Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
or are removed from a group, thus retaining their access to Rancher instead of losing it. This issue affects Rancher: from >= 2.6.7 before < 2.6.13, from >= 2.7.0 before < 2.7.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rancher/rancher/security/advisories/GHSA-vf6j-6739-78m8 - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22648
CVE ID: CVE-2023-22649 State: PUBLISHED Published: 2024-10-16T07:46:50.610Z Last Updated: 2024-10-16T17:26:00.938Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: SUSE Products: rancher Problem Types: CWE-532 Description: A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. [Rancher Audit Logging](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log) is an opt-in feature, only deployments that have it enabled and have [AUDIT_LEVEL](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#audit-log-levels) set to `1 or above`
ermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#audit-log-levels) set to `1 or above` are impacted by this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22649 - https://github.com/rancher/rancher/security/advisories/GHSA-xfj7-qf8w-2gcr
CVE ID: CVE-2023-22650 State: PUBLISHED Published: 2024-10-16T08:20:42.467Z Last Updated: 2024-10-16T14:44:01.636Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SUSE Products: rancher Problem Types: CWE-287 Description: A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22650 - h
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22650 - https://github.com/rancher/rancher/security/advisories/GHSA-9ghh-mmcq-8phc
CVE ID: CVE-2023-22651 State: PUBLISHED Published: 2023-05-04T07:53:49.876Z Last Updated: 2025-01-29T16:49:36.675Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SUSE Products: Rancher Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. A failure in the update logic of Rancher's admission Webhook may lead to the misconfiguration of the Webhook. This component enforces validation rules and security checks before resources are admitted into the Kubernetes cluster. The issue only affects users that upgrade from 2.6.x or 2.7.x to 2.7.2. Users that did a fresh install of 2.7.2 (and did no
issue only affects users that upgrade from 2.6.x or 2.7.x to 2.7.2. Users that did a fresh install of 2.7.2 (and did not follow an upgrade path) are not affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22651 - https://github.com/rancher/rancher/security/advisories/GHSA-6m9f-pj6w-w87g
CVE ID: CVE-2023-22652 State: PUBLISHED Published: 2023-06-01T11:51:15.111Z Last Updated: 2025-05-13T00:11:54.972Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: openSUSE Products: libeconf Problem Types: CWE-120 Description: A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf leads to DoS via malformed config files. This issue affects libeconf: before 0.5.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22652 - https://https://github.com/openSUSE/libeconf/issues/177 - https://lists.fedoraproject.org/archives/li
d=CVE-2023-22652 - https://https://github.com/openSUSE/libeconf/issues/177 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SMG5256D5I3GFA3RBAJQ2WYPJDYAIL74/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SDD5GL5T3V5XZ3VFA4HPE6YGJ2K4HHPC/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAYW7X753Z6GOJKVLQPXBDHISN6ZT233/
CVE ID: CVE-2023-22653 State: PUBLISHED Published: 2023-07-06T14:53:28.255Z Last Updated: 2024-08-02T10:13:49.393Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Milesight Products: UR32L Problem Types: CWE-78 Description: An OS command injection vulnerability exists in the vtysh_ubus tcpdump_start_cb functionality of Milesight UR32L v32.3.0.5. A specially crafted HTTP request can lead to command execution. An authenticated attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1714
CVE ID: CVE-2023-22654 State: PUBLISHED Published: 2023-05-23T00:00:00 Last Updated: 2025-01-21T15:02:46.670Z Vendors: T&D Corporation and ESPEC MIC CORP. Products: T&D Corporation and ESPEC MIC CORP. data logger products Problem Types: Client-side enforcement of server-side security Description: Client-side enforcement of server-side security issue exists in T&D Corporation and ESPEC MIC CORP. data logger products, which may lead to an arbitrary script execution on a logged-in user's web browser. Affected products and versions are as follows: T&D Corporation data logger products (TR-71W/72W all firmware versions, RTR-5W all firmware versions, WDR-7 all firmware versions, WDR-3 all firmware
oducts (TR-71W/72W all firmware versions, RTR-5W all firmware versions, WDR-7 all firmware versions, WDR-3 all firmware versions, and WS-2 all firmware versions), and ESPEC MIC CORP. data logger products (RT-12N/RS-12N all firmware versions, RT-22BN all firmware versions, and TEU-12N all firmware versions). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tandd.com/news/detail.html?id=780 - https://www.monitoring.especmic.co.jp/post/VulnerabilityInRT-12N_RS-12N_RT-22BNandTEU-12N - https://jvn.jp/en/jp/JVN14778242/
CVE ID: CVE-2023-22655 State: PUBLISHED Published: 2024-03-14T16:45:46.683Z Last Updated: 2025-02-13T16:44:02.893Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N) Vendors: n/a Products: 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX Problem Types: escalation of privilege, CWE-693 Description: Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/conte
s. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html - https://security.netapp.com/advisory/ntap-20240405-0006/ - https://lists.debian.org/debian-lts-announce/2024/05/msg00003.html
