Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-38305 State: PUBLISHED Published: 2023-07-31T00:00:00 Last Updated: 2024-10-22T17:57:31.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Webmin 2.021. The download functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a crafted download path containing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the victim's browser when the download link is accessed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/jaysharma786/Webmin-2.021/
DP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/jaysharma786/Webmin-2.021/blob/main/CVE-2023-38305
CVE ID: CVE-2023-38306 State: PUBLISHED Published: 2023-07-31T00:00:00 Last Updated: 2024-10-22T17:51:13.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Webmin 2.021. A Cross-site Scripting (XSS) Bypass vulnerability was discovered in the file upload functionality. Normally, the application restricts the upload of certain file types such as .svg, .php, etc., and displays an error message if a prohibited file type is detected. However, by following certain steps, an attacker can bypass these restrictions and inject malicious code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/jaysharma786/Webmin-2.021/blob/main/CVE-2023-38306
CVE ID: CVE-2023-38307 State: PUBLISHED Published: 2023-07-31T00:00:00 Last Updated: 2024-10-22T17:50:42.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality. The vulnerability occurs when an authenticated user adds a new user and inserts an XSS payload into the user's real name. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/jaysharma786/Webmin-2.021/blob/main/CVE-2023-38307
CVE ID: CVE-2023-38308 State: PUBLISHED Published: 2023-07-31T00:00:00 Last Updated: 2024-10-22T17:50:05.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Webmin 2.021. A Cross-Site Scripting (XSS) vulnerability was discovered in the HTTP Tunnel functionality when handling third-party domain URLs. By providing a crafted URL from a third-party domain, an attacker can inject malicious code. leading to the execution of arbitrary JavaScript code within the context of the victim's browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/jaysharma786/Web
: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/jaysharma786/Webmin-2.021/blob/main/CVE-2023-38308
CVE ID: CVE-2023-38309 State: PUBLISHED Published: 2023-07-31T00:00:00 Last Updated: 2024-10-22T17:49:35.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Webmin 2.021. A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the package search functionality. The vulnerability allows an attacker to inject a malicious payload in the "Search for Package" field, which gets reflected back in the application's response, leading to the execution of arbitrary JavaScript code within the context of the victim's browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changel
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/jaysharma786/Webmin-2.021/blob/main/CVE-2023-38309
CVE ID: CVE-2023-38310 State: PUBLISHED Published: 2023-07-31T00:00:00 Last Updated: 2024-10-22T17:48:55.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the configuration settings of the system logs functionality. The vulnerability allows an attacker to store an XSS payload in the configuration settings of specific log files. This results in the execution of that payload whenever the affected log files are accessed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/ja
gram Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/jaysharma786/Webmin-2.021/blob/main/CVE-2023-38310
CVE ID: CVE-2023-38311 State: PUBLISHED Published: 2023-07-31T00:00:00 Last Updated: 2024-10-22T17:43:26.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the System Logs Viewer functionality. The vulnerability allows an attacker to store a malicious payload in the configuration field, triggering the execution of the payload when saving the configuration or when accessing the System Logs Viewer page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/jaysharma786/Webmin-
CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/jaysharma786/Webmin-2.021/blob/main/CVE-2023-38311
CVE ID: CVE-2023-38312 State: PUBLISHED Published: 2023-10-15T00:00:00 Last Updated: 2024-09-16T18:58:17.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal vulnerability in Valve Counter-Strike 8684 allows a client (with remote control access to a game server) to read arbitrary files from the underlying server via the motdfile console variable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MikeIsAStar/Counter-Strike-Arbitrary-File-Read
