker operating through local access may attempt exploitation with low privileges. If successful, the issue may disrupt the affected service.

02

Exploit reality and attack path

CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.

Observed exploitation

?

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

No confirmed evidence

No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.

Public PoC / exploit material

?

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

None recorded

No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.

Likely attack path: local access → Expected Behavior Violation → disrupt the affected service
Attack surface: Local
Privileges required: Low: a basic authenticated account is required
User interaction: None
Attack complexity: Low: no specialised conditions are recorded
Security boundary: Unchanged: impact remains within the vulnerable component's security authority
Weakness ? CWE means Common Weakness Enumeration: a standard category for the underlying weakness.: CWE-440 ↗
CWE-440: Expected Behavior Violation. A feature, API, or function does not perform according to its specification.
CVSS vector ? CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity.: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Common Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
AVLocalAttack vector: The attacker needs local access to the vulnerable system.ACLowAttack complexity: No specialised conditions are required beyond attacker-controlled input.PRLowPrivileges required: The attacker needs basic user-level privileges.UINoneUser interaction: No action by another user is required.SUnchangedScope: The security impact remains within the vulnerable component's authority.CHighConfidentiality impact: A successful attack can cause a major loss.IHighIntegrity impact: A successful attack can cause a major loss.AHighAvailability impact: A successful attack can cause a major loss.
Post-exploitation / living off the land: The issue can support a local privilege or sandbox boundary transition; normal system utilities may then be available in the gained context.

Denial of serviceCWE-440

A

Official authority intelligence

Only matched European and national findings are included. Language selectors and unavailable sources are omitted.

ENISA EUVD · EUVD-2023-54651Official EUVD mapping

0 linked advisory records.

Official EUVD record

BSI · German · WID-SEC-W-2024-0893Oracle PeopleSoft: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Oracle PeopleSoft ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Official advisory

BSI · German · WID-SEC-W-2023-2298OpenSSL: Schwachstelle ermöglicht Denial of Service

Ein Angreifer kann eine Schwachstelle in OpenSSL ausnutzen, um einen Denial of Service Angriff durchzuführen oder unbekannte Auswirkungen zu verursachen.

Official advisory

BSI · German · WID-SEC-W-2024-1591Juniper JUNOS: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Juniper JUNOS ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen, Privilegien zu erweitern und Sicherheitsmechanismen inklusive zu umgehen.

Official advisory

BSI · German · WID-SEC-W-2024-0053Dell BIOS: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen im Dell BIOS ausnutzen, um vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder einen Denial-of-Service-Zustand auszulösen.

Official advisory

CERT-FR · French · CERTFR-2026-AVI-0627Multiples vulnérabilités dans les produits Splunk

ord?id=CVE-2023-34453 Référence CVE CVE-2023-34454 https://www.cve.org/CVERecord?id=CVE-2023-34454 Référence CVE CVE-2023-34455 https://www.cve.org/CVERecord?id=CVE-2023-34455 Référence CVE CVE-2023-3635 https://www.cve.org/CVERecord?id=CVE-2023-3635 Référence CVE CVE-2023-37920 https://www.cve.org/CVERecord?id=CVE-2023-37920 Référence CVE CVE-2023-39410 https://www.cve.org/CVERecord?id=CVE-2023-39410 Référence CVE CVE-2023-43642 https://www.cve.org/CVERecord?id=CVE-2023-43642 Référence CVE CVE-2023-44487 https://www.cve.org/CVERecord?id=CVE-2023-44487 Référence CVE CVE-2023-47627 https://www.cve.org/CVERecord?id=CVE-2023-47627 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-49081 https://www.cve.org/CVERecord?id=CVE-2023-49081 Référence CVE CVE-2023-49082 https://www.cve.org/CVERecord?id=CVE-2023-49082 Référence CVE CVE-2023-49083 https://www.cve.org/CVERecord?id=CVE-2023-49083 Référence CVE CVE-2023-50782 https://www.cve.org/CVERecord?id=CVE-2023-50782 Référence CVE CVE-2023-5408 https://www.cve.org/CVERecord?id=CVE-2023-5408 Référence CVE CVE-2023-5590 https://www.cve.org/CVERecord?id=CVE-2023-5590 Référence CVE CVE-2024-0397 https://www.cve.org/CVERecord?id=CVE-2024-0397 Référence CVE CVE-2024-10220 https://www.cve.org/CVERecord?id=CVE-202

Official advisory

CERT-FR · French · CERTFR-2026-AVI-0199Multiples vulnérabilités dans les produits VMware

d?id=CVE-2023-45283 Référence CVE CVE-2023-45284 https://www.cve.org/CVERecord?id=CVE-2023-45284 Référence CVE CVE-2023-45285 https://www.cve.org/CVERecord?id=CVE-2023-45285 Référence CVE CVE-2023-45287 https://www.cve.org/CVERecord?id=CVE-2023-45287 Référence CVE CVE-2023-45288 https://www.cve.org/CVERecord?id=CVE-2023-45288 Référence CVE CVE-2023-45289 https://www.cve.org/CVERecord?id=CVE-2023-45289 Référence CVE CVE-2023-45290 https://www.cve.org/CVERecord?id=CVE-2023-45290 Référence CVE CVE-2023-46218 https://www.cve.org/CVERecord?id=CVE-2023-46218 Référence CVE CVE-2023-47090 https://www.cve.org/CVERecord?id=CVE-2023-47090 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-48795 https://www.cve.org/CVERecord?id=CVE-2023-48795 Référence CVE CVE-2023-5363 https://www.cve.org/CVERecord?id=CVE-2023-5363 Référence CVE CVE-2023-5678 https://www.cve.org/CVERecord?id=CVE-2023-5678 Référence CVE CVE-2023-6129 https://www.cve.org/CVERecord?id=CVE-2023-6129 Référence CVE CVE-2023-6237 https://www.cve.org/CVERecord?id=CVE-2023-6237 Référence CVE CVE-2024-0727 https://www.cve.org/CVERecord?id=CVE-2024-0727 Référence CVE CVE-2024-11053 https://www.cve.org/CVERecord?id=CVE-2024-11053 Référence CVE CVE-2024-13176 https://www.cve.org/CVERecord?id=CVE-2024-13

Official advisory

CERT-FR · French · CERTFR-2025-AVI-1057Multiples vulnérabilités dans les produits VMware

