Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
plugin to change the 'validation_token' in the plugin config, providing access to the plugin's remote control functionalities, such as creating an admin access URL, which can be used for privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/80440bfa-4a02-4441-bbdb-52d7dd065a9d?source=cve - https://plugins.trac.wordpress.org/browser/wordapp/trunk/includes/config.php#L59 - https://plugins.trac.wordpress.org/browser/wordapp/trunk/includes/pdx.php#L64 - https://plugins.trac.wordpress.org/browser/wordapp/trunk/includes/access.php#L28
CVE ID: CVE-2023-2989 State: PUBLISHED Published: 2023-06-22T19:14:17.275Z Last Updated: 2024-12-05T17:41:57.318Z Vendors: Fortra Products: Globalscape EFT Problem Types: CWE-125 Description: Fortra Globalscape EFT versions before 8.1.0.16 suffer from an out of bounds memory read in their administration server, which can allow an attacker to crash the service or bypass authentication if successfully exploited Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/2023/06/22/multiple-vulnerabilities-in-fortra-globalscape-eft-administration-server-fixed/ - https://kb.globalscape.com/Knowledgebase/11586/Is-EFT-susceptible-to-th
a-globalscape-eft-administration-server-fixed/ - https://kb.globalscape.com/Knowledgebase/11586/Is-EFT-susceptible-to-the-Authentication-Bypass-via-Outofbounds-Memory-Read-vulnerability
CVE ID: CVE-2023-2990 State: PUBLISHED Published: 2023-06-22T19:17:28.531Z Last Updated: 2024-12-04T21:34:07.241Z Vendors: Fortra Products: Globalscape EFT Problem Types: CWE-400 Description: Fortra Globalscape EFT versions before 8.1.0.16 suffer from a denial of service vulnerability, where a compressed message that decompresses to itself can cause infinite recursion and crash the service Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/2023/06/22/multiple-vulnerabilities-in-fortra-globalscape-eft-administration-server-fixed/ - https://kb.globalscape.com/Knowledgebase/11588/Is-EFT-susceptible-to-the-Denial-of-service-
ministration-server-fixed/ - https://kb.globalscape.com/Knowledgebase/11588/Is-EFT-susceptible-to-the-Denial-of-service-via-recursive-Deflate-Stream-vulnerability
CVE ID: CVE-2023-2991 State: PUBLISHED Published: 2023-06-22T19:22:24.434Z Last Updated: 2024-12-06T15:12:53.692Z Vendors: Fortra Products: Globalscape EFT Problem Types: CWE-200 Description: Fortra Globalscape EFT's administration server suffers from an information disclosure vulnerability where the serial number of the harddrive that Globalscape is installed on can be remotely determined via a "trial extension request" message Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/2023/06/22/multiple-vulnerabilities-in-fortra-globalscape-eft-administration-server-fixed/ - https://kb.globalscape.com/Knowledgebase/11589/Is-E
erabilities-in-fortra-globalscape-eft-administration-server-fixed/ - https://kb.globalscape.com/Knowledgebase/11589/Is-EFT-susceptible-to-the-Remotely-obtain-HDD-serial-number-vulnerability
CVE ID: CVE-2023-2992 State: PUBLISHED Published: 2023-06-26T19:44:40.121Z Last Updated: 2024-09-16T14:51:34.588Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Lenovo Products: System Management Module (SMM), Fan Power Controller (FPC) Problem Types: CWE-405 Description: An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-127357
CVE ID: CVE-2023-2993 State: PUBLISHED Published: 2023-06-26T19:44:50.040Z Last Updated: 2024-11-06T21:47:48.605Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Lenovo Products: System Management Module (SMM) , Fan Power Controller (FPC) Problem Types: CWE-281 Description: A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/produc
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-127357
CVE ID: CVE-2023-2994 State: REJECTED Published: N/A Last Updated: 2023-05-30T17:26:56.324Z Description: No description available.
