Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-5077 State: PUBLISHED Published: 2023-09-28T23:24:28.643Z Last Updated: 2024-09-26T21:57:22.469Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: HashiCorp Products: Vault, Vault Enterprise Problem Types: CWE-266 Description: The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2023-30-vault-s-google-cloud-secrets-engine-removed-existing-iam-conditions-when-creating-updating-rolesets/58654
CVE ID: CVE-2023-5078 State: PUBLISHED Published: 2023-11-08T22:02:49.076Z Last Updated: 2024-09-16T14:52:18.065Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: ThinkPad BIOS Problem Types: CWE-1419 Description: A vulnerability was reported in some ThinkPad BIOS that could allow a physical or local attacker with elevated privileges to tamper with BIOS firmware. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-141775
CVE ID: CVE-2023-5079 State: PUBLISHED Published: 2023-11-08T22:03:43.746Z Last Updated: 2024-09-03T20:05:51.770Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Lenovo Products: LeCloud Application Problem Types: CWE-20 Description: Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/418253?
CVE ID: CVE-2023-5080 State: PUBLISHED Published: 2024-01-19T20:06:30.375Z Last Updated: 2025-06-17T21:19:23.987Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: Lenovo Products: Tablet Problem Types: CWE-266 Description: A privilege escalation vulnerability was reported in some Lenovo tablet products that could allow local applications access to device identifiers and system commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-142135
CVE ID: CVE-2023-5081 State: PUBLISHED Published: 2024-01-19T20:07:36.051Z Last Updated: 2025-05-30T14:25:34.902Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Lenovo Products: Tablet Problem Types: CWE-497 Description: An information disclosure vulnerability was reported in the Lenovo Tab M8 HD that could allow a local application to gather a non-resettable device identifier. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-142135
CVE ID: CVE-2023-5082 State: PUBLISHED Published: 2023-11-06T20:40:37.134Z Last Updated: 2025-02-26T21:19:03.513Z Vendors: Unknown Products: History Log by click5 Problem Types: CWE-89 SQL Injection Description: The History Log by click5 WordPress plugin before 1.0.13 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when using the Smash Balloon Social Photo Feed plugin alongside it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/13a196ba-49c7-4575-9a49-3ef9eb2348f3
CVE ID: CVE-2023-5084 State: PUBLISHED Published: 2023-09-20T09:49:59.437Z Last Updated: 2024-12-03T14:43:54.559Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: hestiacp Products: hestiacp/hestiacp Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.8.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/f3340570-6e59-4c72-a7d1-d4b829b4fb45 - https://github.com/hestiacp/hestiacp/pull/4013/commits/5131f5a966759df77477fdf7f29daa2bda93b1ff
CVE ID: CVE-2023-5085 State: PUBLISHED Published: 2023-10-24T13:52:59.223Z Last Updated: 2025-02-05T18:58:52.739Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: johnnypea Products: Advanced Menu Widget Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Advanced Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'advMenu' shortcode in versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to i
upplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5da2dac6-940c-419e-853f-6cfd5d53d427?source=cve - https://plugins.trac.wordpress.org/browser/advanced-menu-widget/trunk/class-advanced-menu-widget.php?rev=1471917#L74
CVE ID: CVE-2023-5086 State: PUBLISHED Published: 2023-10-20T07:29:37.430Z Last Updated: 2025-02-05T19:03:17.336Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mahesh901122 Products: Copy Anything to Clipboard Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Copy Anything to Clipboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'copy' shortcode in versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above perm
ng on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e834a211-ccc8-4a30-a15d-879ba34184e9?source=cve - https://plugins.trac.wordpress.org/browser/copy-the-code/tags/2.6.4/classes/class-copy-the-code-shortcode.php#L83 - https://plugins.trac.wordpress.org/changeset/2969441/copy-the-code#file1
CVE ID: CVE-2023-5087 State: PUBLISHED Published: 2023-10-16T19:38:57.172Z Last Updated: 2025-04-23T16:14:27.837Z Vendors: Unknown Products: Page Builder: Pagelayer Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Page Builder: Pagelayer WordPress plugin before 1.7.8 doesn't prevent attackers with author privileges and higher from inserting malicious JavaScript inside a post's header or footer code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3b45cc0b-7378-49f3-900e-d0e18cd4b878
CVE ID: CVE-2023-5088 State: PUBLISHED Published: 2023-11-03T13:58:50.085Z Last Updated: 2025-11-06T22:57:21.072Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Advanced Virtualization Problem Types: CWE-821 Description: A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1