ERecord?id=CVE-2023-38546 Référence CVE CVE-2023-39615 https://www.cve.org/CVERecord?id=CVE-2023-39615 Référence CVE CVE-2023-40217 https://www.cve.org/CVERecord?id=CVE-2023-40217 Référence CVE CVE-2023-4039 https://www.cve.org/CVERecord?id=CVE-2023-4039 Référence CVE CVE-2023-4387 https://www.cve.org/CVERecord?id=CVE-2023-4387 Référence CVE CVE-2023-45322 https://www.cve.org/CVERecord?id=CVE-2023-45322 Référence CVE CVE-2023-45853 https://www.cve.org/CVERecord?id=CVE-2023-45853 Référence CVE CVE-2023-46218 https://www.cve.org/CVERecord?id=CVE-2023-46218 Référence CVE CVE-2023-4641 https://www.cve.org/CVERecord?id=CVE-2023-4641 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-4813 https://www.cve.org/CVERecord?id=CVE-2023-4813 Référence CVE CVE-2023-48795 https://www.cve.org/CVERecord?id=CVE-2023-48795 Référence CVE CVE-2023-50495 https://www.cve.org/CVERecord?id=CVE-2023-50495 Référence CVE CVE-2023-5156 https://www.cve.org/CVERecord?id=CVE-2023-5156 Référence CVE CVE-2023-52425 https://www.cve.org/CVERecord?id=CVE-2023-52425 Référence CVE CVE-2023-52426 https://www.cve.org/CVERecord?id=CVE-2023-52426 Référence CVE CVE-2023-52445 https://www.cve.org/CVERecord?id=CVE-2023-52445 Référence CVE CVE-2023-52451 https://www.cve.org/CVERecord?id=CVE-2

Official advisory

CERT-FR · French · CERTFR-2025-AVI-1054Multiples vulnérabilités dans les produits VMware

rg/CVERecord?id=CVE-2023-0466 Référence CVE CVE-2023-1255 https://www.cve.org/CVERecord?id=CVE-2023-1255 Référence CVE CVE-2023-2650 https://www.cve.org/CVERecord?id=CVE-2023-2650 Référence CVE CVE-2023-27043 https://www.cve.org/CVERecord?id=CVE-2023-27043 Référence CVE CVE-2023-2975 https://www.cve.org/CVERecord?id=CVE-2023-2975 Référence CVE CVE-2023-3446 https://www.cve.org/CVERecord?id=CVE-2023-3446 Référence CVE CVE-2023-36632 https://www.cve.org/CVERecord?id=CVE-2023-36632 Référence CVE CVE-2023-3817 https://www.cve.org/CVERecord?id=CVE-2023-3817 Référence CVE CVE-2023-40217 https://www.cve.org/CVERecord?id=CVE-2023-40217 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-52593 https://www.cve.org/CVERecord?id=CVE-2023-52593 Référence CVE CVE-2023-5363 https://www.cve.org/CVERecord?id=CVE-2023-5363 Référence CVE CVE-2023-5678 https://www.cve.org/CVERecord?id=CVE-2023-5678 Référence CVE CVE-2023-6129 https://www.cve.org/CVERecord?id=CVE-2023-6129 Référence CVE CVE-2023-6237 https://www.cve.org/CVERecord?id=CVE-2023-6237 Référence CVE CVE-2023-6597 https://www.cve.org/CVERecord?id=CVE-2023-6597 Référence CVE CVE-2024-0397 https://www.cve.org/CVERecord?id=CVE-2024-0397 Référence CVE CVE-2024-0450 https://www.cve.org/CVERecord?id=CVE-2024-0450

Official advisory

CERT-FR · French · CERTFR-2025-AVI-0969Multiples vulnérabilités dans les produits VMware

ecord?id=CVE-2023-46219 Référence CVE CVE-2023-46246 https://www.cve.org/CVERecord?id=CVE-2023-46246 Référence CVE CVE-2023-4641 https://www.cve.org/CVERecord?id=CVE-2023-4641 Référence CVE CVE-2023-47038 https://www.cve.org/CVERecord?id=CVE-2023-47038 Référence CVE CVE-2023-47039 https://www.cve.org/CVERecord?id=CVE-2023-47039 Référence CVE CVE-2023-47169 https://www.cve.org/CVERecord?id=CVE-2023-47169 Référence CVE CVE-2023-47282 https://www.cve.org/CVERecord?id=CVE-2023-47282 Référence CVE CVE-2023-47471 https://www.cve.org/CVERecord?id=CVE-2023-47471 Référence CVE CVE-2023-4806 https://www.cve.org/CVERecord?id=CVE-2023-4806 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-4813 https://www.cve.org/CVERecord?id=CVE-2023-4813 Référence CVE CVE-2023-48231 https://www.cve.org/CVERecord?id=CVE-2023-48231 Référence CVE CVE-2023-48232 https://www.cve.org/CVERecord?id=CVE-2023-48232 Référence CVE CVE-2023-48233 https://www.cve.org/CVERecord?id=CVE-2023-48233 Référence CVE CVE-2023-48234 https://www.cve.org/CVERecord?id=CVE-2023-48234 Référence CVE CVE-2023-48235 https://www.cve.org/CVERecord?id=CVE-2023-48235 Référence CVE CVE-2023-48236 https://www.cve.org/CVERecord?id=CVE-2023-48236 Référence CVE CVE-2023-48237 https://www.cve.org/CVERecord?id=CVE

Official advisory

CERT-FR · French · CERTFR-2025-AVI-0967Multiples vulnérabilités dans les produits VMware

d?id=CVE-2023-30584 Référence CVE CVE-2023-36632 https://www.cve.org/CVERecord?id=CVE-2023-36632 Référence CVE CVE-2023-38552 https://www.cve.org/CVERecord?id=CVE-2023-38552 Référence CVE CVE-2023-39331 https://www.cve.org/CVERecord?id=CVE-2023-39331 Référence CVE CVE-2023-39332 https://www.cve.org/CVERecord?id=CVE-2023-39332 Référence CVE CVE-2023-39333 https://www.cve.org/CVERecord?id=CVE-2023-39333 Référence CVE CVE-2023-40217 https://www.cve.org/CVERecord?id=CVE-2023-40217 Référence CVE CVE-2023-44487 https://www.cve.org/CVERecord?id=CVE-2023-44487 Référence CVE CVE-2023-46809 https://www.cve.org/CVERecord?id=CVE-2023-46809 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-52969 https://www.cve.org/CVERecord?id=CVE-2023-52969 Référence CVE CVE-2023-52970 https://www.cve.org/CVERecord?id=CVE-2023-52970 Référence CVE CVE-2023-5752 https://www.cve.org/CVERecord?id=CVE-2023-5752 Référence CVE CVE-2023-6597 https://www.cve.org/CVERecord?id=CVE-2023-6597 Référence CVE CVE-2024-0397 https://www.cve.org/CVERecord?id=CVE-2024-0397 Référence CVE CVE-2024-0450 https://www.cve.org/CVERecord?id=CVE-2024-0450 Référence CVE CVE-2024-11168 https://www.cve.org/CVERecord?id=CVE-2024-11168 Référence CVE CVE-2024-12254 https://www.cve.org/CVERecord?id=CVE-2024-