CVE ID: CVE-2023-2995 State: PUBLISHED Published: 2023-09-19T19:37:08.838Z Last Updated: 2025-04-23T16:16:20.973Z Vendors: Unknown Products: Leyka Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Leyka WordPress plugin before 3.30.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/762ff2ca-5c1f-49ae-b83c-1c22bacbc82f
CVE ID: CVE-2023-2996 State: PUBLISHED Published: 2023-06-27T13:17:07.479Z Last Updated: 2024-12-05T16:48:09.882Z Vendors: Unknown Products: Jetpack Problem Types: CWE-20 Improper Input Validation Description: The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/52d221bd-ae42-435d-a90a-60a5ae530663 - https://jetpack.com/blog/jetpack-12-1-1-critical-security-update/
CVE ID: CVE-2023-2998 State: PUBLISHED Published: 2023-05-31T00:00:00 Last Updated: 2025-01-10T16:26:40.740Z Severity: MEDIUM (CVSS 6 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/8282d78e-f399-4bf4-8403-f39103a31e78 - https://github.com/thorsten/phpmyfaq/commit/c120070a66e6c497c328d3b6b067eebcd8ea8493
CVE ID: CVE-2023-2999 State: PUBLISHED Published: 2023-05-31T00:00:00 Last Updated: 2025-01-10T16:26:06.631Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/4d89c7cc-fb4c-4b64-9b67-f0189f70a620 - https://github.com/thorsten/phpmyfaq/commit/937913948cab382a38f681e0bd29c152e2f383cd
CVE ID: CVE-2023-30013 State: PUBLISHED Published: 2023-05-05T00:00:00.000Z Last Updated: 2025-01-29T17:40:48.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Kazamayc/vuln/tree/main/TOTOLINK/X5000R/2 - http://packetstormsecurity.com/files/174799/TOTOLINK-Wireless-Routers-Remote-Command-Execution.html
CVE ID: CVE-2023-30014 State: PUBLISHED Published: 2024-01-12T00:00:00.000Z Last Updated: 2025-06-03T14:06:27.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via sub_event_id parameter in sub_event_stat_update.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Pings1031/cve_report/blob/main/judging-management-system/SQLi-1.md
CVE ID: CVE-2023-30015 State: PUBLISHED Published: 2024-01-12T00:00:00.000Z Last Updated: 2025-06-03T14:06:21.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via txtsearch parameter in review_search.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Pings1031/cve_report/blob/main/judging-management-system/SQLi-3.md
CVE ID: CVE-2023-30016 State: PUBLISHED Published: 2024-01-12T00:00:00.000Z Last Updated: 2025-06-20T16:36:57.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via sub_event_id parameter in sub_event_details_edit.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Pings1031/cve_report/blob/main/judging-management-system/SQLi-2.md
CVE ID: CVE-2023-30018 State: PUBLISHED Published: 2023-05-08T00:00:00.000Z Last Updated: 2025-01-29T17:09:31.745Z Vendors: n/a Products: n/a Problem Types: n/a Description: Judging Management System v1.0 is vulnerable to SQL Injection. via /php-jms/review_se_result.php?mainevent_id=. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/10F26/bug_report/blob/main/judging-management-system/SQLi-1.md
CVE ID: CVE-2023-30019 State: PUBLISHED Published: 2023-05-08T00:00:00.000Z Last Updated: 2025-02-13T16:49:24.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: imgproxy <=3.14.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the imageURL parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/imgproxy/imgproxy - https://breakandpray.com/cve-2023-30019-ssrf-in-imgproxy/
CVE ID: CVE-2023-30024 State: PUBLISHED Published: 2023-04-28T00:00:00.000Z Last Updated: 2025-01-31T16:08:38.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MagicJack device, a VoIP solution for internet phone calls, contains a hidden NAND flash memory partition allowing unauthorized read/write access. Attackers can exploit this by replacing the original software with a malicious version, leading to ransomware deployment on the host computer. Affected devices have firmware versions prior to magicJack A921 USB Phone Jack Rev 3.0 V1.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.magicjack.com/ - https://pastebin.com
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.magicjack.com/ - https://pastebin.com/raw/irWcawp8 - https://drive.google.com/drive/folders/1cKd8hksThK610GPtBQ3du8DEkwKywlAi?usp=sharing - https://samuraisecurity.co.uk/red-teaming-0x01-click-rce-via-voip-usb/
