Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
d to the public and may be used. VDB-221494 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.221494 - https://vuldb.com/?ctiid.221494 - https://blog.0xgabe.com/?p=71
CVE ID: CVE-2023-0919 State: PUBLISHED Published: 2023-02-19T00:00:00 Last Updated: 2024-08-02T05:24:34.781Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: kareadita Products: kareadita/kavita Problem Types: CWE-306 Description: Missing Authentication for Critical Function in GitHub repository kareadita/kavita prior to 0.7.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/3c514923-473f-4c50-ae0d-d002a41fe70f - https://github.com/Kareadita/Kavita/pull/1748/commits/6648b79e1b2f92449d5816d0722b7a3d72f259d5
CVE ID: CVE-2023-0921 State: PUBLISHED Published: 2023-06-06T00:00:00 Last Updated: 2025-01-07T21:51:37.372Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/392433 - https://hackerone.com/reports/1
A ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/392433 - https://hackerone.com/reports/1869839 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0921.json
CVE ID: CVE-2023-0922 State: PUBLISHED Published: 2023-04-03T00:00:00.000Z Last Updated: 2025-02-13T14:54:44.569Z Vendors: n/a Products: Samba Problem Types: CWE-319 Description: The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.samba.org/samba/security/CVE-2023-0922.html - https://security.netapp.com/advisory/ntap-20230406-0007/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YXBPYIA4VWNOD437NAHZ3NXKAETLFB5S/ - https://security.gentoo.
ves/list/package-announce%40lists.fedoraproject.org/message/YXBPYIA4VWNOD437NAHZ3NXKAETLFB5S/ - https://security.gentoo.org/glsa/202309-06
CVE ID: CVE-2023-0923 State: PUBLISHED Published: 2023-09-15T20:16:04.935Z Last Updated: 2024-08-02T05:24:34.705Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: RHODS-1.22-RHEL-8 Problem Types: CWE-862 Description: A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:0977 - https://access.redhat.com/security/cve/CVE-2023-0923 -
: References: - https://access.redhat.com/errata/RHSA-2023:0977 - https://access.redhat.com/security/cve/CVE-2023-0923 - https://bugzilla.redhat.com/show_bug.cgi?id=2171870
CVE ID: CVE-2023-0924 State: PUBLISHED Published: 2023-05-02T07:04:48.615Z Last Updated: 2025-01-30T15:04:14.816Z Vendors: Unknown Products: ZYREX POPUP Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The ZYREX POPUP WordPress plugin through 1.0 does not validate the type of files uploaded when creating a popup, allowing a high privileged user (such as an Administrator) to upload arbitrary files, even when modifying the file system is disallowed, such as in a multisite install. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0fd0d7a5-9263-43b6-9244-7880c3d3e6f4
CVE ID: CVE-2023-0925 State: PUBLISHED Published: 2023-09-06T17:27:05.357Z Last Updated: 2024-09-26T19:12:41.171Z Vendors: Software AG Products: webMethods OneData Problem Types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Description: Version 10.11 of webMethods OneData runs an embedded instance of Azul Zulu Java 11.0.15 which hosts a Java RMI registry (listening on TCP port 2099 by default) and two RMI interfaces (listening on a single, dynamically assigned TCP high port). Port 2099 serves as a Java Remote Method Invocation (RMI) registry which allows for remotely loading and processing data via RMI interfaces. An unauthenticated attacker with network connectivity to
ws for remotely loading and processing data via RMI interfaces. An unauthenticated attacker with network connectivity to the RMI registry and RMI interface ports can abuse this functionality to instruct the webMethods OneData application to load a malicious serialized Java object as a parameter to one of the available Java methods presented by the RMI interface. Once deserialized on the vulnerable server, the malicious code runs as whichever operating system account is used to run the software, which in most cases is the local System account on Windows. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.softwareag.com/en_corporate/platform/i
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.softwareag.com/en_corporate/platform/integration-apis/webmethods-integration.html
CVE ID: CVE-2023-0926 State: PUBLISHED Published: 2024-08-24T02:02:32.778Z Last Updated: 2024-08-26T13:22:48.949Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: sasiddiqui Products: Custom Permalinks Problem Types: CWE-79 Description: The Custom Permalinks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping on tag names. This allows authenticated users, with editor-level permissions or greater to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, even when 'unfiltered_html' has been disabled. Additi
pages that will execute whenever a user accesses an injected page, even when 'unfiltered_html' has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/97f8549a-292d-4a6d-8ec0-550467e5cf0f?source=cve - https://wordpress.org/plugins/custom-permalinks/ - https://github.com/samiahmedsiddiqui/custom-permalinks/pull/96 - https://plugins.trac.wordpress.org/changeset/3138206/custom-permalinks/trunk/admin/class-custom-permalinks-post-types-table.php - https://plugins.trac.wordpress.org/changeset/3138206/custom-permalinks/trunk/admin/class-custom-permalinks-taxonomies-table.php