CVE ID: CVE-2023-22656 State: PUBLISHED Published: 2024-05-16T20:47:41.469Z Last Updated: 2024-08-02T10:13:49.818Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: n/a Products: Intel(R) Media SDK and some Intel(R) oneVPL software Problem Types: escalation of privilege, CWE-125 Description: Out-of-bounds read in Intel(R) Media SDK and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00935.html
CVE ID: CVE-2023-22657 State: PUBLISHED Published: 2023-02-01T17:56:01.101Z Last Updated: 2025-03-26T17:49:38.336Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: F5 Products: F5OS-A, F5OS-C Problem Types: CWE-77 Description: On F5OS-A beginning in version 1.2.0 to before 1.3.0 and F5OS-C beginning in version 1.3.0 to before 1.5.0, processing F5OS tenant file names may allow for command injection. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K06345931
CVE ID: CVE-2023-22659 State: PUBLISHED Published: 2023-07-06T14:53:33.646Z Last Updated: 2024-11-14T14:39:44.254Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Milesight Products: UR32L Problem Types: CWE-77 Description: An os command injection vulnerability exists in the libzebra.so change_hostname functionality of Milesight UR32L v32.3.0.5. A specially-crafted network packets can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1699
CVE ID: CVE-2023-22660 State: PUBLISHED Published: 2023-04-05T15:18:02.497Z Last Updated: 2025-02-10T18:05:08.035Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ichitaro Products: Ichitaro Problem Types: CWE-122 Description: A heap-based buffer overflow vulnerability exists in the way Ichitaro version 2022 1.0.1.57600 processes certain LayoutBox stream record types. A specially crafted document can cause a buffer overflow, leading to memory corruption, which can result in arbitrary code execution.To trigger this vulnerability, the victim would need to open a malicious, attacker-created document. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
d need to open a malicious, attacker-created document. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1722 - https://jvn.jp/en/jp/JVN79149117/
CVE ID: CVE-2023-22661 State: PUBLISHED Published: 2023-05-10T13:17:02.969Z Last Updated: 2025-01-27T18:03:54.580Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Server Board BMC firmware Problem Types: escalation of privilege, CWE-120 Description: Buffer overflow in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00839.html
CVE ID: CVE-2023-22662 State: PUBLISHED Published: 2024-05-16T20:47:01.139Z Last Updated: 2024-08-02T10:13:50.092Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:H) Vendors: n/a Products: UEFI firmware for some Intel(R) Server Board S2600BP products Problem Types: denial of service, CWE-20 Description: Improper input validation of EpsdSrMgmtConfig in UEFI firmware for some Intel(R) Server Board S2600BP products may allow a privileged user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01080.html
CVE ID: CVE-2023-22663 State: PUBLISHED Published: 2023-11-14T19:04:30.019Z Last Updated: 2024-08-30T18:28:32.424Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: n/a Products: Intel Unison software Problem Types: escalation of privilege, CWE-287 Description: Improper authentication for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00963.html
CVE ID: CVE-2023-22664 State: PUBLISHED Published: 2023-02-01T17:56:15.585Z Last Updated: 2025-03-26T17:48:59.560Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP, BIG-IP SPK Problem Types: CWE-400 Description: On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: - CISA
ave reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K56676554
CVE ID: CVE-2023-22665 State: PUBLISHED Published: 2023-04-25T06:44:21.516Z Last Updated: 2025-02-13T16:44:03.940Z Vendors: Apache Software Foundation Products: Apache Jena Problem Types: CWE-917 Description: There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/s0dmpsxcwqs57l4qfs415klkgmhdxq7s - http://www.openwall.com/lists/oss-security/2023/07/11/11
CVE ID: CVE-2023-22666 State: PUBLISHED Published: 2023-08-08T09:15:00.281Z Last Updated: 2024-08-02T10:13:49.428Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-190 Description: Memory Corruption in Audio while playing amrwbplus clips with modified content. Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/august-2023-bulletin
CVE ID: CVE-2023-22667 State: PUBLISHED Published: 2023-07-04T04:46:41.414Z Last Updated: 2024-10-24T19:11:39.267Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-190 Description: Memory Corruption in Audio while allocating the ion buffer during the music playback. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin
CVE ID: CVE-2023-22668 State: PUBLISHED Published: 2023-12-05T03:03:45.703Z Last Updated: 2024-08-02T10:13:49.804Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory Corruption in Audio while invoking IOCTLs calls from the user-space. Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE ID: CVE-2023-22669 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-05-05T16:05:58.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: Parsing of DWG files in Open Design Alliance Drawings SDK before 2023.6 lacks proper validation of the length of user-supplied XRecord data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.opendesign.com/security-advisories
CVE ID: CVE-2023-22670 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-05-05T16:05:49.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-based buffer overflow exists in the DXF file reading procedure in Open Design Alliance Drawings SDK before 2023.6. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of the length of user-supplied XRecord data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