Official advisory

CERT-FR · French · CERTFR-2025-AVI-0864Multiples vulnérabilités dans VMware Tanzu

ecord?id=CVE-2023-45285 Référence CVE CVE-2023-45288 https://www.cve.org/CVERecord?id=CVE-2023-45288 Référence CVE CVE-2023-45289 https://www.cve.org/CVERecord?id=CVE-2023-45289 Référence CVE CVE-2023-45290 https://www.cve.org/CVERecord?id=CVE-2023-45290 Référence CVE CVE-2023-45918 https://www.cve.org/CVERecord?id=CVE-2023-45918 Référence CVE CVE-2023-46218 https://www.cve.org/CVERecord?id=CVE-2023-46218 Référence CVE CVE-2023-4641 https://www.cve.org/CVERecord?id=CVE-2023-4641 Référence CVE CVE-2023-47038 https://www.cve.org/CVERecord?id=CVE-2023-47038 Référence CVE CVE-2023-4806 https://www.cve.org/CVERecord?id=CVE-2023-4806 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-4813 https://www.cve.org/CVERecord?id=CVE-2023-4813 Référence CVE CVE-2023-48795 https://www.cve.org/CVERecord?id=CVE-2023-48795 Référence CVE CVE-2023-5156 https://www.cve.org/CVERecord?id=CVE-2023-5156 Référence CVE CVE-2023-5363 https://www.cve.org/CVERecord?id=CVE-2023-5363 Référence CVE CVE-2023-5678 https://www.cve.org/CVERecord?id=CVE-2023-5678 Référence CVE CVE-2023-5981 https://www.cve.org/CVERecord?id=CVE-2023-5981 Référence CVE CVE-2023-6004 https://www.cve.org/CVERecord?id=CVE-2023-6004 Référence CVE CVE-2023-6129 https://www.cve.org/CVERecord?id=CVE-2023-6129

Official advisory

CERT-FR · French · CERTFR-2025-AVI-0756Multiples vulnérabilités dans les produits VMware

ecord?id=CVE-2023-45853 Référence CVE CVE-2023-46129 https://www.cve.org/CVERecord?id=CVE-2023-46129 Référence CVE CVE-2023-46218 https://www.cve.org/CVERecord?id=CVE-2023-46218 Référence CVE CVE-2023-46219 https://www.cve.org/CVERecord?id=CVE-2023-46219 Référence CVE CVE-2023-4641 https://www.cve.org/CVERecord?id=CVE-2023-4641 Référence CVE CVE-2023-47038 https://www.cve.org/CVERecord?id=CVE-2023-47038 Référence CVE CVE-2023-47039 https://www.cve.org/CVERecord?id=CVE-2023-47039 Référence CVE CVE-2023-47100 https://www.cve.org/CVERecord?id=CVE-2023-47100 Référence CVE CVE-2023-4806 https://www.cve.org/CVERecord?id=CVE-2023-4806 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-4813 https://www.cve.org/CVERecord?id=CVE-2023-4813 Référence CVE CVE-2023-48795 https://www.cve.org/CVERecord?id=CVE-2023-48795 Référence CVE CVE-2023-4911 https://www.cve.org/CVERecord?id=CVE-2023-4911 Référence CVE CVE-2023-51074 https://www.cve.org/CVERecord?id=CVE-2023-51074 Référence CVE CVE-2023-5156 https://www.cve.org/CVERecord?id=CVE-2023-5156 Référence CVE CVE-2023-5189 https://www.cve.org/CVERecord?id=CVE-2023-5189 Référence CVE CVE-2023-52572 https://www.cve.org/CVERecord?id=CVE-2023-52572 Référence CVE CVE-2023-52757 https://www.cve.org/CVERecord?id=CVE-2023-

Official advisory

CERT-FR · French · CERTFR-2025-AVI-0622Multiples vulnérabilités dans les produits VMware

d?id=CVE-2023-45283 Référence CVE CVE-2023-45284 https://www.cve.org/CVERecord?id=CVE-2023-45284 Référence CVE CVE-2023-45285 https://www.cve.org/CVERecord?id=CVE-2023-45285 Référence CVE CVE-2023-45287 https://www.cve.org/CVERecord?id=CVE-2023-45287 Référence CVE CVE-2023-45288 https://www.cve.org/CVERecord?id=CVE-2023-45288 Référence CVE CVE-2023-45289 https://www.cve.org/CVERecord?id=CVE-2023-45289 Référence CVE CVE-2023-45290 https://www.cve.org/CVERecord?id=CVE-2023-45290 Référence CVE CVE-2023-46218 https://www.cve.org/CVERecord?id=CVE-2023-46218 Référence CVE CVE-2023-46737 https://www.cve.org/CVERecord?id=CVE-2023-46737 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-48795 https://www.cve.org/CVERecord?id=CVE-2023-48795 Référence CVE CVE-2023-53034 https://www.cve.org/CVERecord?id=CVE-2023-53034 Référence CVE CVE-2023-5363 https://www.cve.org/CVERecord?id=CVE-2023-5363 Référence CVE CVE-2023-5678 https://www.cve.org/CVERecord?id=CVE-2023-5678 Référence CVE CVE-2023-6129 https://www.cve.org/CVERecord?id=CVE-2023-6129 Référence CVE CVE-2023-6237 https://www.cve.org/CVERecord?id=CVE-2023-6237 Référence CVE CVE-2023-6378 https://www.cve.org/CVERecord?id=CVE-2023-6378 Référence CVE CVE-2023-6597 https://www.cve.org/CVERecord?id=CVE-2023-659