CVE ID: CVE-2023-38313 State: PUBLISHED Published: 2023-11-17T00:00:00 Last Updated: 2024-08-02T17:39:12.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenNDS Captive Portal before 10.1.2. it has a do_binauth NULL pointer dereference that can be triggered with a crafted GET HTTP request with a missing client redirect query string parameter. Triggering this issue results in crashing openNDS (a Denial-of-Service condition). The issue occurs when the client is about to be authenticated, and can be triggered only when the BinAuth option is set. Affected OpenNDS Captive Portal before version 10.1.2 fixed infixed in OpenWrt master, OpenWrt 23.05 and Ope
ion is set. Affected OpenNDS Captive Portal before version 10.1.2 fixed infixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on28. August 2023 by updating OpenNDS to version 10.1.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openNDS/openNDS/releases/tag/v10.1.2 - https://github.com/openwrt/routing/commit/0b19771fb2dd81e7c428759610aed583171eed80 - https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006-v4/#sthash.2vJg3d85.rwx82g1C.dpbs
CVE ID: CVE-2023-38314 State: PUBLISHED Published: 2023-11-17T00:00:00 Last Updated: 2024-08-02T17:39:12.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a NULL pointer dereference in preauthenticated() that can be triggered with a crafted GET HTTP request with a missing redirect query string parameter. Triggering this issue results in crashing OpenNDS (a Denial-of-Service condition). Affected OpenNDS Captive Portal before version 10.1.2 fixed infixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on28. August 2023 by updating OpenNDS to version 10.1.3. Additional Analyst Notes: - CVE Program C
.05 and OpenWrt 22.03 on28. August 2023 by updating OpenNDS to version 10.1.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openNDS/openNDS/releases/tag/v10.1.2 - https://github.com/openwrt/routing/commit/0b19771fb2dd81e7c428759610aed583171eed80 - https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006-v4/#sthash.2vJg3d85.rwx82g1C.dpbs
CVE ID: CVE-2023-38315 State: PUBLISHED Published: 2023-11-17T00:00:00 Last Updated: 2024-08-02T17:39:12.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a try_to_authenticate NULL pointer dereference that can be triggered with a crafted GET HTTP with a missing client token query string parameter. Triggering this issue results in crashing OpenNDS (a Denial-of-Service condition). Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3. Additional Analyst Notes: - CVE Program Container: Ref
t 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openNDS/openNDS/releases/tag/v10.1.2 - https://github.com/openwrt/routing/commit/0b19771fb2dd81e7c428759610aed583171eed80 - https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006-v4/#sthash.2vJg3d85.rwx82g1C.dpbs
CVE ID: CVE-2023-38316 State: PUBLISHED Published: 2023-11-17T00:00:00 Last Updated: 2024-09-04T20:19:25.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenNDS Captive Portal before version 10.1.2. When the custom unescape callback is enabled, attackers can execute arbitrary OS commands by inserting them into the URL portion of HTTP GET requests. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openNDS/openNDS/releases/tag/
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openNDS/openNDS/releases/tag/v10.1.2 - https://github.com/openwrt/routing/commit/0b19771fb2dd81e7c428759610aed583171eed80 - https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006-v4/#sthash.2vJg3d85.rwx82g1C.dpbs
CVE ID: CVE-2023-38317 State: PUBLISHED Published: 2024-01-26T00:00:00.000Z Last Updated: 2025-06-03T18:01:57.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the network interface name entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://openwrt.org/docs/guide-user/services/captive-portal/opennds - https://github.com/openNDS/openNDS/releases/tag/v10.1.3 - https://github.com/openNDS/openNDS/blob/master/ChangeLog - https://www.fore
b.com/openNDS/openNDS/releases/tag/v10.1.3 - https://github.com/openNDS/openNDS/blob/master/ChangeLog - https://www.forescout.com/resources/sierra21-vulnerabilities
CVE ID: CVE-2023-38318 State: PUBLISHED Published: 2024-01-26T00:00:00.000Z Last Updated: 2025-06-20T19:37:02.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the gateway FQDN entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://openwrt.org/docs/guide-user/services/captive-portal/opennds - https://github.com/openNDS/openNDS/releases/tag/v10.1.3 - https://github.com/openNDS/openNDS/blob/master/ChangeLog - https://www.forescout.com/
NDS/openNDS/releases/tag/v10.1.3 - https://github.com/openNDS/openNDS/blob/master/ChangeLog - https://www.forescout.com/resources/sierra21-vulnerabilities
CVE ID: CVE-2023-38319 State: PUBLISHED Published: 2024-01-26T00:00:00.000Z Last Updated: 2025-06-20T19:37:43.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://openwrt.org/docs/guide-user/services/captive-portal/opennds - https://github.com/openNDS/openNDS/releases/tag/v10.1.3 - https://github.com/openNDS/openNDS/blob/master/ChangeLog - https://www.forescout.com/resou
penNDS/releases/tag/v10.1.3 - https://github.com/openNDS/openNDS/blob/master/ChangeLog - https://www.forescout.com/resources/sierra21-vulnerabilities
CVE ID: CVE-2023-38320 State: PUBLISHED Published: 2023-11-17T00:00:00 Last Updated: 2024-08-02T17:39:12.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a show_preauthpage NULL pointer dereference that can be triggered with a crafted GET HTTP with a missing User-Agent header. Triggering this issue results in crashing OpenNDS (a Denial-of-Service condition). This problem was fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openNDS/openNDS/releases/tag
10.1.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openNDS/openNDS/releases/tag/v10.1.2 - https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.2vJg3d85.dpbs - https://github.com/openwrt/routing/commit/0b19771fb2dd81e7c428759610aed583171eed80
CVE ID: CVE-2023-38321 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-02T17:39:12.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference, daemon crash, and Captive Portal outage) via a GET request to /opennds_auth/ that lacks a custom query string parameter and client-token. Additional Analyst Notes: - CVE Program Container: References: - https://openwrt.org/docs/guide-user/services/captive-portal/opennds - https://github.com/openNDS/openNDS/blob/master/ChangeLog - https://source.sierrawireless.com/-/medi
ive-portal/opennds - https://github.com/openNDS/openNDS/blob/master/ChangeLog - https://source.sierrawireless.com/-/media/support_downloads/security-bulletins/pdf/swi-psa-2023-006-r3.ashx
CVE ID: CVE-2023-38322 State: PUBLISHED Published: 2023-11-17T00:00:00 Last Updated: 2024-08-02T17:39:12.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a do_binauth NULL pointer dereference that be triggered with a crafted GET HTTP request with a missing User-Agent HTTP header. Triggering this issue results in crashing OpenNDS (a Denial-of-Service condition). The issue occurs when the client is about to be authenticated, and can be triggered only when the BinAuth option is set. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. Au
Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openNDS/openNDS/releases/tag/v10.1.2 - https://github.com/openwrt/routing/commit/0b19771fb2dd81e7c428759610aed583171eed80 - https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006-v4/#sthash.2vJg3d85.rwx82g1C.dpbs
CVE ID: CVE-2023-38323 State: PUBLISHED Published: 2024-01-26T00:00:00.000Z Last Updated: 2025-05-29T15:18:17.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the status path script entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://openwrt.org/docs/guide-user/services/captive-portal/opennds - https://github.com/openNDS/openNDS/releases/tag/v10.1.3 - https://github.com/openNDS/openNDS/blob/master/ChangeLog - https://www.forescou
m/openNDS/openNDS/releases/tag/v10.1.3 - https://github.com/openNDS/openNDS/blob/master/ChangeLog - https://www.forescout.com/resources/sierra21-vulnerabilities
CVE ID: CVE-2023-38324 State: PUBLISHED Published: 2023-11-17T00:00:00 Last Updated: 2024-11-26T20:12:30.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenNDS before 10.1.2. It allows users to skip the splash page sequence (and directly authenticate) when it is using the default FAS key and OpenNDS is configured as FAS. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://openwrt.org/docs/guide-user/services/captive-portal/opennds - http
ainer: - CISA ADP Vulnrichment: References: - https://openwrt.org/docs/guide-user/services/captive-portal/opennds - https://github.com/openNDS/openNDS/releases/tag/v10.1.2 - https://github.com/openNDS/openNDS/blob/master/ChangeLog - https://www.forescout.com/resources/sierra21-vulnerabilities - https://cwe.mitre.org/data/definitions/1390.html - https://github.com/openwrt/routing/commit/0b19771fb2dd81e7c428759610aed583171eed80 - https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006-v4/#sthash.2vJg3d85.rwx82g1C.dpbs
CVE ID: CVE-2023-38325 State: PUBLISHED Published: 2023-07-14T00:00:00 Last Updated: 2024-10-30T16:00:29.757Z Vendors: n/a Products: n/a Problem Types: n/a Description: The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pyca/cryptography/issues/9207 - https://github.com/pyca/cryptography/pull/9208 - https://pypi.org/project/cryptography/#history - https://github.com/pyca/cryptography/compare/41.0.1...41.0.2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMCCTYY3CSNQBFFYYC5DAV6KAT
ps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMCCTYY3CSNQBFFYYC5DAV6KATHWCUZK/ - https://security.netapp.com/advisory/ntap-20230824-0010/
CVE ID: CVE-2023-38326 State: REJECTED Published: N/A Last Updated: 2023-07-18T00:00:00 Description: No description available.
