Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-3899 State: PUBLISHED Published: 2023-08-23T10:49:11.684Z Last Updated: 2025-11-20T07:23:33.825Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SA
ort, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 6 Problem Types: CWE-285 Description: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the sta
egistration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2023:4701 - https://access.redhat.com/errata/RHSA-2023:4702 - https://access.redhat.com/errata/RHSA-2023:4703 - https://access.redhat.com/errata/RHSA-2023:4704 - https://access.redha
https://access.redhat.com/errata/RHSA-2023:4703 - https://access.redhat.com/errata/RHSA-2023:4704 - https://access.redhat.com/errata/RHSA-2023:4705 - https://access.redhat.com/errata/RHSA-2023:4706 - https://access.redhat.com/errata/RHSA-2023:4707 - https://access.redhat.com/errata/RHSA-2023:4708 - https://access.redhat.com/security/cve/CVE-2023-3899 - https://bugzilla.redhat.com/show_bug.cgi?id=2225407
CVE ID: CVE-2023-3900 State: PUBLISHED Published: 2023-08-02T00:07:05.231Z Last Updated: 2025-11-20T04:08:08.254Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-1287 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid 'start_sha' value on merge requests page may lead to Denial of Service as Changes tab would not load. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/418770 - https://hackerone.com/reports/205851
ram Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/418770 - https://hackerone.com/reports/2058514
CVE ID: CVE-2023-3904 State: PUBLISHED Published: 2023-12-15T16:03:15.329Z Last Updated: 2025-11-20T04:08:13.275Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-1287 Description: An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible to overflow the time spent on an issue that altered the details shown in the issue boards. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/418226 - https://hackerone.com/reports/205
rogram Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/418226 - https://hackerone.com/reports/2053154
CVE ID: CVE-2023-3906 State: PUBLISHED Published: 2023-09-29T06:02:16.308Z Last Updated: 2025-11-20T04:08:18.260Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-1287 Description: An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/419213 - https://hackerone.com/reports/2071411
CVE ID: CVE-2023-3907 State: PUBLISHED Published: 2023-12-17T23:02:36.694Z Last Updated: 2025-11-20T04:08:23.279Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-286 Description: A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows a project Maintainer to use a Project Access Token to escalate their role to Owner Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/418878 - https://hackerone.com/reports/2058934
CVE ID: CVE-2023-3908 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:17.592Z Description: No description available.
CVE ID: CVE-2023-3909 State: PUBLISHED Published: 2023-11-06T12:08:45.129Z Last Updated: 2025-11-20T04:08:28.265Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-1333 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in gitlab-ci.yml file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/i
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/418763 - https://hackerone.com/reports/2050269
CVE ID: CVE-2023-3911 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:45.592Z Description: No description available.
CVE ID: CVE-2023-3913 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:07.293Z Description: No description available.
CVE ID: CVE-2023-3914 State: PUBLISHED Published: 2023-09-29T06:02:21.304Z Last Updated: 2025-11-20T04:08:33.278Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-286 Description: A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows access to internal projects. A service account is not deleted when a namespace is deleted, allowing access to internal projects. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/418115 - https://hackerone.com/reports/2040822
CVE ID: CVE-2023-3915 State: PUBLISHED Published: 2023-09-01T10:01:16.853Z Last Updated: 2025-11-20T04:08:38.257Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-279 Description: An issue has been discovered in GitLab EE affecting all versions starting from 16.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. If an external user is given an owner role on any group, that external user may escalate their privileges on the instance by creating a service account in that group. This service account is not classified as external and may be used to access interna
ng a service account in that group. This service account is not classified as external and may be used to access internal projects. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/417664 - https://hackerone.com/reports/2040834
CVE ID: CVE-2023-3917 State: PUBLISHED Published: 2023-09-29T06:02:26.304Z Last Updated: 2025-11-20T04:08:43.256Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-1287 Description: Denial of Service in pipelines affecting all versions of Gitlab EE and CE prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows attacker to cause pipelines to fail. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/417896 - https://hackerone.com/reports/2055158
CVE ID: CVE-2023-3919 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:10.479Z Description: No description available.
CVE ID: CVE-2023-3920 State: PUBLISHED Published: 2023-09-29T06:02:31.303Z Last Updated: 2025-11-20T04:08:48.263Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in GitLab affecting all versions starting from 11.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that a maintainer to create a fork relationship between existing projects contrary to the documentation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issu
alyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/417481 - https://hackerone.com/reports/2058121
CVE ID: CVE-2023-3922 State: PUBLISHED Published: 2023-09-29T07:30:50.402Z Last Updated: 2025-11-20T04:08:53.255Z Severity: LOW (CVSS 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-601 Description: An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to hijack some links and buttons on the GitLab UI to a malicious page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/394770 - https://hackerone.com/repor
CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/394770 - https://hackerone.com/reports/1887323
CVE ID: CVE-2023-3928 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:12.810Z Description: No description available.
CVE ID: CVE-2023-3929 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:13.594Z Description: No description available.
CVE ID: CVE-2023-3930 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:18.408Z Description: No description available.
CVE ID: CVE-2023-3932 State: PUBLISHED Published: 2023-08-03T04:01:58.186Z Last Updated: 2025-11-20T04:08:58.262Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-286 Description: An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/41
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/417594 - https://hackerone.com/reports/2057633
CVE ID: CVE-2023-3933 State: PUBLISHED Published: 2023-10-20T15:06:22.941Z Last Updated: 2025-02-05T19:00:25.159Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wiloke Products: Your Journey Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user
r unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c738e051-ad1c-4115-94d3-127dd5dff935?source=cve - https://github.com/BlackFan/client-side-prototype-pollution
CVE ID: CVE-2023-3934 State: REJECTED Published: N/A Last Updated: 2024-01-31T05:16:29.186Z Description: No description available.