Official advisory

CERT-FR · French · CERTFR-2025-AVI-0524Multiples vulnérabilités dans VMware Tanzu

ecord?id=CVE-2023-44487 Référence CVE CVE-2023-45285 https://www.cve.org/CVERecord?id=CVE-2023-45285 Référence CVE CVE-2023-45287 https://www.cve.org/CVERecord?id=CVE-2023-45287 Référence CVE CVE-2023-45288 https://www.cve.org/CVERecord?id=CVE-2023-45288 Référence CVE CVE-2023-45289 https://www.cve.org/CVERecord?id=CVE-2023-45289 Référence CVE CVE-2023-45290 https://www.cve.org/CVERecord?id=CVE-2023-45290 Référence CVE CVE-2023-45853 https://www.cve.org/CVERecord?id=CVE-2023-45853 Référence CVE CVE-2023-4641 https://www.cve.org/CVERecord?id=CVE-2023-4641 Référence CVE CVE-2023-4752 https://www.cve.org/CVERecord?id=CVE-2023-4752 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-48161 https://www.cve.org/CVERecord?id=CVE-2023-48161 Référence CVE CVE-2023-51792 https://www.cve.org/CVERecord?id=CVE-2023-51792 Référence CVE CVE-2023-5363 https://www.cve.org/CVERecord?id=CVE-2023-5363 Référence CVE CVE-2023-5678 https://www.cve.org/CVERecord?id=CVE-2023-5678 Référence CVE CVE-2023-5752 https://www.cve.org/CVERecord?id=CVE-2023-5752 Référence CVE CVE-2023-5870 https://www.cve.org/CVERecord?id=CVE-2023-5870 Référence CVE CVE-2023-6129 https://www.cve.org/CVERecord?id=CVE-2023-6129 Référence CVE CVE-2023-6228 https://www.cve.org/CVERecord?id=CVE-2023-622

Official advisory

CERT-FR · French · CERTFR-2025-AVI-0309Multiples vulnérabilités dans les produits IBM

CVERecord?id=CVE-2023-23934 Référence CVE CVE-2023-25577 https://www.cve.org/CVERecord?id=CVE-2023-25577 Référence CVE CVE-2023-2650 https://www.cve.org/CVERecord?id=CVE-2023-2650 Référence CVE CVE-2023-3446 https://www.cve.org/CVERecord?id=CVE-2023-3446 Référence CVE CVE-2023-38325 https://www.cve.org/CVERecord?id=CVE-2023-38325 Référence CVE CVE-2023-3961 https://www.cve.org/CVERecord?id=CVE-2023-3961 Référence CVE CVE-2023-4091 https://www.cve.org/CVERecord?id=CVE-2023-4091 Référence CVE CVE-2023-42669 https://www.cve.org/CVERecord?id=CVE-2023-42669 Référence CVE CVE-2023-46136 https://www.cve.org/CVERecord?id=CVE-2023-46136 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-49083 https://www.cve.org/CVERecord?id=CVE-2023-49083 Référence CVE CVE-2023-50782 https://www.cve.org/CVERecord?id=CVE-2023-50782 Référence CVE CVE-2023-52434 https://www.cve.org/CVERecord?id=CVE-2023-52434 Référence CVE CVE-2023-52439 https://www.cve.org/CVERecord?id=CVE-2023-52439 Référence CVE CVE-2023-52448 https://www.cve.org/CVERecord?id=CVE-2023-52448 Référence CVE CVE-2023-52458 https://www.cve.org/CVERecord?id=CVE-2023-52458 Référence CVE CVE-2023-52466 https://www.cve.org/CVERecord?id=CVE-2023-52466 Référence CVE CVE-2023-52475 https://www.cve.org/CVERecord?id=C

Official advisory

CERT-FR · French · CERTFR-2025-AVI-0214Multiples vulnérabilités dans les produits IBM

ord?id=CVE-2023-24329 Référence CVE CVE-2023-27043 https://www.cve.org/CVERecord?id=CVE-2023-27043 Référence CVE CVE-2023-2976 https://www.cve.org/CVERecord?id=CVE-2023-2976 Référence CVE CVE-2023-32573 https://www.cve.org/CVERecord?id=CVE-2023-32573 Référence CVE CVE-2023-32762 https://www.cve.org/CVERecord?id=CVE-2023-32762 Référence CVE CVE-2023-32763 https://www.cve.org/CVERecord?id=CVE-2023-32763 Référence CVE CVE-2023-36632 https://www.cve.org/CVERecord?id=CVE-2023-36632 Référence CVE CVE-2023-40217 https://www.cve.org/CVERecord?id=CVE-2023-40217 Référence CVE CVE-2023-46234 https://www.cve.org/CVERecord?id=CVE-2023-46234 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-48795 https://www.cve.org/CVERecord?id=CVE-2023-48795 Référence CVE CVE-2023-7104 https://www.cve.org/CVERecord?id=CVE-2023-7104 Référence CVE CVE-2024-0690 https://www.cve.org/CVERecord?id=CVE-2024-0690 Référence CVE CVE-2024-11187 https://www.cve.org/CVERecord?id=CVE-2024-11187 Référence CVE CVE-2024-21634 https://www.cve.org/CVERecord?id=CVE-2024-21634 Référence CVE CVE-2024-27268 https://www.cve.org/CVERecord?id=CVE-2024-27268 Référence CVE CVE-2024-27306 https://www.cve.org/CVERecord?id=CVE-2024-27306 Référence CVE CVE-2024-45296 https://www.cve.org/CVERecord?id=CVE-2

Official advisory

CERT-FR · French · CERTFR-2025-AVI-0045Multiples vulnérabilités dans les produits IBM

e et une atteinte à la confidentialité des données. Solutions Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation). Documentation Bulletin de sécurité IBM 7180725 du 10 janvier 2025 https://www.ibm.com/support/pages/node/7180725 Bulletin de sécurité IBM 7180894 du 13 janvier 2025 https://www.ibm.com/support/pages/node/7180894 Bulletin de sécurité IBM 7180895 du 13 janvier 2025 https://www.ibm.com/support/pages/node/7180895 Référence CVE CVE-2023-22067 https://www.cve.org/CVERecord?id=CVE-2023-22067 Référence CVE CVE-2023-22081 https://www.cve.org/CVERecord?id=CVE-2023-22081 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-5676 https://www.cve.org/CVERecord?id=CVE-2023-5676 Référence CVE CVE-2024-20918 https://www.cve.org/CVERecord?id=CVE-2024-20918 Référence CVE CVE-2024-20921 https://www.cve.org/CVERecord?id=CVE-2024-20921 Référence CVE CVE-2024-20926 https://www.cve.org/CVERecord?id=CVE-2024-20926 Référence CVE CVE-2024-20932 https://www.cve.org/CVERecord?id=CVE-2024-20932 Référence CVE CVE-2024-20945 https://www.cve.org/CVERecord?id=CVE-2024-20945 Référence CVE CVE-2024-20952 https://www.cve.org/CVERecord?id=CVE-2024-20952 Référence CVE CVE-2024-21536 https://www.cve.org/CVERecord?id=CVE

Official advisory

CERT-FR · French · CERTFR-2024-AVI-1103Multiples vulnérabilités dans les produits IBM

ERecord?id=CVE-2023-38289 Référence CVE CVE-2023-38325 https://www.cve.org/CVERecord?id=CVE-2023-38325 Référence CVE CVE-2023-40217 https://www.cve.org/CVERecord?id=CVE-2023-40217 Référence CVE CVE-2023-40745 https://www.cve.org/CVERecord?id=CVE-2023-40745 Référence CVE CVE-2023-41175 https://www.cve.org/CVERecord?id=CVE-2023-41175 Référence CVE CVE-2023-41334 https://www.cve.org/CVERecord?id=CVE-2023-41334 Référence CVE CVE-2023-4421 https://www.cve.org/CVERecord?id=CVE-2023-4421 Référence CVE CVE-2023-4759 https://www.cve.org/CVERecord?id=CVE-2023-4759 Référence CVE CVE-2023-4806 https://www.cve.org/CVERecord?id=CVE-2023-4806 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-4813 https://www.cve.org/CVERecord?id=CVE-2023-4813 Référence CVE CVE-2023-49083 https://www.cve.org/CVERecord?id=CVE-2023-49083 Référence CVE CVE-2023-50291 https://www.cve.org/CVERecord?id=CVE-2023-50291 Référence CVE CVE-2023-50292 https://www.cve.org/CVERecord?id=CVE-2023-50292 Référence CVE CVE-2023-50298 https://www.cve.org/CVERecord?id=CVE-2023-50298 Référence CVE CVE-2023-50386 https://www.cve.org/CVERecord?id=CVE-2023-50386 Référence CVE CVE-2023-50447 https://www.cve.org/CVERecord?id=CVE-2023-50447 Référence CVE CVE-2023-50495 https://www.cve.org/CVERecord?id=CVE

Official advisory

CERT-FR · French · CERTFR-2024-AVI-0958Multiples vulnérabilités dans les produits IBM

ecord?id=CVE-2023-38546 Référence CVE CVE-2023-39325 https://www.cve.org/CVERecord?id=CVE-2023-39325 Référence CVE CVE-2023-42465 https://www.cve.org/CVERecord?id=CVE-2023-42465 Référence CVE CVE-2023-44487 https://www.cve.org/CVERecord?id=CVE-2023-44487 Référence CVE CVE-2023-45284 https://www.cve.org/CVERecord?id=CVE-2023-45284 Référence CVE CVE-2023-45288 https://www.cve.org/CVERecord?id=CVE-2023-45288 Référence CVE CVE-2023-46218 https://www.cve.org/CVERecord?id=CVE-2023-46218 Référence CVE CVE-2023-4692 https://www.cve.org/CVERecord?id=CVE-2023-4692 Référence CVE CVE-2023-4693 https://www.cve.org/CVERecord?id=CVE-2023-4693 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-48161 https://www.cve.org/CVERecord?id=CVE-2023-48161 Référence CVE CVE-2023-48795 https://www.cve.org/CVERecord?id=CVE-2023-48795 Référence CVE CVE-2023-49083 https://www.cve.org/CVERecord?id=CVE-2023-49083 Référence CVE CVE-2023-50314 https://www.cve.org/CVERecord?id=CVE-2023-50314 Référence CVE CVE-2023-50782 https://www.cve.org/CVERecord?id=CVE-2023-50782 Référence CVE CVE-2023-5115 https://www.cve.org/CVERecord?id=CVE-2023-5115 Référence CVE CVE-2023-52425 https://www.cve.org/CVERecord?id=CVE-2023-52425 Référence CVE CVE-2023-52451 https://www.cve.org/CVERecord?id=CVE

Official advisory

CERT-FR · French · CERTFR-2024-AVI-0885Multiples vulnérabilités dans Oracle PeopleSoft

De multiples vulnérabilités ont été découvertes dans Oracle PeopleSoft. Elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Official advisory

CERT-FR · French · CERTFR-2024-AVI-0781Multiples vulnérabilités dans les produits Juniper Networks

CVERecord?id=CVE-2023-28840 Référence CVE CVE-2023-28841 https://www.cve.org/CVERecord?id=CVE-2023-28841 Référence CVE CVE-2023-28842 https://www.cve.org/CVERecord?id=CVE-2023-28842 Référence CVE CVE-2023-2975 https://www.cve.org/CVERecord?id=CVE-2023-2975 Référence CVE CVE-2023-32732 https://www.cve.org/CVERecord?id=CVE-2023-32732 Référence CVE CVE-2023-33953 https://www.cve.org/CVERecord?id=CVE-2023-33953 Référence CVE CVE-2023-3446 https://www.cve.org/CVERecord?id=CVE-2023-3446 Référence CVE CVE-2023-3817 https://www.cve.org/CVERecord?id=CVE-2023-3817 Référence CVE CVE-2023-4785 https://www.cve.org/CVERecord?id=CVE-2023-4785 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-5043 https://www.cve.org/CVERecord?id=CVE-2023-5043 Référence CVE CVE-2023-5363 https://www.cve.org/CVERecord?id=CVE-2023-5363 Référence CVE CVE-2024-21605 https://www.cve.org/CVERecord?id=CVE-2024-21605 Référence CVE CVE-2024-21609 https://www.cve.org/CVERecord?id=CVE-2024-21609 Référence CVE CVE-2024-21615 https://www.cve.org/CVERecord?id=CVE-2024-21615 Référence CVE CVE-2024-21618 https://www.cve.org/CVERecord?id=CVE-2024-21618 Référence CVE CVE-2024-39512 https://www.cve.org/CVERecord?id=CVE-2024-39512 Référence CVE CVE-2024-39517 https://www.cve.org/CVERecord?id=CVE-2

