Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-49113 State: PUBLISHED Published: 2024-06-20T12:39:00.966Z Last Updated: 2025-11-04T17:13:05.413Z Vendors: Kiuwan Products: SAST Local Analyzer Problem Types: CWE-312 Description: The Kiuwan Local Analyzer (KLA) Java scanning application contains several hard-coded secrets in plain text format. In some cases, this can potentially compromise the confidentiality of the scan results. Several credentials were found in the JAR files of the Kiuwan Local Analyzer. The JAR file "lib.engine/insight/optimyth-insight.jar" contains the file "InsightServicesConfig.properties", which has the configuration tokens "insight.github.user" as well as "insight.github.password" prefilled with cre
rties", which has the configuration tokens "insight.github.user" as well as "insight.github.password" prefilled with credentials. At least the specified username corresponds to a valid GitHub account. The JAR file "lib.engine/insight/optimyth-insight.jar" also contains the file "es/als/security/Encryptor.properties", in which the key used for encrypting the results of any performed scan. This issue affects Kiuwan SAST: <master.1808.p685.q13371 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/kiuwan - https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log
CVE ID: CVE-2023-49114 State: PUBLISHED Published: 2024-02-26T12:19:44.624Z Last Updated: 2025-02-13T17:18:34.767Z Vendors: Qognify Products: VMS Client Viewer Problem Types: CWE-427 Description: A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL, if some specific pre-conditions are met. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://r.sec-consult.com/qognify - http://seclists.org/fulldisclosure/2024/Mar/10
CVE ID: CVE-2023-49115 State: PUBLISHED Published: 2024-02-01T22:28:08.697Z Last Updated: 2024-08-02T21:46:28.903Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: MachineSense Products: FeverWarn Problem Types: CWE-306 Description: MachineSense devices use unauthenticated MQTT messaging to monitor devices and remote viewing of sensor data by users. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-01 - https://machinesense.com/pages/about-machinesense
CVE ID: CVE-2023-49117 State: PUBLISHED Published: 2023-12-26T05:53:40.513Z Last Updated: 2024-08-02T21:46:29.150Z Vendors: Alfasado Inc. Products: PowerCMS (PowerCMS 6 Series), PowerCMS (PowerCMS 5 Series), PowerCMS (PowerCMS 4 Series) Problem Types: Cross-site scripting (XSS) Description: PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability. Additional Analyst Notes: - CVE Program Container: References: -
of-Life, EOL) are also affected by this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.powercms.jp/news/release-powercms-202312.html - https://jvn.jp/en/jp/JVN32646742/
CVE ID: CVE-2023-49118 State: PUBLISHED Published: 2024-02-02T06:18:45.256Z Last Updated: 2024-08-02T21:46:29.149Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-125 Description: in OpenHarmony v3.2.4 and prior versions allow a local attacker causes information leak through out-of-bounds Read. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-02.md
CVE ID: CVE-2023-49119 State: PUBLISHED Published: 2023-12-26T07:20:58.393Z Last Updated: 2024-11-27T15:22:12.385Z Vendors: WESEEK, Inc. Products: GROWI Problem Types: Cross-site scripting (XSS) Description: Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/ - https://jvn.jp/en/jp/JVN18715935/
CVE ID: CVE-2023-49121 State: PUBLISHED Published: 2024-01-09T09:59:52.512Z Last Updated: 2025-08-27T20:47:16.375Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Solid Edge SE2023 Problem Types: CWE-122 Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productce
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf
CVE ID: CVE-2023-49122 State: PUBLISHED Published: 2024-01-09T09:59:53.759Z Last Updated: 2025-08-27T20:47:55.578Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Solid Edge SE2023 Problem Types: CWE-122 Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productce
CVE ID: CVE-2023-49123 State: PUBLISHED Published: 2024-01-09T09:59:55.117Z Last Updated: 2025-08-27T20:48:25.061Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Solid Edge SE2023 Problem Types: CWE-122 Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productce
CVE ID: CVE-2023-49124 State: PUBLISHED Published: 2024-01-09T09:59:56.361Z Last Updated: 2025-08-27T20:48:58.792Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Solid Edge SE2023 Problem Types: CWE-125 Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-po
rrent process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf
CVE ID: CVE-2023-49125 State: PUBLISHED Published: 2024-02-13T08:59:57.813Z Last Updated: 2025-05-07T21:13:43.727Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: Parasolid V35.0, Parasolid V35.1, Parasolid V36.0, Solid Edge SE2023, Solid Edge SE2024 Problem Types: CWE-125 Description: A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.263), Parasolid V35.1 (All versions < V35.1.252), Parasolid V36.0 (All versions < V36.0.198), Solid Edge SE2023 (All versions < V223.0 Update 11), Solid Edge SE2024 (All versions < V224.0 Update 3). The affected applications contain an out of bounds read past the end of an allocated st
All versions < V224.0 Update 3). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted files containing XT format. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-797296.html - https://cert-portal.siemens.com/productcert/html/ssa-382651.html
CVE ID: CVE-2023-49126 State: PUBLISHED Published: 2024-01-09T09:59:57.599Z Last Updated: 2025-08-27T20:49:34.090Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Solid Edge SE2023 Problem Types: CWE-125 Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-po
CVE ID: CVE-2023-49127 State: PUBLISHED Published: 2024-01-09T09:59:58.842Z Last Updated: 2025-08-27T20:52:54.620Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Solid Edge SE2023 Problem Types: CWE-125 Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-po
CVE ID: CVE-2023-49128 State: PUBLISHED Published: 2024-01-09T10:00:00.630Z Last Updated: 2025-08-27T20:52:54.771Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Solid Edge SE2023 Problem Types: CWE-787 Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted PAR file. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-por
rent process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf
CVE ID: CVE-2023-49129 State: PUBLISHED Published: 2024-01-09T10:00:02.399Z Last Updated: 2025-06-17T20:39:17.161Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Solid Edge SE2023 Problem Types: CWE-121 Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain a stack overflow vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/p
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf
CVE ID: CVE-2023-49130 State: PUBLISHED Published: 2024-01-09T10:00:04.164Z Last Updated: 2025-08-27T20:52:54.892Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Solid Edge SE2023 Problem Types: CWE-824 Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.si
rocess. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-589891.pdf
CVE ID: CVE-2023-49131 State: PUBLISHED Published: 2024-01-09T10:00:05.693Z Last Updated: 2025-08-27T20:52:55.024Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Solid Edge SE2023 Problem Types: CWE-824 Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.si
CVE ID: CVE-2023-49132 State: PUBLISHED Published: 2024-01-09T10:00:07.440Z Last Updated: 2025-08-27T20:52:55.200Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Solid Edge SE2023 Problem Types: CWE-824 Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.si
CVE ID: CVE-2023-49133 State: PUBLISHED Published: 2024-04-09T14:12:47.975Z Last Updated: 2025-11-04T18:19:38.116Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Tp-Link Products: AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3), N300 Wireless Access Point (EAP115) Problem Types: CWE-829 Description: A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point (EAP115 V4) v5.0.4 Build 20220216. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send
d 20220216. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.This vulnerability impacts `uclited` on the EAP225(V3) 5.1.0 Build 20220926 of the AC1350 Wireless MU-MIMO Gigabit Access Point. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1862
CVE ID: CVE-2023-49134 State: PUBLISHED Published: 2024-04-09T14:12:48.096Z Last Updated: 2025-11-04T18:19:39.308Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Tp-Link Products: AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3), N300 Wireless Access Point (EAP115) Problem Types: CWE-829 Description: A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point (EAP115 V4) v5.0.4 Build 20220216. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send
d 20220216. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.This vulnerability impacts `uclited` on the EAP115(V4) 5.0.4 Build 20220216 of the N300 Wireless Gigabit Access Point. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1862
CVE ID: CVE-2023-49135 State: PUBLISHED Published: 2024-01-02T07:24:17.361Z Last Updated: 2024-11-14T19:23:02.826Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-416 Description: in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia player crash through modify a released pointer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-01.md
CVE ID: CVE-2023-49137 State: REJECTED Published: N/A Last Updated: 2025-05-28T21:23:30.695Z Description: No description available.
CVE ID: CVE-2023-49139 State: REJECTED Published: N/A Last Updated: 2025-05-28T21:26:44.565Z Description: No description available.
CVE ID: CVE-2023-49140 State: PUBLISHED Published: 2023-12-12T09:16:13.379Z Last Updated: 2024-10-08T19:23:02.781Z Vendors: JTEKT ELECTRONICS CORPORATION Products: GC-A22W-CW, GC-A24W-C(W), GC-A26W-C(W), GC-A24, GC-A24-M, GC-A25, GC-A26, GC-A26-J2, GC-A27-C, GC-A28-C Problem Types: Denial-of-service (DoS) Description: Denial-of-service (DoS) vulnerability exists in commplex-link service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to specific ports, a denial-of-service (DoS) condition may occur. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.electronics.jtekt.co.jp/en/topics/202312116562/ -
Program Container: - CISA ADP Vulnrichment: References: - https://www.electronics.jtekt.co.jp/en/topics/202312116562/ - https://jvn.jp/en/jp/JVN34145838/
CVE ID: CVE-2023-49141 State: PUBLISHED Published: 2024-08-14T13:45:37.747Z Last Updated: 2025-03-14T10:03:03.649Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Processors stream cache mechanism Problem Types: escalation of privilege, CWE-1189 Description: Improper isolation in some Intel(R) Processors stream cache mechanism may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01046.html
CVE ID: CVE-2023-49142 State: PUBLISHED Published: 2024-01-02T07:24:22.879Z Last Updated: 2025-06-17T20:29:06.042Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-416 Description: in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia audio crash through modify a released pointer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-01.md
CVE ID: CVE-2023-49143 State: PUBLISHED Published: 2023-12-12T09:16:20.067Z Last Updated: 2024-08-02T21:46:28.984Z Vendors: JTEKT ELECTRONICS CORPORATION Products: GC-A22W-CW, GC-A24W-C(W), GC-A26W-C(W), GC-A24, GC-A24-M, GC-A25, GC-A26, GC-A26-J2, GC-A27-C, GC-A28-C Problem Types: Denial-of-service (DoS) Description: Denial-of-service (DoS) vulnerability exists in rfe service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to specific ports, a denial-of-service (DoS) condition may occur. Additional Analyst Notes: - CVE Program Container: References: - https://www.electronics.jtekt.co.jp/en/topics/202312116562/ - https://jvn.jp/en/jp/JVN34145838/
CVE ID: CVE-2023-49144 State: PUBLISHED Published: 2024-08-14T13:45:32.690Z Last Updated: 2024-08-16T17:06:08.236Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N) Vendors: n/a Products: Intel(R) Server Platforms Problem Types: information disclosure, CWE-125 Description: Out of bounds read in OpenBMC Firmware for some Intel(R) Server Platforms before versions egs-1.15-0, bhs-0.27 may allow a privileged user to potentially enable information disclosure via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01078.html
CVE ID: CVE-2023-49145 State: PUBLISHED Published: 2023-11-27T22:14:02.850Z Last Updated: 2025-02-13T17:18:35.345Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: Apache Software Foundation Products: Apache NiFi Problem Types: CWE-79 Description: Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, then arbitrary JavaScript code can be executed within the session context of the authenticated user. Upgrading to Apache NiFi 1
bitrary JavaScript code can be executed within the session context of the authenticated user. Upgrading to Apache NiFi 1.24.0 or 2.0.0-M1 is the recommended mitigation. Additional Analyst Notes: - CVE Program Container: References: - https://nifi.apache.org/security.html#CVE-2023-49145 - https://lists.apache.org/thread/j8rd0qsvgoj0khqck5f49jfbp0fm8r1o - http://www.openwall.com/lists/oss-security/2023/11/27/5
CVE ID: CVE-2023-49146 State: PUBLISHED Published: 2023-11-22T00:00:00 Last Updated: 2024-08-02T21:46:29.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: DOMSanitizer (aka dom-sanitizer) before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rhukster/dom-sanitizer/commit/c2a98f27ad742668b254282ccc5581871d0fb601 - https://github.com/rhukster/dom-sanitizer/compare/1.0.6...1.0.7
CVE ID: CVE-2023-49147 State: PUBLISHED Published: 2023-12-19T00:00:00 Last Updated: 2024-08-02T21:46:29.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PDF24 Creator 11.14.0. The configuration of the msi installer file was found to produce a visible cmd.exe window when using the repair function of msiexec.exe. This allows an unprivileged local attacker to use a chain of actions (e.g., an oplock on faxPrnInst.log) to open a SYSTEM cmd.exe. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2023/Dec/18 - http://packetstormsecurity.com/files/176206/PDF24-Creator-11.15.1-Local-Privilege-Escalation.html -
losure/2023/Dec/18 - http://packetstormsecurity.com/files/176206/PDF24-Creator-11.15.1-Local-Privilege-Escalation.html - https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-via-msi-installer-in-pdf24-creator-geek-software-gmbh/
CVE ID: CVE-2023-49148 State: PUBLISHED Published: 2023-12-18T22:08:11.992Z Last Updated: 2024-08-02T21:46:29.324Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Kulwant Nagi Products: Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Kulwant Nagi Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates.This issue affects Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates: from n/a through 3.0.5. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/affiliateboo