Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-39061 State: PUBLISHED Published: 2023-08-21T00:00:00 Last Updated: 2024-10-10T13:46:25.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability in Chamilo v.1.11 thru v.1.11.20 allows a remote authenticated privileged attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://chamilo.com - https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-123-2023-07-08-Moderate-impact-Moderate-risk-CSRF-through-admin-account-forum-posts
CVE ID: CVE-2023-39062 State: PUBLISHED Published: 2023-08-28T00:00:00 Last Updated: 2024-10-02T16:27:35.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Spipu HTML2PDF before v.5.2.8 allows a remote attacker to execute arbitrary code via a crafted script to the forms.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/spipu/html2pdf/blob/92afd81823d62ad95eb9d034858311bb63aeb4ac/CHANGELOG.md - https://github.com/afine-com/CVE-2023-39062 - https://github.com/sectroyer/CVEs/tree/main/CVE-2023-39062
CVE ID: CVE-2023-39063 State: PUBLISHED Published: 2023-09-11T00:00:00 Last Updated: 2024-09-26T19:02:40.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in RaidenFTPD 2.4.4005 allows a local attacker to execute arbitrary code via the Server name field of the Step by step setup wizard. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/AndreGNogueira/CVE-2023-39063
CVE ID: CVE-2023-39067 State: PUBLISHED Published: 2023-09-11T00:00:00 Last Updated: 2024-09-26T17:42:41.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in ZLMediaKiet v.4.0 and v.5.0 allows an attacker to execute arbitrary code via a crafted script to the URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Yao-ruo/CVE-ZLMediaKit/blob/main/README.md - https://github.com/Yao-ruo/CVE-FIND/blob/main/CVE-2023-39067
CVE ID: CVE-2023-39068 State: PUBLISHED Published: 2023-09-11T00:00:00 Last Updated: 2024-09-26T15:51:27.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in NBD80S09S-KLC v.YK_HZXM_NBD80S09S-KLC_V4.03.R11.7601.Nat.OnvifC.20230414.bin and NBD80N32RA-KL-V3 v.YK_HZXM_NBD80N32RA-KL_V4.03.R11.7601.Nat.OnvifC.20220120.bin allows a remote attacker to casue a denial of service via a crafted request to the service.XM component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.xiongmaitech.com/en/index.php/service/notice_info/51/3
CVE ID: CVE-2023-39069 State: PUBLISHED Published: 2023-09-11T00:00:00 Last Updated: 2024-09-26T15:33:32.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/StrangeBeeCorp/Security/blob/main/Security%20advisories/SB-SEC-ADV-2022-001%3A%20Authentication%20bypass%20due%20to%20incomplete%20checks%20in%20the%20Active%20Directory%20authentication%20module.md
CVE ID: CVE-2023-39070 State: PUBLISHED Published: 2023-09-11T00:00:00 Last Updated: 2024-09-26T15:32:18.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Cppcheck 2.12 dev allows a local attacker to execute arbitrary code via the removeContradiction parameter in token.cpp:1934. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceforge.net/p/cppcheck/discussion/general/thread/fa43fb8ab1/
CVE ID: CVE-2023-39073 State: PUBLISHED Published: 2023-09-12T00:00:00 Last Updated: 2024-09-26T16:10:46.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in SNMP Web Pro v.1.1 allows a remote attacker to execute arbitrary code and obtain senstive information via a crafted request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/ph4nt0mbyt3/9456312e867c10de8f808250ec0b12d3
CVE ID: CVE-2023-39075 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-08-02T18:02:05.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: Renault Zoe EV 2021 automotive infotainment system versions 283C35202R to 283C35519R (builds 11.10.2021 to 16.01.2023) allows attackers to crash the infotainment system by sending arbitrary USB data via a USB device. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jhyeon.dev/posts/vuln/202307/renault-zoe/ - https://nvd.nist.gov/vuln/detail/CVE-2023-39075 - https://blog.dhjeong.kr/posts/vuln/202307/renault-zoe/ - https://blog.dhjeong.kr/posts/automotive/2023/12/how-to-fuzzing-realcars/