Official advisory

CERT-FR · French · CERTFR-2024-AVI-0692Multiples vulnérabilités dans les produits IBM

d?id=CVE-2023-30447 Référence CVE CVE-2023-30448 https://www.cve.org/CVERecord?id=CVE-2023-30448 Référence CVE CVE-2023-30449 https://www.cve.org/CVERecord?id=CVE-2023-30449 Référence CVE CVE-2023-31130 https://www.cve.org/CVERecord?id=CVE-2023-31130 Référence CVE CVE-2023-32067 https://www.cve.org/CVERecord?id=CVE-2023-32067 Référence CVE CVE-2023-35012 https://www.cve.org/CVERecord?id=CVE-2023-35012 Référence CVE CVE-2023-42282 https://www.cve.org/CVERecord?id=CVE-2023-42282 Référence CVE CVE-2023-45803 https://www.cve.org/CVERecord?id=CVE-2023-45803 Référence CVE CVE-2023-46809 https://www.cve.org/CVERecord?id=CVE-2023-46809 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-5676 https://www.cve.org/CVERecord?id=CVE-2023-5676 Référence CVE CVE-2023-6597 https://www.cve.org/CVERecord?id=CVE-2023-6597 Référence CVE CVE-2024-20918 https://www.cve.org/CVERecord?id=CVE-2024-20918 Référence CVE CVE-2024-20921 https://www.cve.org/CVERecord?id=CVE-2024-20921 Référence CVE CVE-2024-20926 https://www.cve.org/CVERecord?id=CVE-2024-20926 Référence CVE CVE-2024-20932 https://www.cve.org/CVERecord?id=CVE-2024-20932 Référence CVE CVE-2024-20945 https://www.cve.org/CVERecord?id=CVE-2024-20945 Référence CVE CVE-2024-20952 https://www.cve.org/CVERecord?id=CVE-2

Official advisory

CERT-FR · French · CERTFR-2024-AVI-0538Multiples vulnérabilités dans Tenable Identity Exposure

enable.com/security/tns-2024-11 Référence CVE CVE-2023-0464 https://www.cve.org/CVERecord?id=CVE-2023-0464 Référence CVE CVE-2023-0465 https://www.cve.org/CVERecord?id=CVE-2023-0465 Référence CVE CVE-2023-0466 https://www.cve.org/CVERecord?id=CVE-2023-0466 Référence CVE CVE-2023-2650 https://www.cve.org/CVERecord?id=CVE-2023-2650 Référence CVE CVE-2023-3446 https://www.cve.org/CVERecord?id=CVE-2023-3446 Référence CVE CVE-2023-3817 https://www.cve.org/CVERecord?id=CVE-2023-3817 Référence CVE CVE-2023-46218 https://www.cve.org/CVERecord?id=CVE-2023-46218 Référence CVE CVE-2023-46219 https://www.cve.org/CVERecord?id=CVE-2023-46219 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-5678 https://www.cve.org/CVERecord?id=CVE-2023-5678 Référence CVE CVE-2024-0727 https://www.cve.org/CVERecord?id=CVE-2024-0727 Référence CVE CVE-2024-2004 https://www.cve.org/CVERecord?id=CVE-2024-2004 Référence CVE CVE-2024-21892 https://www.cve.org/CVERecord?id=CVE-2024-21892 Référence CVE CVE-2024-22017 https://www.cve.org/CVERecord?id=CVE-2024-22017 Référence CVE CVE-2024-22025 https://www.cve.org/CVERecord?id=CVE-2024-22025 Référence CVE CVE-2024-2398 https://www.cve.org/CVERecord?id=CVE-2024-2398 Référence CVE CVE-2024-27983 https://www.cve.org/CVERecord?id=CVE-2024-

Official advisory

CERT-FR · French · CERTFR-2024-AVI-0385Multiples vulnérabilités dans les produits IBM

ERecord?id=CVE-2023-44794 Référence CVE CVE-2023-45803 https://www.cve.org/CVERecord?id=CVE-2023-45803 Référence CVE CVE-2023-45862 https://www.cve.org/CVERecord?id=CVE-2023-45862 Référence CVE CVE-2023-45871 https://www.cve.org/CVERecord?id=CVE-2023-45871 Référence CVE CVE-2023-46218 https://www.cve.org/CVERecord?id=CVE-2023-46218 Référence CVE CVE-2023-4622 https://www.cve.org/CVERecord?id=CVE-2023-4622 Référence CVE CVE-2023-4623 https://www.cve.org/CVERecord?id=CVE-2023-4623 Référence CVE CVE-2023-46813 https://www.cve.org/CVERecord?id=CVE-2023-46813 Référence CVE CVE-2023-4732 https://www.cve.org/CVERecord?id=CVE-2023-4732 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-4921 https://www.cve.org/CVERecord?id=CVE-2023-4921 Référence CVE CVE-2023-50387 https://www.cve.org/CVERecord?id=CVE-2023-50387 Référence CVE CVE-2023-5072 https://www.cve.org/CVERecord?id=CVE-2023-5072 Référence CVE CVE-2023-50782 https://www.cve.org/CVERecord?id=CVE-2023-50782 Référence CVE CVE-2023-50868 https://www.cve.org/CVERecord?id=CVE-2023-50868 Référence CVE CVE-2023-51042 https://www.cve.org/CVERecord?id=CVE-2023-51042 Référence CVE CVE-2023-51043 https://www.cve.org/CVERecord?id=CVE-2023-51043 Référence CVE CVE-2023-5178 https://www.cve.org/CVERecord?id=CVE-20

Official advisory

CERT-FR · French · CERTFR-2024-AVI-0325Multiples vulnérabilités dans Oracle PeopleSoft

