Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
s/chamilo-18/wiki/security_issues#Issue-129-2023-09-04-Critical-impact-Moderate-risk-Authenticated-users-may-gain-unauthenticated-RCE-CVE-2023-4223CVE-2023-4224CVE-2023-4225CVE-2023-4226 - https://starlabs.sg/advisories/23/23-4225 - https://github.com/chamilo/chamilo-lms/commit/6f32625a012d5de2dfe8edbccb4ed14a85e310d4 - https://github.com/chamilo/chamilo-lms/commit/f3d62b65ad60d68096c2674d5695339f04de0b8a - https://github.com/chamilo/chamilo-lms/commit/e864127a440c2cab0eb62c113a04e2e904543a1f
CVE ID: CVE-2023-4226 State: PUBLISHED Published: 2023-11-28T07:21:40.906Z Last Updated: 2024-08-02T07:17:12.285Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Chamilo Products: Chamilo Problem Types: CWE-434 Description: Unrestricted file upload in `/main/inc/ajax/work.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files. Additional Analyst Notes: - CVE Program Container: References: - https://support.chamilo.org/projects/chamilo-18/wiki/security_issues#Issue-129-2023-09-04-Critical-impact-Moderate-risk-Authenticated-users-may-gain-unauthenticated-RCE-CVE-2023-4223CV
sues#Issue-129-2023-09-04-Critical-impact-Moderate-risk-Authenticated-users-may-gain-unauthenticated-RCE-CVE-2023-4223CVE-2023-4224CVE-2023-4225CVE-2023-4226 - https://starlabs.sg/advisories/23/23-4226 - https://github.com/chamilo/chamilo-lms/commit/6f32625a012d5de2dfe8edbccb4ed14a85e310d4 - https://github.com/chamilo/chamilo-lms/commit/f3d62b65ad60d68096c2674d5695339f04de0b8a - https://github.com/chamilo/chamilo-lms/commit/e864127a440c2cab0eb62c113a04e2e904543a1f
CVE ID: CVE-2023-4227 State: PUBLISHED Published: 2023-08-24T05:07:57.783Z Last Updated: 2024-10-28T06:10:40.977Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Moxa Products: ioLogik 4000 Series Problem Types: CWE-489 Description: A vulnerability has been identified in the ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which can be exploited by malicious actors to potentially gain unauthorized access to the product. This could lead to security breaches, data theft, and unauthorized manipulation of sensitive information. The vulnerability is attributed to the presence of an unauthorized service, which could potentially enable unauthor
ion. The vulnerability is attributed to the presence of an unauthorized service, which could potentially enable unauthorized access to the. device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230310-iologik-4000-series-multiple-web-server-vulnerabilities-and-improper-access-control-vulnerability
CVE ID: CVE-2023-4228 State: PUBLISHED Published: 2023-08-24T06:19:40.559Z Last Updated: 2024-10-01T16:16:32.729Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Moxa Products: ioLogik 4000 Series Problem Types: CWE-1004 Description: A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/s
ion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230310-iologik-4000-series-multiple-web-server-vulnerabilities-and-improper-access-control-vulnerability
CVE ID: CVE-2023-4229 State: PUBLISHED Published: 2023-08-24T06:33:44.358Z Last Updated: 2024-10-01T16:14:10.135Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Moxa Products: ioLogik 4000 Series Problem Types: CWE-1021 Description: A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, potentially exposing users to security risks. This vulnerability may allow attackers to trick users into interacting with malicious content, leading to unintended actions or unauthorized data disclosures. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/supp
. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230310-iologik-4000-series-multiple-web-server-vulnerabilities-and-improper-access-control-vulnerability
CVE ID: CVE-2023-4230 State: PUBLISHED Published: 2023-08-24T06:43:01.398Z Last Updated: 2024-10-02T20:39:03.784Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Moxa Products: ioLogik 4000 Series Problem Types: CWE-200 Description: A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which has the potential to facilitate the collection of information on ioLogik 4000 Series devices. This vulnerability may enable attackers to gather information for the purpose of assessing vulnerabilities and potential attack vectors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
es and potential attack vectors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230310-iologik-4000-series-multiple-web-server-vulnerabilities-and-improper-access-control-vulnerability
CVE ID: CVE-2023-4231 State: PUBLISHED Published: 2023-09-15T07:53:25.341Z Last Updated: 2024-09-25T15:21:04.256Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Cevik Informatics Products: Online Payment System Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cevik Informatics Online Payment System allows SQL Injection.This issue affects Online Payment System: before 4.09. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0532
CVE ID: CVE-2023-4232 State: PUBLISHED Published: 2024-04-17T22:49:12.892Z Last Updated: 2025-11-04T18:16:54.347Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a, Fedora Products: ofono, Fedora Problem Types: CWE-119 Description: A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_status_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for this memcpy length in decode_submit(), but it was forgotten in decode_status_report(). Additional Analyst Notes: - CISA ADP V
memcpy length in decode_submit(), but it was forgotten in decode_status_report(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2255394
CVE ID: CVE-2023-4233 State: PUBLISHED Published: 2024-04-17T22:50:49.698Z Last Updated: 2025-11-04T18:16:56.833Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a, Fedora Products: ofono, Fedora Problem Types: CWE-119 Description: A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the sms_decode_address_field() function during the SMS PDU decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2255396
