Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-2114 State: PUBLISHED Published: 2023-05-08T13:58:08.740Z Last Updated: 2025-02-04T20:02:29.849Z Vendors: Unknown Products: NEX-Forms Problem Types: CWE-89 SQL Injection Description: The NEX-Forms WordPress plugin before 8.4 does not properly escape the `table` parameter, which is populated with user input, before concatenating it to an SQL query. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3d8ab3a5-1bf8-4216-91fa-e89541e5c43d - https://github.com/SchmidAlex/nex-forms_SQL-Injection
CVE ID: CVE-2023-2117 State: PUBLISHED Published: 2023-05-30T07:49:17.892Z Last Updated: 2025-01-10T20:55:18.959Z Vendors: Unknown Products: Image Optimizer by 10web Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/44024299-ba40-4da7-81e1-bd44d10846f3
CVE ID: CVE-2023-2118 State: PUBLISHED Published: 2023-04-21T21:52:14.163Z Last Updated: 2025-02-04T19:54:58.711Z Vendors: Devolutions Products: Devolutions Server Description: Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send support tickets and download diagnostic files via specific endpoints. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2023-0010
CVE ID: CVE-2023-2119 State: PUBLISHED Published: 2023-04-18T01:57:07.181Z Last Updated: 2025-01-13T16:51:21.159Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nik00726 Products: Responsive Filterable Portfolio Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Responsive Filterable Portfolio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.0.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages tha
n and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e67dfe0f-ac1c-4a78-bfc9-0cfd6c3040d4?source=cve - https://plugins.trac.wordpress.org/browser/wp-responsive-thumbnail-slider/trunk/wp-responsive-images-thumbnail-slider.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2808922%40responsive-filterable-portfolio%2Ftags%2F1.0.19&new=2899431%40res
hangeset?sfp_email=&sfph_mail=&reponame=&old=2808922%40responsive-filterable-portfolio%2Ftags%2F1.0.19&new=2899431%40responsive-filterable-portfolio%2Ftags%2F1.0.20
CVE ID: CVE-2023-2120 State: PUBLISHED Published: 2023-04-18T01:57:09.113Z Last Updated: 2025-01-13T16:51:11.600Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nik00726 Products: Thumbnail carousel slider Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Thumbnail carousel slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if
escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f4bf4e12-5cbb-45bc-938e-62163baaa15d?source=cve - https://plugins.trac.wordpress.org/browser/wp-responsive-thumbnail-slider/trunk/wp-responsive-images-thumbnail-slider.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2813150%40wp-responsive-thumbnail-slider%2Ftags%2F1.1.9&new=2899786%40wp-responsive-thum
email=&sfph_mail=&reponame=&old=2813150%40wp-responsive-thumbnail-slider%2Ftags%2F1.1.9&new=2899786%40wp-responsive-thumbnail-slider%2Ftags%2F1.1.10
CVE ID: CVE-2023-2121 State: PUBLISHED Published: 2023-06-09T16:59:49.065Z Last Updated: 2025-01-06T18:15:00.958Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: HashiCorp Products: Vault, Vault Enterprise Problem Types: CWE-79 Description: Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2023-17-vault-s-kv-diff-viewer-allowed-html-injection/54814
CVE ID: CVE-2023-2122 State: PUBLISHED Published: 2023-08-16T11:03:20.332Z Last Updated: 2024-10-08T19:57:23.556Z Vendors: Unknown Products: Image Optimizer by 10web Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/936fd93a-428d-4744-a4fc
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/936fd93a-428d-4744-a4fc-c8da78dcbe78
CVE ID: CVE-2023-2123 State: PUBLISHED Published: 2023-08-16T11:03:22.025Z Last Updated: 2024-10-08T19:16:49.294Z Vendors: Unknown Products: WP Inventory Manager Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Inventory Manager WordPress plugin before 2.1.0.13 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/44448888-cd5d-482e-859e-123e442ce5c1 - https://github.com/daniloalbuqrque/poc-cve-xss-encoded-wp-inventory-manager-plugin
CVE ID: CVE-2023-2124 State: PUBLISHED Published: 2023-05-15T00:00:00 Last Updated: 2024-08-02T06:12:20.423Z Vendors: n/a Products: Kernel Problem Types: CWE-787 Description: An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/xfs/xfs_buf_item_recover.c?h=v6.4-rc1&id=22ed903eee23a5b174e240f1cdfa9acf393a5210 - https://syzkaller.appspot.com/bug?extid=7e
s_buf_item_recover.c?h=v6.4-rc1&id=22ed903eee23a5b174e240f1cdfa9acf393a5210 - https://syzkaller.appspot.com/bug?extid=7e9494b8b399902e994e - https://security.netapp.com/advisory/ntap-20230622-0010/ - https://www.debian.org/security/2023/dsa-5448 - https://www.debian.org/security/2023/dsa-5480 - https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