VERecord?id=CVE-2023-2975 Référence CVE CVE-2023-3446 https://www.cve.org/CVERecord?id=CVE-2023-3446 Référence CVE CVE-2023-38039 https://www.cve.org/CVERecord?id=CVE-2023-38039 Référence CVE CVE-2023-3817 https://www.cve.org/CVERecord?id=CVE-2023-3817 Référence CVE CVE-2023-38545 https://www.cve.org/CVERecord?id=CVE-2023-38545 Référence CVE CVE-2023-38546 https://www.cve.org/CVERecord?id=CVE-2023-38546 Référence CVE CVE-2023-4043 https://www.cve.org/CVERecord?id=CVE-2023-4043 Référence CVE CVE-2023-44483 https://www.cve.org/CVERecord?id=CVE-2023-44483 Référence CVE CVE-2023-46219 https://www.cve.org/CVERecord?id=CVE-2023-46219 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2024-0853 https://www.cve.org/CVERecord?id=CVE-2024-0853 Référence CVE CVE-2024-21063 https://www.cve.org/CVERecord?id=CVE-2024-21063 Référence CVE CVE-2024-21065 https://www.cve.org/CVERecord?id=CVE-2024-21065 Référence CVE CVE-2024-21070 https://www.cve.org/CVERecord?id=CVE-2024-21070 Référence CVE CVE-2024-21097 https://www.cve.org/CVERecord?id=CVE-2024-21097 Gestion détaillée du document le 18 avril 2024 Version initiale Alertes Avis Bulletins d’actualités Mentions légales Conditions générales À propos Contact cyber.gouv.fr service-public.fr legifrance.gouv.fr info.gouv.fr

Official advisory

CERT-FR · French · CERTFR-2024-AVI-0297Multiples vulnérabilités dans Juniper

Record?id=CVE-2023-3978 Référence CVE CVE-2023-39975 https://www.cve.org/CVERecord?id=CVE-2023-39975 Référence CVE CVE-2023-40217 https://www.cve.org/CVERecord?id=CVE-2023-40217 Référence CVE CVE-2023-41913 https://www.cve.org/CVERecord?id=CVE-2023-41913 Référence CVE CVE-2023-43804 https://www.cve.org/CVERecord?id=CVE-2023-43804 Référence CVE CVE-2023-44487 https://www.cve.org/CVERecord?id=CVE-2023-44487 Référence CVE CVE-2023-46218 https://www.cve.org/CVERecord?id=CVE-2023-46218 Référence CVE CVE-2023-4785 https://www.cve.org/CVERecord?id=CVE-2023-4785 Référence CVE CVE-2023-4806 https://www.cve.org/CVERecord?id=CVE-2023-4806 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-48795 https://www.cve.org/CVERecord?id=CVE-2023-48795 Référence CVE CVE-2023-49083 https://www.cve.org/CVERecord?id=CVE-2023-49083 Référence CVE CVE-2023-5156 https://www.cve.org/CVERecord?id=CVE-2023-5156 Référence CVE CVE-2023-5981 https://www.cve.org/CVERecord?id=CVE-2023-5981 Référence CVE CVE-2024-30378 https://www.cve.org/CVERecord?id=CVE-2024-30378 Référence CVE CVE-2024-30380 https://www.cve.org/CVERecord?id=CVE-2024-30380 Référence CVE CVE-2024-30381 https://www.cve.org/CVERecord?id=CVE-2024-30381 Référence CVE CVE-2024-30382 https://www.cve.org/CVERecord?id=CVE-2

Official advisory

CERT-FR · French · CERTFR-2024-AVI-0145Multiples vulnérabilités dans les produits IBM

d?id=CVE-2023-46589 Référence CVE CVE-2023-47141 https://www.cve.org/CVERecord?id=CVE-2023-47141 Référence CVE CVE-2023-47145 https://www.cve.org/CVERecord?id=CVE-2023-47145 Référence CVE CVE-2023-47152 https://www.cve.org/CVERecord?id=CVE-2023-47152 Référence CVE CVE-2023-47158 https://www.cve.org/CVERecord?id=CVE-2023-47158 Référence CVE CVE-2023-47627 https://www.cve.org/CVERecord?id=CVE-2023-47627 Référence CVE CVE-2023-47701 https://www.cve.org/CVERecord?id=CVE-2023-47701 Référence CVE CVE-2023-47746 https://www.cve.org/CVERecord?id=CVE-2023-47746 Référence CVE CVE-2023-47747 https://www.cve.org/CVERecord?id=CVE-2023-47747 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-49081 https://www.cve.org/CVERecord?id=CVE-2023-49081 Référence CVE CVE-2023-49082 https://www.cve.org/CVERecord?id=CVE-2023-49082 Référence CVE CVE-2023-50308 https://www.cve.org/CVERecord?id=CVE-2023-50308 Référence CVE CVE-2023-5363 https://www.cve.org/CVERecord?id=CVE-2023-5363 Référence CVE CVE-2023-5676 https://www.cve.org/CVERecord?id=CVE-2023-5676 Référence CVE CVE-2023-5678 https://www.cve.org/CVERecord?id=CVE-2023-5678 Référence CVE CVE-2023-6129 https://www.cve.org/CVERecord?id=CVE-2023-6129 Référence CVE CVE-2023-6681 https://www.cve.org/CVERecord?id=CVE-2023-6

Official advisory

CERT-FR · French · CERTFR-2024-AVI-0113Multiples vulnérabilités dans les produits IBM

d?id=CVE-2023-34462 Référence CVE CVE-2023-36478 https://www.cve.org/CVERecord?id=CVE-2023-36478 Référence CVE CVE-2023-36479 https://www.cve.org/CVERecord?id=CVE-2023-36479 Référence CVE CVE-2023-40167 https://www.cve.org/CVERecord?id=CVE-2023-40167 Référence CVE CVE-2023-41900 https://www.cve.org/CVERecord?id=CVE-2023-41900 Référence CVE CVE-2023-44487 https://www.cve.org/CVERecord?id=CVE-2023-44487 Référence CVE CVE-2023-46308 https://www.cve.org/CVERecord?id=CVE-2023-46308 Référence CVE CVE-2023-46849 https://www.cve.org/CVERecord?id=CVE-2023-46849 Référence CVE CVE-2023-46850 https://www.cve.org/CVERecord?id=CVE-2023-46850 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-5363 https://www.cve.org/CVERecord?id=CVE-2023-5363 Référence CVE CVE-2023-5676 https://www.cve.org/CVERecord?id=CVE-2023-5676 Gestion détaillée du document le 09 février 2024 Version initiale Alertes Avis Bulletins d’actualités Mentions légales Conditions générales À propos Contact cyber.gouv.fr service-public.fr legifrance.gouv.fr info.gouv.fr france.fr info.gouv.fr/risques Premier Ministre / Secrétariat Général de la Défense et de la Sécurité Nationale / Agence nationale de la sécurité des systèmes d'information