CVE ID: CVE-2023-4234 State: PUBLISHED Published: 2024-04-17T22:53:32.562Z Last Updated: 2025-11-04T18:16:59.241Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a, Fedora Products: ofono, Fedora Problem Types: CWE-119 Description: A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_submit_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for this memcpy length in decode_submit(), but it was forgotten in decode_submit_report(). Additional Analyst Notes: - CISA ADP V
memcpy length in decode_submit(), but it was forgotten in decode_submit_report(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2255399
CVE ID: CVE-2023-4235 State: PUBLISHED Published: 2024-04-17T22:54:27.254Z Last Updated: 2025-11-04T18:17:00.416Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a, Fedora Products: ofono, Fedora Problem Types: CWE-119 Description: A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_deliver_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for this memcpy length in decode_submit(), but it was forgotten in decode_deliver_report(). Additional Analyst Notes: - CISA ADP
memcpy length in decode_submit(), but it was forgotten in decode_deliver_report(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2255402
CVE ID: CVE-2023-4236 State: PUBLISHED Published: 2023-09-20T12:32:16.631Z Last Updated: 2025-02-13T17:09:18.327Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND 9 Description: A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal data structures are incorrectly reused under significant DNS-over-TLS query load. This issue affects BIND 9 versions 9.18.0 through 9.18.18 and 9.18.11-S1 through 9.18.18-S1. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2023-4236 - http://www.openwall.com/lists/os
t Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2023-4236 - http://www.openwall.com/lists/oss-security/2023/09/20/2 - https://www.debian.org/security/2023/dsa-5504 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPJLLTJCSDJJII7IIZPLTBQNWP7MZH7F/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U35OARLQCPMVCBBPHWBXY5M6XJLD2TZ5/ - https://security.netapp.com/advisory/ntap-20231013-0004/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSK5V4W4OHPM3JTJGWAQD6CZW7SFD75B/
CVE ID: CVE-2023-4237 State: PUBLISHED Published: 2023-10-04T14:23:20.710Z Last Updated: 2025-11-20T18:27:25.235Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9 Problem Types: CWE-497 Description: A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability. Additional Analyst Notes: - CVE Program Contain
compromising the system's confidentiality, integrity, and availability. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHBA-2023:5653 - https://access.redhat.com/errata/RHBA-2023:5666 - https://access.redhat.com/security/cve/CVE-2023-4237 - https://bugzilla.redhat.com/show_bug.cgi?id=2229979
CVE ID: CVE-2023-4238 State: PUBLISHED Published: 2023-09-25T15:56:52.815Z Last Updated: 2025-04-22T20:03:49.212Z Vendors: Unknown Products: Prevent files / folders access Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Prevent files / folders access WordPress plugin before 2.5.2 does not validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/53816136-4b1a-4b7d-b73b-08a90c2a638f
CVE ID: CVE-2023-4239 State: PUBLISHED Published: 2023-08-09T02:04:02.327Z Last Updated: 2025-02-05T19:37:12.704Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: rameez_iqbal Products: Real Estate Manager – Property Listing and Agent Management Problem Types: CWE-269 Improper Privilege Management Description: The Real Estate Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7.1 due to insufficient restriction on the 'rem_save_profile_front' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities'
attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d83d1fd0-6e21-406e-a7c0-89d26eabbb32?source=cve - https://plugins.trac.wordpress.org/browser/real-estate-manager/tags/6.7.1/classes/shortcodes.class.php#L1439
CVE ID: CVE-2023-4241 State: PUBLISHED Published: 2023-08-16T10:13:12.564Z Last Updated: 2024-10-02T16:12:50.008Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Cloudflare Products: lol-html Problem Types: CWE-20 Description: lol-html can cause panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cloudflare/lol-html/security/advisories/GHSA-c3x7-354f-4p2x
CVE ID: CVE-2023-4242 State: PUBLISHED Published: 2023-08-09T03:36:14.224Z Last Updated: 2025-02-05T19:36:52.211Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: fullservices Products: FULL – Customer Problem Types: CWE-287 Improper Authentication Description: The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to obtain sensitive information about the site configuration as disclosed by the WordPress health check. Additional Analyst Notes: - CVE Program C
ation about the site configuration as disclosed by the WordPress health check. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a77d0fb5-8829-407d-a40a-169cf0c5f837?source=cve - https://plugins.trac.wordpress.org/browser/full-customer/tags/1.1.0/app/api/Health.php
CVE ID: CVE-2023-4243 State: PUBLISHED Published: 2023-08-09T03:36:13.639Z Last Updated: 2025-02-05T19:37:01.446Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: fullservices Products: FULL – Customer Problem Types: CWE-285 Improper Authorization Description: The FULL - Customer plugin for WordPress is vulnerable to Arbitrary File Upload via the /install-plugin REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to execute code by installing plugins from arbitrary remote locations including non-repository sources onto the site, granted they are package