CVE ID: CVE-2023-2130 State: PUBLISHED Published: 2023-04-17T20:00:06.747Z Last Updated: 2024-08-02T06:12:20.407Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Purchase Order Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Purchase Order Management System 1.0. Affected is an unknown function of the file /admin/suppliers/view_details.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226206 is the identifier assigne
the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226206 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.226206 - https://vuldb.com/?ctiid.226206 - https://github.com/zitozito1/bug_report/blob/main/SQLi.md
CVE ID: CVE-2023-2131 State: PUBLISHED Published: 2023-04-20T20:40:57.215Z Last Updated: 2025-01-16T21:35:37.482Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: INEA Products: ME RTU Problem Types: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Description: Versions of INEA ME RTU firmware prior to 3.36 are vulnerable to OS command injection, which could allow an attacker to remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-110-01
CVE ID: CVE-2023-2132 State: PUBLISHED Published: 2023-06-06T00:00:00 Last Updated: 2025-01-07T21:34:45.492Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A DollarMathPostFilter Regular Expression Denial of Service in was possible by sending crafted payloads to the preview_markdown endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
ayloads to the preview_markdown endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/407586 - https://hackerone.com/reports/1934711 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2132.json
CVE ID: CVE-2023-2133 State: PUBLISHED Published: 2023-04-19T03:40:25.735Z Last Updated: 2025-02-13T16:40:11.388Z Vendors: Google Products: Chrome Problem Types: Out of bounds memory access Description: Out of bounds memory access in Service Worker API in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html - https://crbug.com/1429197 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedo
-desktop_18.html - https://crbug.com/1429197 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FEJZMAUB4XP44HSHEBDWEKFGA7DUHY42/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4AOSGAOPXLBK4A5ZRTVZ4M6QKVLSWMWG/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJQI63HWZFL6M26Q6UOHKDY6LD2PFC5Z/ - https://www.debian.org/security/2023/dsa-5393 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraprojec
ge/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SLO7BL2MHZYPY6O3OAEAQL3SKYMGGO6M/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ES2CDRHR2Y4WY6DNDIAPYZFXJU3ZBFAV/ - https://security.gentoo.org/glsa/202309-17
CVE ID: CVE-2023-2134 State: PUBLISHED Published: 2023-04-19T03:40:26.081Z Last Updated: 2025-02-13T16:40:11.971Z Vendors: Google Products: Chrome Problem Types: Out of bounds memory access Description: Out of bounds memory access in Service Worker API in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html - https://crbug.com/1429201 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedo
-desktop_18.html - https://crbug.com/1429201 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FEJZMAUB4XP44HSHEBDWEKFGA7DUHY42/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4AOSGAOPXLBK4A5ZRTVZ4M6QKVLSWMWG/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJQI63HWZFL6M26Q6UOHKDY6LD2PFC5Z/ - https://www.debian.org/security/2023/dsa-5393 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraprojec
CVE ID: CVE-2023-2135 State: PUBLISHED Published: 2023-04-19T03:40:26.399Z Last Updated: 2025-02-13T16:40:12.525Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in DevTools in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who convinced a user to enable specific preconditions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html - https://crbug.com/1424337 - https://lists.fedoraproject.org/archives/list/package-a
channel-update-for-desktop_18.html - https://crbug.com/1424337 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FEJZMAUB4XP44HSHEBDWEKFGA7DUHY42/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4AOSGAOPXLBK4A5ZRTVZ4M6QKVLSWMWG/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJQI63HWZFL6M26Q6UOHKDY6LD2PFC5Z/ - https://www.debian.org/security/2023/dsa-5393 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/ - https://lists.fedoraproject.org/archives/list/package-announce@
aproject.org/message/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SLO7BL2MHZYPY6O3OAEAQL3SKYMGGO6M/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ES2CDRHR2Y4WY6DNDIAPYZFXJU3ZBFAV/ - https://security.gentoo.org/glsa/202309-17
CVE ID: CVE-2023-2136 State: PUBLISHED Published: 2023-04-19T03:40:26.644Z Last Updated: 2025-10-21T23:05:48.846Z Vendors: Google Products: Chrome Problem Types: Integer overflow Description: Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html - https://crbug.com/1432603 - https://lists.fedoraproject.org/archives/list/package-announce@list