xt of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.opendesign.com/security-advisories
CVE ID: CVE-2023-22671 State: PUBLISHED Published: 2023-01-06T00:00:00.000Z Last Updated: 2025-04-07T18:14:21.741Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injection when calling analyzeHeadless with untrusted input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/NationalSecurityAgency/ghidra/issues/4869 - https://github.com/NationalSecurityAgency/ghidra/pull/4872
CVE ID: CVE-2023-22672 State: PUBLISHED Published: 2023-07-17T10:40:13.860Z Last Updated: 2024-10-07T15:11:09.492Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Mr.Vibe Products: vSlider Multi Image Slider for WordPress Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Mr.Vibe vSlider Multi Image Slider for WordPress plugin <= 4.1.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/vslider/wordpress-vslider-multi-image-slider-for-wordpress-plugin-4-1-2-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2023-22673 State: PUBLISHED Published: 2023-07-10T11:40:27.905Z Last Updated: 2024-10-17T20:52:34.172Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: MageNet Products: Website Monetization by MageNet Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in MageNet Website Monetization by MageNet plugin <= 1.0.29.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/website-monetization-by-magenet/wordpress-website-monetization-by-magenet-plugin-1-0-29-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-22674 State: PUBLISHED Published: 2023-12-21T14:18:07.462Z Last Updated: 2024-09-13T14:57:45.394Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Hal Gatewood Products: Dashicons + Custom Post Types Problem Types: CWE-862, CWE-352 Description: Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Hal Gatewood Dashicons + Custom Post Types.This issue affects Dashicons + Custom Post Types: from n/a through 1.0.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/dashicons-cpt/wordpress-dashicons-custom-post-types-plugin-1-0-2-broken-access
s://patchstack.com/database/vulnerability/dashicons-cpt/wordpress-dashicons-custom-post-types-plugin-1-0-2-broken-access-control?_s_id=cve
CVE ID: CVE-2023-22676 State: PUBLISHED Published: 2023-12-29T08:25:01.932Z Last Updated: 2024-08-02T10:13:50.088Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Anders Thorborg Products: Anders Thorborg Problem Types: CWE-862 Description: Missing Authorization vulnerability in Anders Thorborg.This issue affects Anders Thorborg: from n/a through 1.4.12. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/acf-image-crop-add-on/wordpress-advanced-custom-fields-image-crop-add-on-plugin-1-4-12-broken-access-control?_s_id=cve
CVE ID: CVE-2023-22677 State: PUBLISHED Published: 2023-12-29T08:50:56.723Z Last Updated: 2024-08-02T10:13:49.879Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: BinaryStash Products: WP Booklet Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in BinaryStash WP Booklet.This issue affects WP Booklet: from n/a through 2.1.8. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-booklet/wordpress-wp-booklet-plugin-2-1-8-remote-code-execution-rce?_s_id=cve
CVE ID: CVE-2023-22678 State: PUBLISHED Published: 2023-03-20T11:05:22.998Z Last Updated: 2025-01-10T19:19:44.078Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Rafael Dery Products: Superior FAQ Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Rafael Dery Superior FAQ plugin <= 1.0.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/superior-faq/wordpress-superior-faq-plugin-1-0-2-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2023-22679 State: PUBLISHED Published: 2023-03-20T11:31:57.524Z Last Updated: 2025-02-19T21:40:23.179Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Nicolas Lemoine Products: WP Better Emails Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nicolas Lemoine WP Better Emails plugin <= 0.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-better-emails/wordpress-wp-better-emails-plugin-0-4-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-22680 State: PUBLISHED Published: 2023-03-20T11:36:57.328Z Last Updated: 2025-01-10T19:19:16.264Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Altanic Products: No API Amazon Affiliate Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Altanic No API Amazon Affiliate plugin <= 4.2.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/no-api-amazon-affiliate/wordpress-no-api-amazon-affiliate-plugin-4-2-2-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-22681 State: PUBLISHED Published: 2023-03-20T10:56:57.766Z Last Updated: 2025-01-10T19:19:53.839Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Aarvanshinfotech Products: Online Exam Software : eExamhall Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Aarvanshinfotech Online Exam Software: eExamhall plugin <= 4.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/eexamhall/wordpress-online-exam-software-eexamhall-plugin-4-0-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2023-22682 State: PUBLISHED Published: 2023-03-20T11:44:10.411Z Last Updated: 2024-08-02T13:45:37.043Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Manuel Masia | Pixedelic.com Products: Camera slideshow Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) vulnerability in Manuel Masia | Pixedelic.Com Camera slideshow plugin <= 1.4.0.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/camera-slideshow/wordpress-camera-slideshow-plugin-1-4-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve