Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-2775 State: PUBLISHED Published: 2023-05-17T20:00:04.432Z Last Updated: 2024-08-02T06:33:05.760Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Bus Dispatch and Information System Problem Types: CWE-89 Description: A vulnerability was found in code-projects Bus Dispatch and Information System 1.0. It has been classified as critical. This affects an unknown part of the file adminHome.php. The manipulation of the argument reach_city leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-229281 was assigned to this vulnerability. Additional Ana
en disclosed to the public and may be used. The identifier VDB-229281 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.229281 - https://vuldb.com/?ctiid.229281 - https://github.com/mrwwrrhh/Bus_Dispatch_and_Information_System/blob/main/Bus%20Dispatch%20and%20Information%20System%20in%20login_info%20has%20Sql%20injection%20vulnerabilities.pdf
CVE ID: CVE-2023-2776 State: PUBLISHED Published: 2023-05-17T20:00:05.422Z Last Updated: 2025-01-21T20:58:45.285Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Simple Photo Gallery Problem Types: CWE-434 Description: A vulnerability was found in code-projects Simple Photo Gallery 1.0. It has been declared as critical. This vulnerability affects unknown code. The manipulation leads to unrestricted upload. The attack can be initiated remotely. VDB-229282 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.229282 - https://vuldb.com/?ctiid.229282 -
ogram Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.229282 - https://vuldb.com/?ctiid.229282 - https://gitee.com/zyz0103/system-vul/blob/master/Simple%20Photo%20Gallery%20In%20PHP%20With%20Source%20Code%20has%20file%20upload%20vulnerability.pdf
CVE ID: CVE-2023-2778 State: PUBLISHED Published: 2023-06-13T20:35:18.449Z Last Updated: 2025-03-05T18:57:49.583Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Rockwell Automation Products: FactoryTalk Transaction Manager Problem Types: CWE-400 Description: A denial-of-service vulnerability exists in Rockwell Automation FactoryTalk Transaction Manager. This vulnerability can be exploited by sending a modified packet to port 400. If exploited, the application could potentially crash or experience a high CPU or memory usage condition, causing intermittent application functionality issues. The application would need to be restarted to recover from the DoS. Addi
intermittent application functionality issues. The application would need to be restarted to recover from the DoS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139744
CVE ID: CVE-2023-2779 State: PUBLISHED Published: 2023-06-19T10:52:39.566Z Last Updated: 2025-02-13T16:45:34.023Z Vendors: Unknown Products: Social Share, Social Login and Social Comments Plugin Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Social Share, Social Login and Social Comments WordPress plugin before 7.13.52 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fe9b7696-3b0e-42e2-9dbc-55167605f5c5 - http://pac
CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fe9b7696-3b0e-42e2-9dbc-55167605f5c5 - http://packetstormsecurity.com/files/173053/WordPress-Super-Socializer-7.13.52-Cross-Site-Scripting.html
CVE ID: CVE-2023-2780 State: PUBLISHED Published: 2023-05-17T00:00:00.000Z Last Updated: 2025-01-22T18:03:49.078Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: mlflow Products: mlflow/mlflow Problem Types: CWE-29 Description: Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/b12b0073-0bb0-4bd1-8fc2-ec7f17fd7689 - https://github.com/mlflow/mlflow/commit/fae77a525dd908c56d6204a4cef1c1c75b4e9857
CVE ID: CVE-2023-2781 State: PUBLISHED Published: 2023-06-02T23:37:56.873Z Last Updated: 2024-12-23T16:23:05.774Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: sandeepsoni214 Products: User Email Verification for WooCommerce Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticate_user_by_email in versions up to, and including, 3.5.0. This is due to a random token generation weakness in the resend_verification_email function. This allows unauthenticated attackers to impersonate users and trigger an email
the resend_verification_email function. This allows unauthenticated attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Allow Automatic Login After Successful Verification setting to be enabled, which it is not by default. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f1e31357-7fbc-414b-a4f4-53fa5f2fc715?source=cve - https://plugins.trac.wordpress.org/browser/woo-confirmation-email/tags/3.5.0/public/class-xlwuev-woo
2fc715?source=cve - https://plugins.trac.wordpress.org/browser/woo-confirmation-email/tags/3.5.0/public/class-xlwuev-woocommerce-confirmation-email-public.php#L506 - https://plugins.trac.wordpress.org/browser/woo-confirmation-email/tags/3.5.0/public/class-xlwuev-woocommerce-confirmation-email-public.php#L332 - https://plugins.trac.wordpress.org/browser/woo-confirmation-email/tags/3.5.0/public/class-xlwuev-woocommerce-confirmation-email-public.php#L143