CVE ID: CVE-2023-39076 State: PUBLISHED Published: 2023-09-08T00:00:00 Last Updated: 2024-09-26T18:05:14.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: Injecting random data into the USB memory area on a General Motors (GM) Chevrolet Equinox 2021 Software. 2021.03.26 (build version) vehicle causes a Denial of Service (DoS) in the in-car infotainment system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.jhyeon.dev/posts/vuln/202307/gm-chevrolet/ - https://blog.dhjeong.kr/posts/vuln/202307/gm-chevrolet/ - https://nvd.nist.gov/vuln/detail/CVE-2023-39076
CVE ID: CVE-2023-39086 State: PUBLISHED Published: 2023-08-08T00:00:00 Last Updated: 2024-10-10T20:00:11.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASUS RT-AC66U B1 3.0.0.4.286_51665 was discovered to transmit sensitive information in cleartext. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://asus.com - http://na.com - http://121.41.98.87/2023/08/04/info/
CVE ID: CVE-2023-39094 State: PUBLISHED Published: 2023-08-21T00:00:00 Last Updated: 2024-10-07T17:02:14.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in ZeroWdd studentmanager v.1.0 allows a remote attacker to execute arbitrary code via the username parameter in the student list function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ZeroWdd/studentmanager/issues/12
CVE ID: CVE-2023-39096 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-18T13:53:30.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebBoss.io CMS v3.7.0.1 contains a stored Cross-Site Scripting (XSS) vulnerability due to lack of input validation and output encoding. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.realinfosec.net/advisories/WEBBOSS-P-XSS-2023-0xt2tt.html
CVE ID: CVE-2023-39097 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T15:25:18.704Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebBoss.io CMS v3.7.0.1 contains a stored cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://realinfosec.net/advisories/WEBBOSS-P-XSS-2023-0xf8gi.html
CVE ID: CVE-2023-39106 State: PUBLISHED Published: 2023-08-21T00:00:00 Last Updated: 2024-10-07T15:34:18.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor() component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nacos-group/nacos-spring-project/issues/314
CVE ID: CVE-2023-39107 State: PUBLISHED Published: 2023-08-04T00:00:00 Last Updated: 2024-10-17T15:09:24.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows attackers to overwrite root-owned files by using hardlinks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.nomachine.com/TR07U10948 - https://kb.nomachine.com/SU07U00247 - https://www.ns-echo.com/posts/nomachine_afo.html
CVE ID: CVE-2023-39108 State: PUBLISHED Published: 2023-08-01T00:00:00 Last Updated: 2024-10-17T19:01:48.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zer0yu/CVE_Request/blob/master/rConfig/rConfig_path_b.md
CVE ID: CVE-2023-39109 State: PUBLISHED Published: 2023-08-01T00:00:00 Last Updated: 2024-10-17T19:01:17.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zer0yu/CVE_Request/blob/master/rConfig/rConfig_path_a.md
CVE ID: CVE-2023-39110 State: PUBLISHED Published: 2023-08-01T00:00:00 Last Updated: 2024-10-17T19:00:42.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zer0yu/CVE_Request/blob/master/rConfig/rConfig_%20ajaxGetFileByPath.md
CVE ID: CVE-2023-39112 State: PUBLISHED Published: 2023-08-04T00:00:00 Last Updated: 2024-10-17T15:05:11.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Luci4n555/vul_report/blob/master/vul_1.md - https://vuldb.com/zh/?id.236164
CVE ID: CVE-2023-39113 State: PUBLISHED Published: 2023-08-02T00:00:00 Last Updated: 2024-10-17T20:12:13.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: ngiflib commit fb271 was discovered to contain a segmentation violation via the function "main" at gif2tag.c. This vulnerability is triggered when running the program gif2tga. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/miniupnp/ngiflib/issues/27
CVE ID: CVE-2023-39114 State: PUBLISHED Published: 2023-08-02T00:00:00 Last Updated: 2024-10-17T20:09:23.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: ngiflib commit 84a75 was discovered to contain a segmentation violation via the function SDL_LoadAnimatedGif at ngiflibSDL.c. This vulnerability is triggered when running the program SDLaffgif. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/miniupnp/ngiflib/issues/29
