Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-1404 State: PUBLISHED Published: 2023-06-09T05:33:33.172Z Last Updated: 2024-11-23T13:18:21.680Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpweaver Products: Weaver Show Posts Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Weaver Show Posts Plugin for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display name in versions up to, and including, 1.6. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever
tackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c8647c44-4879-4895-bd07-19f7d62a7326?source=cve - https://plugins.trac.wordpress.org/browser/show-posts/tags/1.6/includes/atw-showposts-sc.php#L368
CVE ID: CVE-2023-1405 State: PUBLISHED Published: 2024-01-16T15:56:18.763Z Last Updated: 2025-06-11T17:08:21.790Z Vendors: Unknown Products: Formidable Forms Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Formidable Forms WordPress plugin before 6.2 unserializes user input, which could allow anonymous users to perform PHP Object Injection when a suitable gadget is present. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8c727a31-ff65-4472-8191-b1becc08192a/
CVE ID: CVE-2023-1406 State: PUBLISHED Published: 2023-04-10T13:17:54.722Z Last Updated: 2025-02-11T21:32:31.166Z Vendors: Unknown Products: JetEngine Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2a81b6b1-2339-4889-9c28-1af133df8b65
CVE ID: CVE-2023-1407 State: PUBLISHED Published: 2023-03-15T06:32:03.080Z Last Updated: 2024-08-02T05:49:11.117Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Student Study Center Desk Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerabilit
d remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223111. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.223111 - https://vuldb.com/?ctiid.223111 - https://s1.ax1x.com/2023/03/15/pp1gd8x.png
CVE ID: CVE-2023-1408 State: PUBLISHED Published: 2023-05-08T13:58:21.683Z Last Updated: 2025-01-29T15:34:35.483Z Vendors: Unknown Products: Video List Manager Problem Types: CWE-89 SQL Injection Description: The Video List Manager WordPress plugin through 1.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/baf7ef4d-b2ba-48e0-9c17-74fa27e0c15b
CVE ID: CVE-2023-1409 State: PUBLISHED Published: 2023-08-23T15:21:43.150Z Last Updated: 2025-02-13T16:39:22.593Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: MongoDB Inc Products: MongoDB Server Problem Types: CWE-295 Description: If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms (e.g. Linux), it is possible that client certificate validation may not be in effect, potentially allowing client to establish a TLS connection with the server that supplies any certificate. This issue affect all MongoDB Server v6.3 versions, MongoDB S
connection with the server that supplies any certificate. This issue affect all MongoDB Server v6.3 versions, MongoDB Server v5.0 versions v5.0.0 to v5.0.14 and all MongoDB Server v4.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-73662 - https://jira.mongodb.org/browse/SERVER-77028 - https://security.netapp.com/advisory/ntap-20230921-0007/
CVE ID: CVE-2023-1410 State: PUBLISHED Published: 2023-03-23T07:48:56.246Z Last Updated: 2025-03-04T21:22:03.229Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:N) Vendors: Grafana Products: Grafana, Grafana Enterprise Problem Types: CWE-79 Description: Grafana is an open-source platform for monitoring and observability. Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip. The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized. An attacker needs to have control over the Graphite data source in order to manipulate a function description and a Grafana admin needs to configure the data
the Graphite data source in order to manipulate a function description and a Grafana admin needs to configure the data source, later a Grafana user needs to select a tampered function and hover over the description. Users may upgrade to version 8.5.22, 9.2.15 and 9.3.11 to receive a fix. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://grafana.com/security/security-advisories/cve-2023-1410/ - https://github.com/grafana/bugbounty/security/advisories/GHSA-qrrg-gw7w-vp76 - https://security.netapp.com/advisory/ntap-20230420-0003/