CVE ID: CVE-2023-3935 State: PUBLISHED Published: 2023-09-13T13:19:18.392Z Last Updated: 2025-08-27T20:32:53.842Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Wibu Products: CodeMeter Runtime Problem Types: CWE-787 Description: A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - https://cert.vde.com/en/advisories/VDE-2023-0
admin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - https://cert.vde.com/en/advisories/VDE-2023-031/ - https://cert.vde.com/en/advisories/VDE-2023-030/
CVE ID: CVE-2023-3936 State: PUBLISHED Published: 2023-08-21T12:29:49.665Z Last Updated: 2025-04-23T16:19:26.930Z Vendors: Unknown Products: Blog2Social: Social Media Auto Post & Scheduler Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6d09a5d3-046d-47ef-86b4-c024ea09dc0f
CVE ID: CVE-2023-3937 State: PUBLISHED Published: 2023-08-11T11:28:30.185Z Last Updated: 2024-10-03T20:27:22.370Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Snow Software Products: Snow License Manager Problem Types: CWE-79 Description: Cross site scripting vulnerability in web portal in Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows allows an authenticated user with high privileges to trigger cross site scripting attack via the web browser Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.snowsoftware.com/s/feed/0D56M00009gUexuSAC
CVE ID: CVE-2023-3938 State: PUBLISHED Published: 2024-05-21T09:32:15.305Z Last Updated: 2024-08-02T07:08:50.673Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ZkTeco Products: ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZkTeco-based OEM devices allows an attacker to authenticate under any user from the device database. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with the ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly other
X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with the ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-001.md
CVE ID: CVE-2023-3939 State: PUBLISHED Published: 2024-05-21T09:45:00.639Z Last Updated: 2024-08-02T07:08:50.765Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: ZkTeco Products: ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in ZkTeco-based OEM devices allows OS Command Injection. Since all the found command implementations are executed from the superuser, their impact is the maximum possible. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and
ximum possible. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with the ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly other. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-002.md
CVE ID: CVE-2023-3940 State: PUBLISHED Published: 2024-05-21T10:15:52.699Z Last Updated: 2024-08-02T07:08:50.683Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ZkTeco Products: ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 Problem Types: CWE-23 Description: Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to access any file on the system. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with the ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referen
5-7354-Ver1.0.0 and possibly others. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-003.md
CVE ID: CVE-2023-3941 State: PUBLISHED Published: 2024-05-21T10:20:39.827Z Last Updated: 2024-08-02T07:08:50.697Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: ZkTeco Products: ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 Problem Types: CWE-23 Description: Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to write any file on the system with root privileges. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with the ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pro
ith the ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-003.md
CVE ID: CVE-2023-3942 State: PUBLISHED Published: 2024-05-21T12:23:49.526Z Last Updated: 2024-08-02T07:08:50.624Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ZkTeco Products: ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0, Standalone service v. 2.1.6-20200907 Problem Types: CWE-89 Description: An 'SQL Injection' vulnerability, due to improper neutralization of special elements used in SQL commands, exists in ZKTeco-based OEM devices. This vulnerability allows an attacker to, in some cases, impersonate another user or perform unauthorized actions. In other instances, it enables the attacker to access user data and system parameters fr
r perform unauthorized actions. In other instances, it enables the attacker to access user data and system parameters from the database. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly other, Standalone service v. 2.1.6-20200907 and possibly others. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-005.md
CVE ID: CVE-2023-3943 State: PUBLISHED Published: 2024-05-21T13:32:47.870Z Last Updated: 2024-08-02T07:08:50.662Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: ZkTeco Products: ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 Problem Types: CWE-121 Description: Stack-based Buffer Overflow vulnerability in ZkTeco-based OEM devices allows, in some cases, the execution of arbitrary code. Due to the lack of protection mechanisms such as stack canaries and PIE, it is possible to successfully execute code even under restrictive conditions. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME an
ctive conditions. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-006.md
CVE ID: CVE-2023-3944 State: PUBLISHED Published: 2023-07-25T19:31:03.830Z Last Updated: 2024-10-15T18:47:37.561Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: phpscriptpoint Products: Lawyer Problem Types: CWE-79 Description: A vulnerability was found in phpscriptpoint Lawyer 1.6 and classified as problematic. Affected by this issue is some unknown functionality of the file page.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-235400. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichm
this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.235400 - https://vuldb.com/?ctiid.235400
CVE ID: CVE-2023-3945 State: PUBLISHED Published: 2023-07-25T21:31:03.569Z Last Updated: 2024-08-02T07:08:50.668Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: phpscriptpoint Products: Lawyer Problem Types: CWE-79 Description: A vulnerability was found in phpscriptpoint Lawyer 1.6. It has been classified as problematic. This affects an unknown part of the file search.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-235401 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References:
ly about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.235401 - https://vuldb.com/?ctiid.235401
CVE ID: CVE-2023-3946 State: PUBLISHED Published: 2023-07-26T05:10:44.967Z Last Updated: 2024-10-15T18:38:29.839Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Trellix Products: Trellix EPO Problem Types: CWE-79 Description: A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO. Additional Analyst Notes: - CVE Program Containe