Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-3973 State: PUBLISHED Published: 2023-07-27T14:33:11.271Z Last Updated: 2024-10-15T15:36:46.194Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L) Vendors: jgraph Products: jgraph/drawio Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/4c1c5db5-210f-4d7e-8380-b95f88fdb78d - https://github.com/jgraph/drawio/commit/1db2c2c653aa245d175d30c210239e3946bfcb95
CVE ID: CVE-2023-3974 State: PUBLISHED Published: 2023-07-27T14:33:31.671Z Last Updated: 2024-10-15T15:36:08.407Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: jgraph Products: jgraph/drawio Problem Types: CWE-78 Description: OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/ce75aa04-e4d6-4e0a-9db0-ae84c46ae9e2 - https://github.com/jgraph/drawio/commit/9d6532de36496e77d872d91b1947bb696607d623
CVE ID: CVE-2023-3975 State: PUBLISHED Published: 2023-07-27T14:34:10.847Z Last Updated: 2024-10-15T15:32:40.165Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: jgraph Products: jgraph/drawio Problem Types: CWE-78 Description: OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/4da96d20-78ac-462e-910c-a14db9062161 - https://github.com/jgraph/drawio/commit/8ec95cb03e0a80cf908a282522ac1651306db340
CVE ID: CVE-2023-3977 State: PUBLISHED Published: 2023-07-28T04:37:03.018Z Last Updated: 2025-02-05T19:38:18.805Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: steve85b, copydeleteposts, socialsharepro, cl272, migrate, popups, socialdude, s-feeds Products: SSL Mixed Content Fix, Duplicate Post, Social Share Icons & Social Share Buttons, Ultimate Posts Widget, Backup Migration, Pop-up, Redirection, Clone, Social Media Share Buttons & Social Sharing Icons, RSS Redirect & Feedburner Alternative, Enhanced Text Widget Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: Several plugins for WordPress by Inisev are vulnerable to Cross-Site Reques
oss-Site Request Forgery (CSRF) Description: Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ab7c8926-c762-49b1-bc97-4b7a
A ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ab7c8926-c762-49b1-bc97-4b7a2f4f97fc?source=cve - https://plugins.trac.wordpress.org/browser/feedburner-alternative-and-rss-redirect/tags/3.7/modules/banner/misc.php#L427 - https://plugins.trac.wordpress.org/browser/ultimate-social-media-icons/tags/2.8.0/banner/misc.php#L424 - https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.3.8/banner/misc.php#L426 - https://plugins.trac.wordpress.org/browser/wp-clone-by-wp-academy/tags/2.3.7/modules/banner/misc.php#L438 - https://plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.6/banner/misc.php#L339 - https://plugins.trac.wordpres
/plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.6/banner/misc.php#L339 - https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.7/includes/banner/misc.php#L427 - https://plugins.trac.wordpress.org/browser/redirect-redirection/tags/1.1.3/includes/banner/misc.php#L427 - https://plugins.trac.wordpress.org/browser/ultimate-posts-widget/tags/2.2.4/banner/misc.php#L343 - https://plugins.trac.wordpress.org/browser/http-https-remover/tags/3.2.3/banner/misc.php#L427 - https://plugins.trac.wordpress.org/browser/pop-up-pop-up/tags/1.1.9/modules/banner/misc.php#L427 - https://plugins.trac.wordpress.org/changeset?old_path=%2Fcopy-delete-posts%2Ftags%2F1.3.8&old=2923021&new_pa
.php#L427 - https://plugins.trac.wordpress.org/changeset?old_path=%2Fcopy-delete-posts%2Ftags%2F1.3.8&old=2923021&new_path=%2Fcopy-delete-posts%2Ftags%2F1.3.9&new=2923021&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/browser/ultimate-social-media-icons/tags/2.8.2/banner/misc.php#L434 - https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.4.0/banner/misc.php#L434 - https://plugins.trac.wordpress.org/browser/wp-clone-by-wp-academy/tags/2.3.8/modules/banner/misc.php#L432 - https://plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.7/banner/misc.php#L351 - https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.8/includes/banner/misc.php#L434 -
nner/misc.php#L351 - https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.8/includes/banner/misc.php#L434 - https://plugins.trac.wordpress.org/browser/ultimate-posts-widget/tags/2.2.5/banner/misc.php#L351 - https://plugins.trac.wordpress.org/browser/pop-up-pop-up/tags/1.2.0/modules/banner/misc.php#L432 - https://plugins.trac.wordpress.org/browser/ultimate-social-media-plus/tags/3.5.7/banner/misc.php#L424 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2823769%40http-https-remover%2Ftags%2F3.2.3&new=2944114%40http-https-remover%2Ftags%2F3.2.4 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2823770%40feedburner-
%2Ftags%2F3.2.4 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2823770%40feedburner-alternative-and-rss-redirect%2Ftags%2F3.7&new=2944116%40feedburner-alternative-and-rss-redirect%2Ftags%2F3.8#file115 - https://plugins.trac.wordpress.org/changeset/2944041/ultimate-social-media-plus/tags/3.5.8/banner/misc.php?old=2823720&old_path=ultimate-social-media-plus%2Ftags%2F3.5.7%2Fbanner%2Fmisc.php
CVE ID: CVE-2023-3978 State: PUBLISHED Published: 2023-08-02T19:48:56.676Z Last Updated: 2024-09-27T21:57:51.807Z Vendors: golang.org/x/net Products: golang.org/x/net/html Problem Types: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/61615 - https://go.dev/cl/514896 - https://pkg.go.dev/vuln/GO-2023-1988