CVE ID: CVE-2023-1412 State: PUBLISHED Published: 2023-04-05T15:22:56.317Z Last Updated: 2025-02-10T18:02:41.160Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Cloudflare Products: WARP Problem Types: CWE-59 Description: An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows (<= 2022.12.582.0) to perform privileged operations with SYSTEM context by working with a combination of opportunistic locks (oplock) and symbolic links (which can both be created by an unprivileged user). After installing the Cloudflare WARP Client (admin privileges required), an MSI-Installer is placed under C:\Wind
user). After installing the Cloudflare WARP Client (admin privileges required), an MSI-Installer is placed under C:\Windows\Installer. The vulnerability lies in the repair function of this MSI. ImpactAn unprivileged (non-admin) user can exploit this vulnerability to perform privileged operations with SYSTEM context, including deleting arbitrary files and reading arbitrary file content. This can lead to a variety of attacks, including the manipulation of system files and privilege escalation. PatchesA new installer with a fix that addresses this vulnerability was released in version 2023.3.381.0. While the WARP Client itself is not vulnerable (only the installer), users are encouraged to upgr
version 2023.3.381.0. While the WARP Client itself is not vulnerable (only the installer), users are encouraged to upgrade to the latest version and delete any older installers present in their systems. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cloudflare/advisories/security/advisories/GHSA-hgxh-48m3-3gq7 - https://install.appcenter.ms/orgs/cloudflare/apps/1.1.1.1-windows-1/distribution_groups/release - https://developers.cloudflare.com/warp-client/get-started/windows/
CVE ID: CVE-2023-1413 State: PUBLISHED Published: 2023-04-17T12:17:47.151Z Last Updated: 2025-04-23T16:22:15.448Z Vendors: Unknown Products: WP VR Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP VR WordPress plugin before 8.2.9 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6938fee5-3510-45e6-8112-c9e2b30f6881
CVE ID: CVE-2023-1414 State: PUBLISHED Published: 2023-04-24T18:31:02.339Z Last Updated: 2025-02-04T16:08:00.755Z Vendors: Unknown Products: WP VR Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow any authenticated users, such as subscriber to update arbitrary tours Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d61d4be7-9251-4c62-8fb7-8a456aa6969e
CVE ID: CVE-2023-1415 State: PUBLISHED Published: 2023-03-15T15:00:56.548Z Last Updated: 2024-11-22T21:50:26.494Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: Simple Art Gallery Problem Types: CWE-434 Description: A vulnerability was found in Simple Art Gallery 1.0. It has been declared as critical. This vulnerability affects the function sliderPicSubmit of the file adminHome.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. VDB-223126 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.223126 - https://vuldb.com/?
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.223126 - https://vuldb.com/?ctiid.223126 - https://github.com/0xxtoby/Vuldb/blob/main/SIMPLE%20ART%20GALLERY%20system%20has%20a%20file%20upload%20(RCE)%20vulnerability.pdf
CVE ID: CVE-2023-1416 State: PUBLISHED Published: 2023-03-15T15:13:12.962Z Last Updated: 2024-08-02T05:49:11.624Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: Simple Art Gallery Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in Simple Art Gallery 1.0. Affected is an unknown function of the file adminHome.php. The manipulation of the argument social_facebook leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223128. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?
f this vulnerability is VDB-223128. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.223128 - https://vuldb.com/?ctiid.223128 - https://github.com/Songs-YZS/CveList/blob/main/SIMPLE%20ART%20GALLERY%20system%20has%20Sql%20injection%20vulnerabilities.pdf
CVE ID: CVE-2023-1417 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-11T15:26:30.751Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Authorization bypass through user-controlled key in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unrelated group. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/39672
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/396720 - https://hackerone.com/reports/1892200 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1417.json
CVE ID: CVE-2023-1418 State: PUBLISHED Published: 2023-03-15T15:18:33.549Z Last Updated: 2024-08-02T05:49:11.277Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Friendly Island Pizza Website and Ordering System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in SourceCodester Friendly Island Pizza Website and Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file cashconfirm.php of the component POST Parameter Handler. The manipulation of the argument transactioncode leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public an
code leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223129 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.223129 - https://vuldb.com/?ctiid.223129 - https://github.com/2889436547/bug_report/blob/main/vendors/Skynidnine/Friendly%20Island%20Pizza%20Website%20and%20Ordering%20System/XSS-1.md
CVE ID: CVE-2023-1419 State: PUBLISHED Published: 2024-11-17T10:20:36.408Z Last Updated: 2024-11-18T18:56:00.727Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat build of Debezium, Red Hat Integration Change Data Capture Problem Types: CWE-233 Description: A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacker to send a malicious request to inject a parameter that may allow the viewing of unauthorized data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-1419 - htt
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-1419 - https://bugzilla.redhat.com/show_bug.cgi?id=2178722
CVE ID: CVE-2023-1420 State: PUBLISHED Published: 2023-04-24T18:30:49.881Z Last Updated: 2025-02-04T18:43:06.967Z Vendors: Unknown Products: Ajax Search Lite, Ajax Search Pro Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape a parameter before outputting it back in a response of an AJAX action, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a9a54ee5-2b80-4f55-894c-1047030ee
ram Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a9a54ee5-2b80-4f55-894c-1047030eea7f
CVE ID: CVE-2023-1421 State: PUBLISHED Published: 2023-03-15T22:51:25.597Z Last Updated: 2024-12-06T23:06:14.595Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-79 Description: A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests on behalf of the victim via sharing a crafted link with a malicious state parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2023-1424 State: PUBLISHED Published: 2023-05-24T04:39:25.040Z Last Updated: 2025-03-05T18:59:00.469Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Mitsubishi Electric Corporation Products: MELSEC iQ-F Series FX5U-32MT/ES, MELSEC iQ-F Series FX5U-64MT/ES, MELSEC iQ-F Series FX5U-80MT/ES, MELSEC iQ-F Series FX5U-32MR/ES, MELSEC iQ-F Series FX5U-64MR/ES, MELSEC iQ-F Series FX5U-80MR/ES, MELSEC iQ-F Series FX5U-32MT/DS, MELSEC iQ-F Series FX5U-64MT/DS, MELSEC iQ-F Series FX5U-80MT/DS, MELSEC iQ-F Series FX5U-32MR/DS, MELSEC iQ-F Series FX5U-64MR/DS, MELSEC iQ-F Series FX5U-80MR/DS, MELSEC iQ-F Series FX5U-32MT/ESS, MELSEC iQ-F Series FX5U-64MT/ES
Series FX5U-64MR/DS, MELSEC iQ-F Series FX5U-80MR/DS, MELSEC iQ-F Series FX5U-32MT/ESS, MELSEC iQ-F Series FX5U-64MT/ESS, MELSEC iQ-F Series FX5U-80MT/ESS, MELSEC iQ-F Series FX5U-32MT/DSS, MELSEC iQ-F Series FX5U-64MT/DSS, MELSEC iQ-F Series FX5U-80MT/DSS, MELSEC iQ-F Series FX5UC-32MT/D, MELSEC iQ-F Series FX5UC-64MT/D, MELSEC iQ-F Series FX5UC-96MT/D, MELSEC iQ-F Series FX5UC-32MT/DSS, MELSEC iQ-F Series FX5UC-64MT/DSS, MELSEC iQ-F Series FX5UC-96MT/DSS, MELSEC iQ-F Series FX5UC-32MT/DS-TS, MELSEC iQ-F Series FX5UC-32MT/DSS-TS, MELSEC iQ-F Series FX5UC-32MR/DS-TS, MELSEC iQ-R Series R00CPU, MELSEC iQ-R Series R01CPU, MELSEC iQ-R Series R02CPU, MELSEC iQ-R Series R04CPU, MELSEC iQ-R Serie