te-for-desktop_18.html - https://crbug.com/1432603 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FEJZMAUB4XP44HSHEBDWEKFGA7DUHY42/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4AOSGAOPXLBK4A5ZRTVZ4M6QKVLSWMWG/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJQI63HWZFL6M26Q6UOHKDY6LD2PFC5Z/ - https://www.debian.org/security/2023/dsa-5393 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedora
/message/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SLO7BL2MHZYPY6O3OAEAQL3SKYMGGO6M/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ES2CDRHR2Y4WY6DNDIAPYZFXJU3ZBFAV/ - https://security.gentoo.org/glsa/202309-17
CVE ID: CVE-2023-2137 State: PUBLISHED Published: 2023-04-19T03:40:26.810Z Last Updated: 2025-02-13T16:40:13.695Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in sqlite in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html - https://crbug.com/1430644 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FE
://crbug.com/1430644 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FEJZMAUB4XP44HSHEBDWEKFGA7DUHY42/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4AOSGAOPXLBK4A5ZRTVZ4M6QKVLSWMWG/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJQI63HWZFL6M26Q6UOHKDY6LD2PFC5Z/ - https://www.debian.org/security/2023/dsa-5393 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SLO7BL2MHZ
WNAJMHJ32X7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SLO7BL2MHZYPY6O3OAEAQL3SKYMGGO6M/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ES2CDRHR2Y4WY6DNDIAPYZFXJU3ZBFAV/ - https://security.gentoo.org/glsa/202309-17
CVE ID: CVE-2023-2138 State: PUBLISHED Published: 2023-04-18T00:00:00.000Z Last Updated: 2025-02-05T20:27:31.707Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: nuxtlabs Products: nuxtlabs/github-module Problem Types: CWE-798 Description: Use of Hard-coded Credentials in GitHub repository nuxtlabs/github-module prior to 1.6.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/65096ef9-eafc-49da-b49a-5b88c0203ca6 - https://github.com/nuxtlabs/github-module/commit/5490c43f729eee60f07920bf88c0aabdc1398b6e
CVE ID: CVE-2023-2139 State: PUBLISHED Published: 2023-04-21T15:44:51.948Z Last Updated: 2025-02-04T20:27:26.439Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Dassault Systèmes Products: DELMIA Apriso Problem Types: CWE-79 Description: A reflected Cross-site Scripting (XSS) Vulnerability in DELMIA Apriso Release 2017 through Release 2022 allows an attacker to execute arbitrary script code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2023-2140 State: PUBLISHED Published: 2023-04-21T15:48:25.654Z Last Updated: 2025-02-04T20:27:09.654Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dassault Systèmes Products: DELMIA Apriso Problem Types: CWE-918 Description: A Server-Side Request Forgery vulnerability in DELMIA Apriso Release 2017 through Release 2022 could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2023-2141 State: PUBLISHED Published: 2023-04-21T15:48:39.800Z Last Updated: 2025-02-04T20:26:49.843Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Dassault Systèmes Products: DELMIA Apriso Problem Types: CWE-502 Description: An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2023-2142 State: PUBLISHED Published: 2024-11-26T11:24:15.422Z Last Updated: 2024-11-27T16:19:44.548Z Vendors: Mozilla Products: Nunjucks Problem Types: CWE-79 Description: In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash \ character. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1825980 - https://github.com/mozilla/nunjucks/security/advisories/GHSA-x77j-w7wf-fjmw
CVE ID: CVE-2023-2143 State: PUBLISHED Published: 2023-07-17T13:29:52.707Z Last Updated: 2024-10-30T15:00:22.942Z Vendors: Unknown Products: Enable SVG, WebP & ICO Upload Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Enable SVG, WebP & ICO Upload WordPress plugin through 1.0.3 does not sanitize SVG file contents, leading to a Cross-Site Scripting vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/91898762-aa7d-4fbc-a016-3de48901e5de
CVE ID: CVE-2023-2144 State: PUBLISHED Published: 2023-04-18T11:00:05.922Z Last Updated: 2025-02-05T20:26:59.191Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Online Thesis Archiving System Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Online Thesis Archiving System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/departments/view_department.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226265 was assigned to this vulnerability. Additional Analyst N
closed to the public and may be used. The identifier VDB-226265 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.226265 - https://vuldb.com/?ctiid.226265 - https://github.com/E1CHO/cve_hub/blob/main/Online%20Thesis%20Archiving%20System/Online%20Thesis%20Archiving%20System%20-%20vuln%206.pdf