CVE ID: CVE-2023-0927 State: PUBLISHED Published: 2023-02-22T19:53:57.610Z Last Updated: 2025-02-13T16:39:10.022Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Web Payments API in Google Chrome on Android prior to 110.0.5481.177 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html - https://crbug.com/1414738 - https://security.gentoo.org/glsa/202309-17
CVE ID: CVE-2023-0928 State: PUBLISHED Published: 2023-02-22T19:53:58.113Z Last Updated: 2025-02-13T16:39:10.595Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in SwiftShader in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html - https://crbug.com/1309035 - https://security.gentoo.org/glsa/202309-17
CVE ID: CVE-2023-0929 State: PUBLISHED Published: 2023-02-22T19:53:58.280Z Last Updated: 2025-02-13T16:39:11.210Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Vulkan in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html - https://crbug.com/1399742 - https://security.gentoo.org/glsa/202309-17
CVE ID: CVE-2023-0930 State: PUBLISHED Published: 2023-02-22T19:54:00.579Z Last Updated: 2025-02-13T16:39:11.785Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in Video in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html - https://crbug.com/1410766 - https://security.gentoo.org/glsa/202309-17
CVE ID: CVE-2023-0931 State: PUBLISHED Published: 2023-02-22T19:54:00.823Z Last Updated: 2025-02-13T16:39:12.383Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Video in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html - https://crbug.com/1407701 - https://security.gentoo.org/glsa/202309-17
CVE ID: CVE-2023-0932 State: PUBLISHED Published: 2023-02-22T19:54:00.984Z Last Updated: 2025-02-13T16:39:12.997Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in WebRTC in Google Chrome on Windows prior to 110.0.5481.177 allowed a remote attacker who convinced the user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html - https://crbug.com/1413005 - https://security.gentoo.org/glsa/202309-17
CVE ID: CVE-2023-0933 State: PUBLISHED Published: 2023-02-22T19:54:01.145Z Last Updated: 2025-05-05T16:07:32.745Z Vendors: Google Products: Chrome Problem Types: Integer overflow Description: Integer overflow in PDF in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html - https://crbug.com/1404864 - https://security.gentoo.org/glsa/202309-17
CVE ID: CVE-2023-0934 State: PUBLISHED Published: 2023-02-21T00:00:00.000Z Last Updated: 2025-03-12T18:07:31.380Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: answerdev Products: answerdev/answer Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/cd213098-5bab-487f-82c7-13698ad43b51 - https://github.com/answerdev/answer/commit/edc06942d51fa8e56a134c5c7e5c8826d9260da0
CVE ID: CVE-2023-0935 State: PUBLISHED Published: 2023-02-21T09:19:03.687Z Last Updated: 2025-03-12T13:34:29.443Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: DolphinPHP Problem Types: CWE-78 Description: A vulnerability was found in DolphinPHP up to 1.5.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file common.php of the component Incomplete Fix CVE-2021-46097. The manipulation of the argument id leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221551. Additional Analyst
closed to the public and may be used. The associated identifier of this vulnerability is VDB-221551. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.221551 - https://vuldb.com/?ctiid.221551 - https://github.com/ssteveez/dolphin/blob/main/README.md
CVE ID: CVE-2023-0936 State: PUBLISHED Published: 2023-02-21T09:24:29.992Z Last Updated: 2025-03-12T15:19:02.447Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: TP-Link Products: Archer C50 Problem Types: CWE-404 Description: A vulnerability was found in TP-Link Archer C50 V2_160801. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Web Management Interface. The manipulation leads to denial of service. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221552. Additional Analyst Notes: - CVE
osed to the public and may be used. The identifier of this vulnerability is VDB-221552. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.221552 - https://vuldb.com/?ctiid.221552
CVE ID: CVE-2023-0937 State: PUBLISHED Published: 2023-03-20T15:52:18.503Z Last Updated: 2025-02-25T21:17:38.359Z Vendors: Unknown Products: VK All in One Expansion Unit Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5110ff02-c721-43eb-b13e-50aca25e1162
CVE ID: CVE-2023-0938 State: PUBLISHED Published: 2023-02-21T09:30:25.360Z Last Updated: 2024-08-02T05:32:44.999Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Music Gallery Site Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Music Gallery Site 1.0. This affects an unknown part of the file music_list.php of the component GET Request Handler. The manipulation of the argument cid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221553 was assigned to this vulnerability. Additional Analyst Note
sed to the public and may be used. The identifier VDB-221553 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221553 - https://vuldb.com/?ctiid.221553 - https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Music%20Gallery%20Site%20-%20SQL%20Injection%201.md