CVE ID: CVE-2023-39115 State: PUBLISHED Published: 2023-08-16T00:00:00 Last Updated: 2024-10-08T20:00:39.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: install/aiz-uploader/upload in Campcodes Online Matrimonial Website System Script 3.3 allows XSS via a crafted SVG document. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.campcodes.com/projects/php/online-matrimonial-website-system-script-in-php/ - http://packetstormsecurity.com/files/173950/Campcodes-Online-Matrimonial-Website-System-3.3-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/51656 - https://github.com/Raj789-sec/CVE-2023-39115
CVE ID: CVE-2023-39121 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T15:23:38.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: emlog v2.1.9 was discovered to contain a SQL injection vulnerability via the component /admin/user.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/safe-b/CVE/issues/1#issue-1817133689 - https://github.com/safe-b/CVE/issues/1
CVE ID: CVE-2023-39122 State: PUBLISHED Published: 2023-07-31T00:00:00 Last Updated: 2024-10-22T15:35:35.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 (and is also fixed by a patch for 9.0.20.200). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/DojoSecurity/BMC-Control-M-Unauthenticated-SQL-Injection
CVE ID: CVE-2023-39125 State: PUBLISHED Published: 2023-08-17T00:00:00 Last Updated: 2024-10-08T14:35:11.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: NTSC-CRT 2.2.1 has an integer overflow and out-of-bounds write in loadBMP in bmp_rw.c because a file's width, height, and BPP are not validated. NOTE: the vendor's perspective is "this main application was not intended to be a well tested program, it's just something to demonstrate it works and for the user to see how to integrate it into their own programs." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LMP88959/NTSC-CRT/issues/32
CVE ID: CVE-2023-39128 State: PUBLISHED Published: 2023-07-25T00:00:00 Last Updated: 2024-10-24T14:12:09.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a stack overflow via the function ada_decode at /gdb/ada-lang.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=30639
CVE ID: CVE-2023-39129 State: PUBLISHED Published: 2023-07-25T00:00:00 Last Updated: 2024-10-24T14:10:49.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap use after free via the function add_pe_exported_sym() at /gdb/coff-pe-read.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=30640
CVE ID: CVE-2023-39130 State: PUBLISHED Published: 2023-07-25T00:00:00 Last Updated: 2024-10-24T14:11:30.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap buffer overflow via the function pe_as16() at /gdb/coff-pe-read.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=30641
CVE ID: CVE-2023-39135 State: PUBLISHED Published: 2023-08-30T00:00:00 Last Updated: 2024-10-01T20:23:46.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Zip Swift v2.1.2 allows attackers to execute a path traversal attack via a crafted zip entry. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/marmelroy/Zip/issues/245 - https://security.snyk.io/research/zip-slip-vulnerability - https://blog.ostorlab.co/zip-packages-exploitation.html - https://ostorlab.co/vulndb/advisory/OVE-2023-1
CVE ID: CVE-2023-39136 State: PUBLISHED Published: 2023-08-30T00:00:00 Last Updated: 2024-10-01T20:21:27.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unhandled edge case in the component _sanitizedPath of ZipArchive v2.5.4 allows attackers to cause a Denial of Service (DoS) via a crafted zip file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/research/zip-slip-vulnerability - https://github.com/ZipArchive/ZipArchive/issues/680 - https://blog.ostorlab.co/zip-packages-exploitation.html - https://ostorlab.co/vulndb/advisory/OVE-2023-2
CVE ID: CVE-2023-39137 State: PUBLISHED Published: 2023-08-30T00:00:00 Last Updated: 2024-10-01T20:18:40.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/brendan-duncan/archive/issues/266 - https://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_name_spoofing/ - https://blog.ostorlab.co/zip-packages-exploitation.html - https://ostorlab.co/vulndb/advisory/OVE-2023-3
CVE ID: CVE-2023-39138 State: PUBLISHED Published: 2023-08-30T00:00:00 Last Updated: 2024-10-02T13:55:21.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/weichsel/ZIPFoundation/issues/282 - https://blog.ostorlab.co/zip-packages-exploitation.html - https://ostorlab.co/vulndb/advisory/OVE-2023-4 - https://ostorlab.co/vulndb/advisory/OVE-2023-6