C iQ-R Series R00CPU, MELSEC iQ-R Series R01CPU, MELSEC iQ-R Series R02CPU, MELSEC iQ-R Series R04CPU, MELSEC iQ-R Series R08CPU, MELSEC iQ-R Series R16CPU, MELSEC iQ-R Series R32CPU, MELSEC iQ-R Series R120CPU, MELSEC iQ-R Series R04ENCPU, MELSEC iQ-R Series R08ENCPU, MELSEC iQ-R Series R16ENCPU, MELSEC iQ-R Series R32ENCPU, MELSEC iQ-R Series R120ENCPU, MELSEC iQ-R Series R08SFCPU, MELSEC iQ-R Series R16SFCPU, MELSEC iQ-R Series R32SFCPU, MELSEC iQ-R Series R120SFCPU, MELSEC iQ-R Series R08PCPU, MELSEC iQ-R Series R16PCPU, MELSEC iQ-R Series R32PCPU, MELSEC iQ-R Series R120PCPU Problem Types: CWE-120 Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulner
20PCPU Problem Types: CWE-120 Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules and MELSEC iQ-R Series CPU modules allows a remote unauthenticated attacker to cause a denial of service (DoS) condition or execute malicious code on a target product by sending specially crafted packets. A system reset of the product is required for recovery from a denial of service (DoS) condition and malicious code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-003_en.pdf - https
SA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-003_en.pdf - https://jvn.jp/vu/JVNVU94650413 - https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-03
CVE ID: CVE-2023-1425 State: PUBLISHED Published: 2023-04-10T13:17:56.500Z Last Updated: 2025-02-11T21:28:24.709Z Vendors: Unknown Products: WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg Problem Types: CWE-89 SQL Injection Description: The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin before 2.7.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/578f4179-e7be-4
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/578f4179-e7be-4963-9379-5e694911b451
CVE ID: CVE-2023-1426 State: PUBLISHED Published: 2023-04-10T13:17:55.647Z Last Updated: 2025-02-11T21:30:48.348Z Vendors: Unknown Products: WP Tiles Problem Types: CWE-200 Information Exposure Description: The WP Tiles WordPress plugin through 1.1.2 does not ensure that posts to be displayed are not draft/private, allowing any authenticated users, such as subscriber to retrieve the titles of draft and privates posts for example. AN attacker could also retrieve the title of any other type of post. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fdd79bb4-d434-4635-bb2b-84d079ecc746
CVE ID: CVE-2023-1427 State: PUBLISHED Published: 2023-04-17T12:17:41.603Z Last Updated: 2025-02-06T15:29:34.944Z Vendors: Unknown Products: Photo Gallery by 10Web Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: - The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images anywhere in the filesystem via a path traversal vector. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c8917ba2-4cb3-4b09-8a49-b7c612254946
CVE ID: CVE-2023-1428 State: PUBLISHED Published: 2023-06-09T10:46:54.244Z Last Updated: 2024-09-26T18:58:56.654Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Google Products: gRPC Problem Types: CWE-617 Description: There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2: te: x (x != trailers) :scheme: x (x != http, https) grpclb_client_stats: x (x == anything) On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53
the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/grpc/grpc/commit/2485fa94bd8a723e5c977d55a3ce10b301b437f8
CVE ID: CVE-2023-1429 State: PUBLISHED Published: 2023-03-16T00:00:00.000Z Last Updated: 2025-02-26T21:16:00.292Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/e0829fea-e458-47b8-84a3-a74476d9638f - https://github.com/pimcore/pimcore/commit/7588c336edb24050656111b89d69e69cc9feb5f5
CVE ID: CVE-2023-1430 State: PUBLISHED Published: 2023-06-09T05:33:37.287Z Last Updated: 2024-12-28T00:51:36.585Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: techjewel Products: Email Marketing, Newsletter, Email Automation and CRM Plugin for WordPress by FluentCRM Problem Types: CWE-759 Use of a One-Way Hash without a Salt Description: The FluentCRM - Marketing Automation For WordPress plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 2.7.40 due to the use of an MD5 hash without a salt to control subscriptions. This makes it possible for unauthenticated attackers to unsubscribe users from lists and
salt to control subscriptions. This makes it possible for unauthenticated attackers to unsubscribe users from lists and manage subscriptions, granted they gain access to any targeted subscribers email address. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/de6da87e-8f7d-4120-8a1b-390ef7733d84?source=cve - https://plugins.trac.wordpress.org/changeset/2899218/fluent-crm/tags/2.8.0/app/Hooks/Handlers/ExternalPages.php?old=2873074&old_path=fluent-crm%2Ftags%2F2.7.40%2Fapp%2FHooks%2FHandlers%2FExternalPages.php