CVE ID: CVE-2023-0939 State: PUBLISHED Published: 2023-02-23T07:28:57.972Z Last Updated: 2024-08-02T05:32:44.998Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NTN Information Technologies Products: Online Services Software Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NTN Information Technologies Online Services Software allows SQL Injection.This issue affects Online Services Software: before 1.17. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-23-0103
CVE ID: CVE-2023-0940 State: PUBLISHED Published: 2023-03-20T15:52:16.823Z Last Updated: 2025-02-26T19:05:40.403Z Vendors: Unknown Products: ProfileGrid Problem Types: CWE-863 Incorrect Authorization Description: The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Administrator ones. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/56744f72-2d48-4f42-8195-24b4dd951bb5
CVE ID: CVE-2023-0941 State: PUBLISHED Published: 2023-02-22T19:54:01.297Z Last Updated: 2025-02-13T16:39:14.156Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Prompts in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html - https://crbug.com/1415366 - https://security.gentoo.org/glsa/202309-17
CVE ID: CVE-2023-0942 State: PUBLISHED Published: 2023-02-21T19:29:16.761Z Last Updated: 2025-01-13T17:05:07.692Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: shoheitanaka Products: Japanized For WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if th
caping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bb606a30-2f7c-41e9-9ebc-9f1b0b84fff8 - https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/trunk/includes/admin/views/html-admin-setting-screen.php#L63 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2868545%40woocommerce-for-japan%2Ftrunk&old=2863064%40woocommerce-for-japan%2Ftrunk&sfp_email=&sf
ph_mail=&reponame=&new=2868545%40woocommerce-for-japan%2Ftrunk&old=2863064%40woocommerce-for-japan%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-0943 State: PUBLISHED Published: 2023-02-21T19:59:38.409Z Last Updated: 2024-08-02T05:32:45.043Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Best POS Management System Problem Types: CWE-434 Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Best POS Management System 1.0. This issue affects the function save_settings of the file index.php?page=site_settings of the component Image Handler. The manipulation of the argument img with the input ../../shell.php leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-221591.
restricted upload. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-221591. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221591 - https://vuldb.com/?ctiid.221591
CVE ID: CVE-2023-0944 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-13T19:08:43.496Z Vendors: n/a Products: Bhima Problem Types: Insecure object reference Description: Bhima version 1.27.0 allows an authenticated attacker with regular user permissions to update arbitrary user session data such as username, email and password. This is possible because the application is vulnerable to IDOR, it does not correctly validate user permissions with respect to certain actions that can be performed by the user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/stewart/ - https://github.com/IMA-Worl
ainer: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/stewart/ - https://github.com/IMA-WorldHealth/bhima/
CVE ID: CVE-2023-0945 State: PUBLISHED Published: 2023-02-21T20:01:32.411Z Last Updated: 2024-08-02T05:32:45.161Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Best POS Management System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Best POS Management System 1.0. Affected is an unknown function of the file index.php?page=add-category. The manipulation of the argument Name with the input "><img src=x onerror=prompt(document.domain);> leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-221592. Additional Analyst Notes
is possible to launch the attack remotely. The identifier of this vulnerability is VDB-221592. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221592 - https://vuldb.com/?ctiid.221592
CVE ID: CVE-2023-0946 State: PUBLISHED Published: 2023-02-21T20:05:08.412Z Last Updated: 2025-03-12T15:11:53.829Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Best POS Management System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Best POS Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file billing/index.php?id=9. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The identifier VDB-221593 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
-221593 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.221593 - https://vuldb.com/?ctiid.221593
CVE ID: CVE-2023-0947 State: PUBLISHED Published: 2023-02-22T00:00:00.000Z Last Updated: 2025-03-12T14:58:55.954Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: flatpressblog Products: flatpressblog/flatpress Problem Types: CWE-22 Description: Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/7379d702-72ff-4a5d-bc68-007290015496 - https://github.com/flatpressblog/flatpress/commit/9c4e5d6567e446c472f3adae3b2fe612f66871c7
CVE ID: CVE-2023-0948 State: PUBLISHED Published: 2023-05-08T13:58:03.613Z Last Updated: 2025-02-04T19:31:08.320Z Vendors: Unknown Products: Japanized For WooCommerce Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Japanized For WooCommerce WordPress plugin before 2.5.8 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a78d75b2-85a0-41eb-9720-c726ca2e8718