CVE ID: CVE-2023-38327 State: PUBLISHED Published: 2025-07-11T00:00:00.000Z Last Updated: 2025-07-15T19:55:59.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in eGroupWare 17.1.20190111. A User Enumeration vulnerability exists under calendar/freebusy.php, which allows unauthenticated remote attackers to enumerate the users of web applications based on server response. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2023-38328 State: PUBLISHED Published: 2023-10-26T00:00:00 Last Updated: 2024-09-10T16:17:54.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in eGroupWare 17.1.20190111. An Improper Password Storage vulnerability affects the setup panel of under setup/manageheader.php, which allows authenticated remote attackers with administrator credentials to read a cleartext database password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2023-38329 State: PUBLISHED Published: 2025-07-11T00:00:00.000Z Last Updated: 2025-07-15T19:55:53.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in eGroupWare 17.1.20190111. A cross-site scripting Reflected (XSS) vulnerability exists in calendar/freebusy.php, which allows unauthenticated remote attackers to inject arbitrary web script or HTML into the "user" HTTP/GET parameter, which reflects its input without sanitization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2023-38330 State: PUBLISHED Published: 2023-08-02T00:00:00 Last Updated: 2024-10-18T14:47:48.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area. An attacker can upload a file with a modified header to create a HTTP Response Splitting attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.oxid-esales.com/view.php?id=7479 - https://docs.oxid-esales.com/de/security/security-bulletins.html#security-bulletin-2023-002
CVE ID: CVE-2023-38331 State: PUBLISHED Published: 2023-07-28T00:00:00 Last Updated: 2024-10-23T12:57:42.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS in the products module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://manageengine.com - https://www.manageengine.com/products/service-desk/CVE-2023-38331.html
CVE ID: CVE-2023-38332 State: PUBLISHED Published: 2023-08-04T00:00:00 Last Updated: 2024-10-17T15:13:55.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus through 7201 allow authenticated users to take over another user's account via sensitive information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://manageengine.com - https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-38332.html
CVE ID: CVE-2023-38333 State: PUBLISHED Published: 2023-08-10T00:00:00.000Z Last Updated: 2025-03-07T18:50:37.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2023-38333.html
CVE ID: CVE-2023-38334 State: PUBLISHED Published: 2023-07-20T00:00:00 Last Updated: 2024-10-24T20:33:37.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: Omnis Studio 10.22.00 has incorrect access control. It advertises an irreversible feature for locking classes within Omnis libraries: it should be no longer possible to delete, view, change, copy, rename, duplicate, or print a locked class. Due to implementation issues, locked classes in Omnis libraries can be unlocked, and thus further analyzed and modified by Omnis Studio. This allows for further analyzing and also deleting, viewing, changing, copying, renaming, duplicating, or printing previously locked Omnis classes. This