talling plugins from arbitrary remote locations including non-repository sources onto the site, granted they are packaged as a valid WordPress plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9799df3f-e34e-42a7-8a72-fa57682f7014?source=cve - https://plugins.trac.wordpress.org/browser/full-customer/tags/1.1.0/app/api/Plugin.php - https://plugins.trac.wordpress.org/browser/full-customer/tags/2.2.1/app/api/PluginInstallation.php
CVE ID: CVE-2023-4244 State: PUBLISHED Published: 2023-09-06T13:53:24.873Z Last Updated: 2025-02-13T17:09:20.006Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Kernel Problem Types: CWE-416 Description: A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Due to a race condition between nf_tables netlink control plane transaction and nft_set element garbage collection, it is possible to underflow the reference counter causing a use-after-free vulnerability. We recommend upgrading past commit 3e91b0ebd994635df2346353322ac51ce84ce6d8. Additional Analyst Notes
ree vulnerability. We recommend upgrading past commit 3e91b0ebd994635df2346353322ac51ce84ce6d8. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e91b0ebd994635df2346353322ac51ce84ce6d8 - https://kernel.dance/3e91b0ebd994635df2346353322ac51ce84ce6d8 - https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html - https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
CVE ID: CVE-2023-4245 State: PUBLISHED Published: 2023-08-31T05:33:04.205Z Last Updated: 2025-02-05T19:34:18.818Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: edgarrojas Products: WooCommerce PDF Invoice Builder, Create invoices, packing slips and more Problem Types: CWE-862 Missing Authorization Description: The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to, and including, 1.2.89. This makes it possible for subscribers to view arbitrary invoices provided they can guess the order id and invoice id. Additional Analyst Notes: - C
ubscribers to view arbitrary invoices provided they can guess the order id and invoice id. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/200fbfc1-df21-43b0-8eb1-b2ba0cc0c0df?source=cve - https://plugins.trac.wordpress.org/browser/woo-pdf-invoice-builder/trunk/woocommerce-pdf-invoice-ajax.php#L425 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2955112%40woo-pdf-invoice-builder%2Ftrunk&old=2953379%40woo-pdf-invoice-builder%2Ftrunk&sfp_email=&sfph_mail=#file1
CVE ID: CVE-2023-4246 State: PUBLISHED Published: 2024-01-11T08:33:03.312Z Last Updated: 2025-06-11T15:38:01.504Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: webdevmattcrom Products: GiveWP – Donation Plugin and Fundraising Platform Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_sendwp_remote_install_handler function. This makes it possible for unauthenticated attackers to install and activate the SendWP plugin via a forged request granted they can tri
ssible for unauthenticated attackers to install and activate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dc5c511f-dc79-468b-a107-cdf50999faf8?source=cve - https://plugins.trac.wordpress.org/browser/give/trunk/includes/admin/misc-functions.php?rev=2772225#L258 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2974851%40give%2Ftrunk&old=2973080%40give%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-4247 State: PUBLISHED Published: 2024-01-11T08:33:05.017Z Last Updated: 2024-11-06T18:31:14.588Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: webdevmattcrom Products: GiveWP – Donation Plugin and Fundraising Platform Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_sendwp_disconnect function. This makes it possible for unauthenticated attackers to deactivate the SendWP plugin via a forged request granted they can trick a site administrato
nauthenticated attackers to deactivate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e32d9104-5a39-4455-b76a-e24ae787bdfd?source=cve - https://plugins.trac.wordpress.org/browser/give/trunk/includes/admin/misc-functions.php?rev=2772225#L333 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2974851%40give%2Ftrunk&old=2973080%40give%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-4248 State: PUBLISHED Published: 2024-01-11T08:32:30.451Z Last Updated: 2025-06-03T14:10:10.270Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: webdevmattcrom Products: GiveWP – Donation Plugin and Fundraising Platform Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_stripe_disconnect_connect_stripe_account function. This makes it possible for unauthenticated attackers to deactivate the plugin's stripe integration settings via a forged requ
makes it possible for unauthenticated attackers to deactivate the plugin's stripe integration settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2bff8dea-6971-47d4-bd2c-0821687033e5?source=cve - https://plugins.trac.wordpress.org/browser/give/trunk/includes/gateways/stripe/includes/admin/admin-actions.php?rev=2585755#L361 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2974851%40give%2Ftrunk&old=2973080%40give%2Ftrunk&sfp_email=&sfph_ma
s.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2974851%40give%2Ftrunk&old=2973080%40give%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-4249 State: PUBLISHED Published: 2023-11-08T22:51:25.143Z Last Updated: 2025-01-16T21:26:29.040Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Zavio Products: IP Camera CF7500, IP Camera CF7300, IP Camera CF7201, IP Camera CF7501, IP Camera CB3211, IP Camera CB3212, IP Camera CB5220, IP Camera CB6231, IP Camera B8520, IP Camera B8220, IP Camera CD321 Problem Types: CWE-121 Description: Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 has a command injection vulnerability in their implementation of their binaries and handling of network requests. Additiona