Official advisory

CERT-FR · French · CERTFR-2023-AVI-1015Multiples vulnérabilités dans les produits Siemens

ecord?id=CVE-2023-45871 Référence CVE CVE-2023-46156 https://www.cve.org/CVERecord?id=CVE-2023-46156 Référence CVE CVE-2023-4623 https://www.cve.org/CVERecord?id=CVE-2023-4623 Référence CVE CVE-2023-46281 https://www.cve.org/CVERecord?id=CVE-2023-46281 Référence CVE CVE-2023-46282 https://www.cve.org/CVERecord?id=CVE-2023-46282 Référence CVE CVE-2023-46283 https://www.cve.org/CVERecord?id=CVE-2023-46283 Référence CVE CVE-2023-46284 https://www.cve.org/CVERecord?id=CVE-2023-46284 Référence CVE CVE-2023-46285 https://www.cve.org/CVERecord?id=CVE-2023-46285 Référence CVE CVE-2023-4806 https://www.cve.org/CVERecord?id=CVE-2023-4806 Référence CVE CVE-2023-4807 https://www.cve.org/CVERecord?id=CVE-2023-4807 Référence CVE CVE-2023-4813 https://www.cve.org/CVERecord?id=CVE-2023-4813 Référence CVE CVE-2023-48427 https://www.cve.org/CVERecord?id=CVE-2023-48427 Référence CVE CVE-2023-48428 https://www.cve.org/CVERecord?id=CVE-2023-48428 Référence CVE CVE-2023-48429 https://www.cve.org/CVERecord?id=CVE-2023-48429 Référence CVE CVE-2023-48430 https://www.cve.org/CVERecord?id=CVE-2023-48430 Référence CVE CVE-2023-48431 https://www.cve.org/CVERecord?id=CVE-2023-48431 Référence CVE CVE-2023-4911 https://www.cve.org/CVERecord?id=CVE-2023-4911 Référence CVE CVE-2023-4921 https://www.cve.org/CVERecord?id=CVE-20

Official advisory

CERT-FR · French · CERTFR-2023-AVI-0904Multiples vulnérabilités dans les produits Tenable

De multiples vulnérabilités ont été découvertes dans les produits Tenable. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, un déni de service à distance et un contournement de la politique de sécurité.

Official advisory

CERT-FR · French · CERTFR-2023-AVI-0889Multiples vulnérabilités dans les produits Tenable

De multiples vulnérabilités ont été découvertes dans les produits Tenable . Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

Official advisory

NCSC-NL · Dutch · NCSC-2025-0106Kwetsbaarheden verholpen in Siemens producten

De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade: - Denial-of-Service (DoS) - Manipulatie van gegevens - Omzeilen van een beveiligingsmaatregel - Omzeilen van authenticatie - (Remote) code execution (root/admin rechten) - (Remote) code execution (Gebruikersrechten) - Toegang tot systeemgegevens - Toegang tot gevoelige gegevens - Spoofing De kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.

Official advisory

NCSC-NL · Dutch · NCSC-2024-0433Kwetsbaarheden verholpen in Siemens producten

De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade: - Denial-of-Service (DoS) - Cross-Site-Scripting (XSS) - Manipulatie van gegevens - Omzeilen van een beveiligingsmaatregel - Omzeilen van authenticatie - (Remote) code execution (Administrator/Root rechten) - (Remote) code execution (Gebruikersrechten) - Toegang tot systeemgegevens - Verhoogde gebruikersrechten De kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.

Official advisory

03

Patch and workaround

Operational remediation based on structured source evidence.

Status ? Patch availability is based on structured fixed-version fields and authoritative update references. If no fix is verified, check the vendor advisory before making a change.: Patch available
Affected: SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0); SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0); SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0); SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0); SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)
Fixed: An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.
Action: Update to V3.1.5 or later version
Workaround: No verified workaround is recorded. Limit untrusted access and use least privilege until authoritative guidance is available.

04

Evidence and provenance

Published 8 Sept 2023 · Last source change 27 Aug 2025, 20:42 UTC · CWE-440 · Expected Behavior Violation

CVE recordCVE.org · 5.1

CVSS sourceNIST NVD

EPSS source

?

The date BlackTree first stored a score for this CVE from the daily FIRST EPSS feed.

FIRST · tracked since 2026-08-14

European sourceENISA EUVD · EUVD-2023-54651

Product sourceVendor CSAF · Siemens ProductCERT

Remediation sourceVendor CSAF · Siemens ProductCERT

CWE sourceCNA

NVD statusNVD modified after enrichment

Core structured fields are present and their contributing authorities are shown above.

Material change intelligence

What changed after publication

View recent updates →

No material field changes have been recorded since change tracking began. Routine source refreshes and cosmetic edits are intentionally excluded.

2023-09-08CVE published

2025-08-27Fixed release or patch reference recorded

ENISA EUVD · EUVD-2023-54651↗Vendor CSAF · Siemens ProductCERT↗CVE authority or vendor reference↗Patch or update reference↗Patch or update reference↗Patch or update reference↗Official CVE record (CNA and ADP data)↗NVD record↗

Technical terms and abbreviations used in this report

CVE: Common Vulnerabilities and Exposures: the public identifier for one disclosed vulnerability.
CVSS: Common Vulnerability Scoring System: a technical severity framework; it is not patching priority by itself.
EPSS: Exploit Prediction Scoring System: FIRST's estimate of the probability that exploitation activity will be observed in the next 30 days; it is a forecast, not confirmation.
CWE: Common Weakness Enumeration: the standard category describing the underlying software or hardware weakness.
CNA: CVE Numbering Authority: an organisation authorised to assign and publish CVE records.
CISA ADP: Cybersecurity and Infrastructure Security Agency Authorized Data Publisher: structured enrichment added to a CVE record.
NVD: National Vulnerability Database: NIST's enrichment service for CVE records.
CERT / CSIRT: A computer security incident response team that publishes warnings or coordinates incident response.
PoC: Proof of concept: public material that demonstrates or helps reproduce exploitation.
CSAF: Common Security Advisory Framework: a machine-readable format for security advisories.
LoTL: Living off the land: abuse of legitimate tools or system functions during an attack.