ot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:2135 - https://access.redhat.com/errata/RHSA-2024:2962 - https://access.redhat.com/security/cve/CVE-2023-5088 - https://bugzilla.redhat.com/show_bug.cgi?id=2247283 - https://lore.kernel.org/all/20230921160712.99521-1-simon.rowe@nutanix.com/T/
CVE ID: CVE-2023-5089 State: PUBLISHED Published: 2023-10-16T19:39:25.420Z Last Updated: 2025-04-23T16:10:59.957Z Vendors: Unknown Products: Defender Security Problem Types: CWE-209 Generation of Error Message Containing Sensitive Information Description: The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2b547488-187b-44bc-a57d-f876a7d4c87d - https://www
CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2b547488-187b-44bc-a57d-f876a7d4c87d - https://www.sprocketsecurity.com/resources/discovering-wp-admin-urls-in-wordpress-with-gravityforms
CVE ID: CVE-2023-5090 State: PUBLISHED Published: 2023-11-06T10:56:57.062Z Last Updated: 2025-11-08T07:10:11.332Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-755 Description: A flaw was found in KVM. An improper check in svm_set_x2apic_msr_interception() may allow direct access to host x2apic msrs when the guest resets its apic, potentially leading to a denial of service condition. Additional Analyst Notes: - CVE Program Container: References: - https://acce
leading to a denial of service condition. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:2758 - https://access.redhat.com/errata/RHSA-2024:3854 - https://access.redhat.com/errata/RHSA-2024:3855 - https://access.redhat.com/errata/RHSA-2024:4211 - https://access.redhat.com/errata/RHSA-2024:4352 - https://access.redhat.com/security/cve/CVE-2023-5090 - https://bugzilla.redhat.com/show_bug.cgi?id=2248122
CVE ID: CVE-2023-5091 State: PUBLISHED Published: 2024-01-08T09:23:35.019Z Last Updated: 2025-05-22T17:23:43.161Z Vendors: Arm Ltd Products: Valhall GPU Kernel Driver Problem Types: CWE-416 Description: Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper GPU processing operations to gain access to already freed memory. This issue affects Valhall GPU Kernel Driver: from r37p0 through r40p0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE ID: CVE-2023-5096 State: PUBLISHED Published: 2023-11-22T15:33:20.626Z Last Updated: 2024-08-02T07:44:53.886Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jonashjalmarsson Products: HTML filter and csv-file search Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The HTML filter and csv-file search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'csvsearch' shortcode in versions up to, and including, 2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with c
sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/157eddd4-67f0-4a07-b3ab-11dbfb9f12aa?source=cve - https://plugins.trac.wordpress.org/changeset/2985200/hk-filter-and-search
CVE ID: CVE-2023-5097 State: PUBLISHED Published: 2024-01-16T19:40:57.869Z Last Updated: 2025-06-17T21:19:15.018Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: HYPR Products: Workforce Access Problem Types: CWE-22 Description: Improper Input Validation vulnerability in HYPR Workforce Access on Windows allows Path Traversal.This issue affects Workforce Access: before 8.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hypr.com/security-advisories
CVE ID: CVE-2023-5098 State: PUBLISHED Published: 2023-10-31T13:54:44.176Z Last Updated: 2025-04-23T16:10:21.446Z Vendors: Unknown Products: Campaign Monitor Forms by Optin Cat Problem Types: CWE-284 Improper Access Control Description: The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges (like subscribers) from overwriting any options on a site with the string "true", which could lead to a variety of outcomes, including DoS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3167a83c-291e-4372-a42e-d842205ba722
CVE ID: CVE-2023-5099 State: PUBLISHED Published: 2023-10-31T11:29:13.058Z Last Updated: 2025-02-05T18:52:30.173Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: jonashjalmarsson Products: HTML filter and csv-file search Problem Types: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Description: The HTML filter and csv-file search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.7 via the 'src' attribute of the 'csvsearch' shortcode. This allows authenticated attackers, with contributor-level permissions and above, to include and execute arbitrary files
his allows authenticated attackers, with contributor-level permissions and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ee2b4055-8cbd-49b7-bb0b-eddef85060fc?source=cve - https://plugins.trac.wordpress.org/changeset/2985200/hk-filter-and-search
CVE ID: CVE-2023-5100 State: PUBLISHED Published: 2023-10-09T12:05:25.109Z Last Updated: 2024-09-19T14:51:23.339Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: SICK AG Products: APU0200 Problem Types: CWE-319 Description: Cleartext Transmission of Sensitive Information in RDT400 in SICK APU allows an unprivileged remote attacker to retrieve potentially sensitive information via intercepting network traffic that is not encrypted. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf - https://sick.com/.well-known/csaf/white/2023/sca-20
t - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json
CVE ID: CVE-2023-5101 State: PUBLISHED Published: 2023-10-09T12:07:13.545Z Last Updated: 2024-12-09T13:55:57.571Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SICK AG Products: APU0200 Problem Types: CWE-552 Description: Files or Directories Accessible to External Parties in RDT400 in SICK APU allows an unprivileged remote attacker to download various files from the server via HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json
CVE ID: CVE-2023-5102 State: PUBLISHED Published: 2023-10-09T12:09:08.155Z Last Updated: 2024-12-09T13:55:52.981Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SICK AG Products: APU0200 Problem Types: CWE-691 Description: Insufficient Control Flow Management in RDT400 in SICK APU allows an unprivileged remote attacker to potentially enable hidden functionality via HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json
CVE ID: CVE-2023-5103 State: PUBLISHED Published: 2023-10-09T12:11:04.740Z Last Updated: 2024-09-18T20:11:23.226Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: SICK AG Products: APU0200 Problem Types: CWE-1021 Description: Improper Restriction of Rendered UI Layers or Frames in RDT400 in SICK APU allows an unprivileged remote attacker to potentially reveal sensitive information via tricking a user into clicking on an actionable item using an iframe. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf - https://sick.com/.well-known/c
https://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json
CVE ID: CVE-2023-5104 State: PUBLISHED Published: 2023-09-21T08:44:16.801Z Last Updated: 2024-09-24T16:37:13.074Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: nocodb Products: nocodb/nocodb Problem Types: CWE-20 Description: Improper Input Validation in GitHub repository nocodb/nocodb prior to 0.96.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/1b5c6d9f-941e-4dd7-a964-42b53d6826b0 - https://github.com/nocodb/nocodb/commit/db0385cb8aab2a34e233454607f59152ac62b3e2
CVE ID: CVE-2023-5105 State: PUBLISHED Published: 2023-12-04T21:27:46.153Z Last Updated: 2024-08-02T07:44:53.887Z Vendors: Unknown Products: Frontend File Manager Plugin Problem Types: CWE-200 Information Exposure Description: The Frontend File Manager Plugin WordPress plugin before 22.6 has a vulnerability that allows an Editor+ user to bypass the file download logic and download files such as `wp-config.php` Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d40c7108-bad6-4ed3-8539-35c0f57e62cc
CVE ID: CVE-2023-5106 State: PUBLISHED Published: 2023-10-02T11:49:56.333Z Last Updated: 2024-10-05T04:04:21.739Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/commit/67039cfcae80b8fc0496f79be88714873cd169b
SA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/commit/67039cfcae80b8fc0496f79be88714873cd169b3 - https://gitlab.com/gitlab-org/security/gitlab/-/issues/980
CVE ID: CVE-2023-5108 State: PUBLISHED Published: 2023-12-04T21:29:21.316Z Last Updated: 2024-08-02T07:44:53.815Z Vendors: Unknown Products: Easy Newsletter Signups Problem Types: CWE-89 SQL Injection Description: The Easy Newsletter Signups WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1b277929-e88b-4ab6-9190-526e75f5ce7a
CVE ID: CVE-2023-5109 State: PUBLISHED Published: 2023-10-20T07:29:39.362Z Last Updated: 2025-02-05T19:02:56.651Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ironikus Products: WP Mailto Links – Protect Email Addresses Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Mailto Links – Protect Email Addresses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wpml_mailto' shortcode in versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with
ut sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was partially patched in version 3.1.3 and fully patched in version 3.1.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ec882062-0059-47ca-a007-3347e7adb70b?source=cve - https://plugins.trac.wordpress.org/browser/wp-mailto-links/tags/3.1.2/core/includes/classes/class-wp-mailto-links-validate.php#L582
CVE ID: CVE-2023-5110 State: PUBLISHED Published: 2023-10-24T13:52:59.678Z Last Updated: 2025-02-05T18:58:38.687Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bannersky Products: BSK PDF Manager Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bsk-pdfm-category-dropdown' shortcode in versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permiss
on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/60de55c6-e4fa-453e-84bd-309f2887e3cb?source=cve - https://plugins.trac.wordpress.org/browser/bsk-pdf-manager/trunk/classes/shortcodes/category/category-dropdown.php?rev=2885460#L36
CVE ID: CVE-2023-5111 State: PUBLISHED Published: 2023-09-30T22:08:52.218Z Last Updated: 2024-09-20T17:22:03.180Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Os Commerce Products: Os Commerce Problem Types: CWE-79 Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "featured_type_name[1]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/bts/ - https://www.oscommerce.com/