CVE ID: CVE-2023-30053 State: PUBLISHED Published: 2023-05-05T00:00:00.000Z Last Updated: 2025-01-29T17:39:17.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Am1ngl/ttt/tree/main/160
CVE ID: CVE-2023-30054 State: PUBLISHED Published: 2023-05-05T00:00:00.000Z Last Updated: 2025-01-29T17:38:25.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A7100RU V7.4cu.2313_B20191024 has a Command Injection vulnerability. An attacker can obtain a stable root shell through a specially constructed payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Am1ngl/ttt/tree/main/161
CVE ID: CVE-2023-30056 State: PUBLISHED Published: 2023-05-09T00:00:00.000Z Last Updated: 2025-01-28T19:55:07.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: A session takeover vulnerability exists in FICO Origination Manager Decision Module 4.8.1 due to insufficient protection of the JSESSIONID cookie. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://fico.com - http://origination.com - https://packetstormsecurity.com/files/172192/FICO-Origination-Manager-Decision-Module-4.8.1-XSS-Session-Hijacking.html
CVE ID: CVE-2023-30057 State: PUBLISHED Published: 2023-05-09T00:00:00.000Z Last Updated: 2025-01-29T14:57:29.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored cross-site scripting (XSS) vulnerabilities in FICO Origination Manager Decision Module 4.8.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://fico.com - http://origination.com - https://packetstormsecurity.com/files/172192/FICO-Origination-Manager-Decision-Module-4.8.1-XSS-Session-Hijacking.html
CVE ID: CVE-2023-30058 State: PUBLISHED Published: 2023-09-11T00:00:00 Last Updated: 2024-09-26T18:38:24.070Z Vendors: n/a Products: n/a Problem Types: n/a Description: novel-plus 3.6.2 is vulnerable to SQL Injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/201206030/novel-plus - https://github.com/Rabb1tQ/HillstoneCVEs/tree/main/CVE-2023-30058 - https://github.com/Rabb1tQ/HillstoneCVEs/blob/main/CVE-2023-30058/CVE-2023-30058.md
CVE ID: CVE-2023-30061 State: PUBLISHED Published: 2023-05-01T00:00:00.000Z Last Updated: 2025-01-30T17:27:06.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-879 v105A1 is vulnerable to Authentication Bypass via phpcgi. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/Zarathustra-L/IoT_Vul/tree/main/D-Link/DIR-879
CVE ID: CVE-2023-30063 State: PUBLISHED Published: 2023-05-01T00:00:00.000Z Last Updated: 2025-01-30T17:26:09.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-890L FW1.10 A1 is vulnerable to Authentication bypass. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/Zarathustra-L/IoT_Vul/tree/main/D-Link/DIR-890L/Auth%20bypass
CVE ID: CVE-2023-30065 State: PUBLISHED Published: 2023-05-05T00:00:00.000Z Last Updated: 2025-01-29T17:36:52.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: MitraStar GPT-2741GNAC-N2 with firmware BR_g5.9_1.11(WVK.0)b32 was discovered to contain a remote code execution (RCE) vulnerability in the ping function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Sigmw/mitrastar-code-execution/blob/main/README.md
CVE ID: CVE-2023-30076 State: PUBLISHED Published: 2023-04-20T00:00:00.000Z Last Updated: 2025-02-05T16:12:52.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Judging Management System v1.0 is vulnerable to SQL Injection via /php-jms/print_judges.php?print_judges.php=&se_name=&sub_event_id=. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Dzero57/cve_report/blob/main/judging-management-system/SQLi-2.md
CVE ID: CVE-2023-30077 State: PUBLISHED Published: 2023-05-04T00:00:00.000Z Last Updated: 2025-01-29T19:35:37.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: Judging Management System v1.0 by oretnom23 was discovered to vulnerable to SQL injection via /php-jms/review_result.php?mainevent_id=, mainevent_id. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.github.com - https://github.com/Dzero57/cve_report/blob/main/judging-management-system/SQLi-1.md
CVE ID: CVE-2023-30078 State: REJECTED Published: N/A Last Updated: 2023-11-06T15:17:05.884622 Description: No description available.
CVE ID: CVE-2023-30079 State: REJECTED Published: N/A Last Updated: 2023-11-06T15:13:47.482623 Description: No description available.