CVE ID: CVE-2023-39139 State: PUBLISHED Published: 2023-08-30T00:00:00 Last Updated: 2024-10-01T20:16:51.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/brendan-duncan/archive/issues/265 - https://ostorlab.co/vulndb/advisory/OVE-2023-5 - https://blog.ostorlab.co/zip-packages-exploitation.html
CVE ID: CVE-2023-39141 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-03T17:55:26.258Z Vendors: n/a Products: n/a Problem Types: n/a Description: webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ziahamza/webui-aria2/blob/109903f0e2774cf948698cd95a01f77f33d7dd2c/node-server.js#L10 - https://gist.github.com/JafarAkhondali/528fe6c548b78f454911fb866b23f66e
CVE ID: CVE-2023-39143 State: PUBLISHED Published: 2023-08-04T00:00:00.000Z Last Updated: 2025-05-05T15:56:10.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled (a very common configuration). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.horizon3.ai/cve-2023-39143-papercut-path-traversal-file-upload-rce-vulnerability/ - https://www.papercut.com/kb/Main/securitybulletinjuly2023/
CVE ID: CVE-2023-39144 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T15:20:12.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: Element55 KnowMore appliances version 21 and older was discovered to store passwords in plaintext. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://getknowmore.com/ - https://github.com/cduram/CVE-2023-39144
CVE ID: CVE-2023-39147 State: PUBLISHED Published: 2023-08-01T00:00:00.000Z Last Updated: 2025-02-13T17:02:38.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.google.com/document/d/1uv9DjHmKuDxZIjNhWX05EsxHEp8fGalXB7XK-QSyr_0/edit?usp=sharing - http://packetstormsecurity.com/files/173878/Uvdesk-1.1.3-Shell-Upload.html
CVE ID: CVE-2023-39150 State: PUBLISHED Published: 2023-09-12T00:00:00 Last Updated: 2024-09-26T15:54:08.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: ConEmu before commit 230724 does not sanitize title responses correctly for control characters, potentially leading to arbitrary code execution. This is related to an incomplete fix for CVE-2022-46387. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Maximus5/ConEmu/commit/60683a186628ffaa7689fcb64b3c38ced69287c1 - https://gist.github.com/dgl/081cf503dc635df39d844e058a6d4c88
CVE ID: CVE-2023-39151 State: PUBLISHED Published: 2023-07-26T13:54:52.297Z Last Updated: 2024-10-21T21:09:19.899Z Vendors: Jenkins Project Products: Jenkins Description: Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-26/#SECURITY-3188 - http://www.openwall.com/lists/oss-security/2023/07/26/2
CVE ID: CVE-2023-39152 State: PUBLISHED Published: 2023-07-26T13:54:52.912Z Last Updated: 2024-10-23T14:47:45.606Z Vendors: Jenkins Project Products: Jenkins Gradle Plugin Description: Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the build log in some circumstances. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-26/#SECURITY-3208 - http://www.openwall.com/lists/oss-security/2023/07/26/2
CVE ID: CVE-2023-39153 State: PUBLISHED Published: 2023-07-26T13:54:53.558Z Last Updated: 2024-10-23T14:47:07.364Z Vendors: Jenkins Project Products: Jenkins GitLab Authentication Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in to the attacker's account. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-26/#SECURITY-2696 - http://www.openwall.com/lists/oss-security/2023/07/26/2
CVE ID: CVE-2023-39154 State: PUBLISHED Published: 2023-07-26T13:54:54.206Z Last Updated: 2024-10-23T14:46:37.651Z Vendors: Jenkins Project Products: Jenkins Qualys Web App Scanning Connector Plugin Description: Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-26/#SECURITY-3012 - http://www.openwall.c
P Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-26/#SECURITY-3012 - http://www.openwall.com/lists/oss-security/2023/07/26/2
CVE ID: CVE-2023-39155 State: PUBLISHED Published: 2023-07-26T13:54:54.847Z Last Updated: 2024-10-23T14:46:08.450Z Vendors: Jenkins Project Products: Jenkins Chef Identity Plugin Description: Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-26/#SECURITY-3192 - http://www.openwall.com/lists/oss-security/2023/07/26/2