CVE ID: CVE-2023-3979 State: PUBLISHED Published: 2023-09-29T06:02:06.310Z Last Updated: 2025-11-20T04:09:18.297Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that upstream members to collaborate with you on your branch get permission to write to the merge request’s source branch. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-or
. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/419972 - https://hackerone.com/reports/2082560
CVE ID: CVE-2023-3980 State: PUBLISHED Published: 2023-07-27T18:26:20.420Z Last Updated: 2024-10-15T15:29:03.050Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: omeka Products: omeka/omeka-s Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/6eb3cb9a-5c78-451f-ae76-0b1e62fe5e54 - https://github.com/omeka/omeka-s/commit/c6833c0531a07bd914e9f85a61bbbc16e9b4c8df
CVE ID: CVE-2023-3981 State: PUBLISHED Published: 2023-07-27T18:28:11.153Z Last Updated: 2024-10-15T15:28:05.660Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: omeka Products: omeka/omeka-s Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in GitHub repository omeka/omeka-s prior to 4.0.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/f5018226-0063-415d-9675-d7e30934ff78 - https://github.com/omeka/omeka-s/commit/dc01ca1b03e845db8a6a6b665d8da36c8dcd2c31
CVE ID: CVE-2023-3982 State: PUBLISHED Published: 2023-07-27T18:32:45.355Z Last Updated: 2024-10-15T15:25:30.103Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: omeka Products: omeka/omeka-s Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/e5e889ee-5947-4c2a-a72e-9c90e2e2a845 - https://github.com/omeka/omeka-s/commit/27ff6575c88d970ce95e1d4096553a927e2003b9
CVE ID: CVE-2023-3983 State: PUBLISHED Published: 2023-07-31T00:00:00 Last Updated: 2024-10-22T15:33:26.154Z Vendors: n/a Products: Advantech iView Problem Types: SQL Injection Description: An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752. An authenticated remote attacker can bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform blind SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-24
CVE ID: CVE-2023-3984 State: PUBLISHED Published: 2023-07-28T03:00:05.219Z Last Updated: 2024-11-21T15:39:31.066Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: phpscriptpoint Products: RecipePoint Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in phpscriptpoint RecipePoint 1.9. This affects an unknown part of the file /recipe-result. The manipulation of the argument text/category/type/difficulty/cuisine/cooking_method leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-235605 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
605 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.235605 - https://vuldb.com/?ctiid.235605
CVE ID: CVE-2023-3985 State: PUBLISHED Published: 2023-07-28T04:31:04.075Z Last Updated: 2024-08-02T07:08:50.828Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Jewelry Store Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Online Jewelry Store 1.0 and classified as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-235606 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Con
nd may be used. VDB-235606 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.235606 - https://vuldb.com/?ctiid.235606 - https://github.com/MaxLiu98/Jewelry-Store-System/blob/main/Jewelry%20Store%20System%20login.php%20has%20Sqlinjection.pdf
CVE ID: CVE-2023-3986 State: PUBLISHED Published: 2023-07-28T05:00:05.605Z Last Updated: 2024-10-16T19:31:52.528Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: SourceCodester Products: Simple Online Mens Salon Management System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Simple Online Mens Salon Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/?page=user/list. The manipulation of the argument First Name/Last Name/Username leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier o
ack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235607. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.235607 - https://vuldb.com/?ctiid.235607 - https://github.com/draco1725/POC/blob/main/Exploit/Simple%20Online%20Men's%20Salon%20Management%20System/Stored%20XSS
CVE ID: CVE-2023-3987 State: PUBLISHED Published: 2023-07-28T05:31:03.454Z Last Updated: 2024-08-02T07:08:50.823Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Simple Online Mens Salon Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Simple Online Mens Salon Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/?page=user/manage_user&id=3. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-23
k remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235608. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.235608 - https://vuldb.com/?ctiid.235608 - https://github.com/draco1725/POC/blob/main/Exploit/Simple%20Online%20Men's%20Salon%20Management%20System/SQL%20Injection
CVE ID: CVE-2023-3988 State: PUBLISHED Published: 2023-07-28T06:00:05.933Z Last Updated: 2025-07-09T13:47:59.673Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: Cafe Billing System Problem Types: CWE-89 Description: A vulnerability was found in Cafe Billing System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file index.php of the component Order Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235609 was assigned to this vulnerability. Additional Analyst Notes: - CVE Pr