CVE ID: CVE-2023-30082 State: PUBLISHED Published: 2023-06-14T00:00:00 Last Updated: 2025-01-06T16:29:00.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied using the osTicket application. This can cause the website to go down or stop responding. When a long password is entered, this procedure will consume all available CPU and memory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/manavparekh/CVEs/blob/main/CVE-2023-30082/Steps%20to%20reproduce.txt - https://blog.manavparekh.com/
https://github.com/manavparekh/CVEs/blob/main/CVE-2023-30082/Steps%20to%20reproduce.txt - https://blog.manavparekh.com/2023/06/cve-2023-30082.html
CVE ID: CVE-2023-30083 State: PUBLISHED Published: 2023-05-09T00:00:00.000Z Last Updated: 2025-01-28T19:22:38.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability found in Libming swftophp v.0.4.8 allows a local attacker to cause a denial of service via the newVar_N in util/decompile.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libming/libming/issues/266
CVE ID: CVE-2023-30084 State: PUBLISHED Published: 2023-05-09T00:00:00.000Z Last Updated: 2025-01-29T14:54:49.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue found in libming swftophp v.0.4.8 allows a local attacker to cause a denial of service via the stackVal function in util/decompile.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libming/libming/issues/268
CVE ID: CVE-2023-30085 State: PUBLISHED Published: 2023-05-09T00:00:00.000Z Last Updated: 2025-01-29T14:48:40.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability found in Libming swftophp v.0.4.8 allows a local attacker to cause a denial of service via the cws2fws function in util/decompile.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libming/libming/issues/267
CVE ID: CVE-2023-30086 State: PUBLISHED Published: 2023-05-09T00:00:00.000Z Last Updated: 2025-01-29T14:44:13.845Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability found in Libtiff V.4.0.7 allows a local attacker to cause a denial of service via the tiffcp function in tiffcp.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://libtiff-release-v4-0-7.com - http://tiffcp.com - https://gitlab.com/libtiff/libtiff/-/issues/538 - https://security.netapp.com/advisory/ntap-20230616-0003/
CVE ID: CVE-2023-30087 State: PUBLISHED Published: 2023-05-09T00:00:00.000Z Last Updated: 2025-01-29T14:37:49.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_mk_string function in mjs.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cesanta/mjs/issues/244
CVE ID: CVE-2023-30088 State: PUBLISHED Published: 2023-05-09T00:00:00.000Z Last Updated: 2025-01-29T20:38:44.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_execute function in mjs.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cesanta/mjs/issues/243
CVE ID: CVE-2023-30090 State: PUBLISHED Published: 2023-05-05T00:00:00.000Z Last Updated: 2025-01-29T17:16:28.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: Semcms Shop v4.2 was discovered to contain an arbitrary file uplaod vulnerability via the component SEMCMS_Upfile.php. This vulnerability allows attackers to execute arbitrary code via uploading a crafted PHP file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xlccccc/vuln/tree/master/Semcms
CVE ID: CVE-2023-30092 State: PUBLISHED Published: 2023-05-08T00:00:00.000Z Last Updated: 2025-01-29T20:53:50.038Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Online Pizza Ordering System v1.0 is vulnerable to SQL Injection via the QTY parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/16166/online-pizza-ordering-system-php-free-source-code.html - https://github.com/nawed20002/CVE-2023-30092
CVE ID: CVE-2023-30093 State: PUBLISHED Published: 2023-05-04T00:00:00.000Z Last Updated: 2025-01-29T20:46:44.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.edoardoottavianelli.it/CVE-2023-30093/ - https://www.youtube.com/watch?v=jZr2JhDd_S8
CVE ID: CVE-2023-30094 State: PUBLISHED Published: 2023-05-04T00:00:00.000Z Last Updated: 2025-01-29T20:46:14.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in TotalJS Flow v10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the platform name field in the settings module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/totaljs/flow/issues/100 - https://www.edoardoottavianelli.it/CVE-2023-30094/ - https://www.youtube.com/watch?v=vOb9Fyg3iVo
CVE ID: CVE-2023-30095 State: PUBLISHED Published: 2023-05-04T00:00:00.000Z Last Updated: 2025-01-29T20:45:48.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the channel description field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/totaljs/messenger/issues/11 - https://www.edoardoottavianelli.it/CVE-2023-30095/ - https://www.youtube.com/watch?v=2k7e9E0Cw0Y
CVE ID: CVE-2023-30096 State: PUBLISHED Published: 2023-05-04T00:00:00.000Z Last Updated: 2025-01-29T20:45:15.362Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the user information field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/totaljs/messenger/issues/10 - https://www.edoardoottavianelli.it/CVE-2023-30096/ - https://www.youtube.com/watch?v=ZA7R001kE2w