public and may be used. The identifier VDB-235609 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.235609 - https://vuldb.com/?ctiid.235609 - https://github.com/excuses0217/CveHub/blob/main/Cafe%20Billing%20System%20index.php%20has%20Sqlinjection.md
CVE ID: CVE-2023-3989 State: PUBLISHED Published: 2023-07-28T06:31:03.857Z Last Updated: 2024-10-15T14:16:09.438Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Jewelry Store System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Jewelry Store System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file add_customer.php. The manipulation leads to cross site scripting. The attack may be launched remotely. VDB-235610 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.2
ility. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.235610 - https://vuldb.com/?ctiid.235610 - https://github.com/zouzuo1994321/Jewelry-Store-System/blob/main/Jewelry%20Store%20System%20add_customer.php%20has%20Cross%20Site%20Scripting(Xss)%20vulnerability.pdf
CVE ID: CVE-2023-3990 State: PUBLISHED Published: 2023-07-28T07:00:05.551Z Last Updated: 2024-08-02T07:08:50.748Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Mingsoft Products: MCMS Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is V
may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-235611. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.235611 - https://vuldb.com/?ctiid.235611 - https://gitee.com/mingSoft/MCMS/issues/I7K4DQ
CVE ID: CVE-2023-3991 State: PUBLISHED Published: 2023-10-16T09:07:46.666Z Last Updated: 2024-09-16T16:37:12.991Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: FreshTomato Products: FreshTomato Problem Types: CWE-78 Description: An OS command injection vulnerability exists in the httpd iperfrun.cgi functionality of FreshTomato 2023.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://govtech-csg.github.io/security-advisories/2023/10/16/CVE-2023-3991.html
CVE ID: CVE-2023-3992 State: PUBLISHED Published: 2023-08-30T14:22:02.880Z Last Updated: 2025-04-23T16:18:46.976Z Vendors: Unknown Products: PostX Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The PostX WordPress plugin before 3.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c43b669f-0377-4402-833c-817b75001888
CVE ID: CVE-2023-3993 State: PUBLISHED Published: 2023-08-02T00:07:00.242Z Last Updated: 2024-10-03T06:23:13.637Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-532 Description: An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a specific endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/409570
CVE ID: CVE-2023-3994 State: PUBLISHED Published: 2023-08-02T00:06:50.342Z Last Updated: 2025-11-20T04:09:23.305Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-1333 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitl
arkdown endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/416225 - https://hackerone.com/reports/1963255
CVE ID: CVE-2023-3995 State: REJECTED Published: N/A Last Updated: 2023-09-04T19:58:12.058Z Description: No description available.
CVE ID: CVE-2023-3996 State: PUBLISHED Published: 2023-10-20T07:29:30.155Z Last Updated: 2025-02-05T19:04:18.914Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: reputeinfosystems Products: ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The ARMember Lite - Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attac
uding, 4.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c1022ac4-869e-415a-a7c8-3650421608ea?source=cve - https://plugins.svn.wordpress.org/armember-membership/tags/4.0.2/readme.txt - https://plugins.svn.wordpress.org/armember-mem
s://plugins.svn.wordpress.org/armember-membership/tags/4.0.2/readme.txt - https://plugins.svn.wordpress.org/armember-membership/tags/4.0.2/readme.md - https://www.armemberplugin.com - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2905086%40armember-membership%2Ftrunk&old=2885708%40armember-membership%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-3997 State: PUBLISHED Published: 2023-07-31T16:16:19.911Z Last Updated: 2025-02-28T11:03:50.122Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Splunk Products: Splunk SOAR (On-premises), Splunk SOAR (Cloud) Problem Types: CWE-117 Description: Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to view the poisoned logs, this can tamper with the terminal and cause possible malicious code execution from the
empts to view the poisoned logs, this can tamper with the terminal and cause possible malicious code execution from the terminal user’s action. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0702
CVE ID: CVE-2023-3998 State: PUBLISHED Published: 2023-10-20T07:29:24.732Z Last Updated: 2025-02-05T19:05:53.124Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: advancedcoding Products: Comments – wpDiscuz Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the userRate function in versions up to, and including, 7.6.3. This makes it possible for unauthenticated attackers to increase or decrease the rating of a post. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
r decrease the rating of a post. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9d09bdab-ffab-44cc-bba2-821b21a8e343?source=cve - https://plugins.trac.wordpress.org/browser/wpdiscuz/trunk/utils/class.WpdiscuzHelperAjax.php#L886