CVE ID: CVE-2023-2782 State: PUBLISHED Published: 2023-05-18T10:16:55.735Z Last Updated: 2025-01-22T16:08:29.503Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Acronis Products: Acronis Cyber Infrastructure Problem Types: CWE-285 Description: Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.3.1-38. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-3475
CVE ID: CVE-2023-2783 State: PUBLISHED Published: 2023-06-16T08:39:26.096Z Last Updated: 2024-12-06T23:03:51.327Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost App Framework Problem Types: CWE-862 Description: Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent by the Apps. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-2784 State: PUBLISHED Published: 2023-06-16T08:41:59.270Z Last Updated: 2024-12-06T23:03:40.088Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: Mattermost Products: Mattermost App Framework Problem Types: CWE-862 Description: Mattermost fails to verify if the requestor is a sysadmin or not, before allowing `install` requests to the Apps allowing a regular user send install requests to the Apps. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-2785 State: PUBLISHED Published: 2023-06-16T09:07:28.235Z Last Updated: 2024-12-06T22:59:34.763Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-400 Description: Mattermost fails to properly truncate the postgres error log message of a search query failure allowing an attacker to cause the creation of large log files which can result in Denial of Service Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-2786 State: PUBLISHED Published: 2023-06-16T08:43:49.826Z Last Updated: 2024-12-06T23:03:28.990Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-862 Description: Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post a message in a channel to actually post it by executing channel commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-2787 State: PUBLISHED Published: 2023-06-16T08:55:39.391Z Last Updated: 2024-12-06T23:03:17.719Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-862 Description: Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2023-2788 State: PUBLISHED Published: 2023-06-16T08:58:15.392Z Last Updated: 2024-12-06T23:00:50.221Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-862 Description: Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2023-2789 State: PUBLISHED Published: 2023-05-18T12:31:03.470Z Last Updated: 2024-08-02T06:33:05.607Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GNU Products: cflow Problem Types: CWE-404 Description: A vulnerability was found in GNU cflow 1.7. It has been rated as problematic. This issue affects the function func_body/parse_variable_declaration of the file parser.c. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. The identifier VDB-229373 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Not
ility. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.229373 - https://vuldb.com/?ctiid.229373 - https://github.com/DaisyPo/fuzzing-vulncollect/blob/main/cflow/stack-overflow/parser.c/README.md - https://github.com/DaisyPo/fuzzing-vulncollect/files/11343936/poc-file.zip
CVE ID: CVE-2023-2790 State: PUBLISHED Published: 2023-05-18T12:31:04.424Z Last Updated: 2024-08-02T06:33:05.524Z Severity: LOW (CVSS 2.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: TOTOLINK Products: N200RE Problem Types: CWE-260 Description: A vulnerability classified as problematic has been found in TOTOLINK N200RE 9.3.5u.6255_B20211224. Affected is an unknown function of the file /squashfs-root/etc_ro/custom.conf of the component Telnet Service. The manipulation leads to password in configuration file. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. VDB-229374 is the identifier assigned to this vulnerability.
e exploit has been disclosed to the public and may be used. VDB-229374 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.229374 - https://vuldb.com/?ctiid.229374 - https://drive.google.com/file/d/1RITXRvKele5aW42YFk0JeQHCq2B63lUj/view?usp=share_link
CVE ID: CVE-2023-2791 State: PUBLISHED Published: 2023-06-16T08:59:16.854Z Last Updated: 2024-12-06T23:00:39.136Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-862 Description: When creating a playbook run via the /dialog API, Mattermost fails to validate all parameters, allowing an authenticated attacker to edit an arbitrary channel post. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2023-2792 State: PUBLISHED Published: 2023-06-16T09:01:43.650Z Last Updated: 2024-12-06T23:00:28.026Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-200 Description: Mattermost fails to sanitize ephemeral error messages, allowing an attacker to obtain arbitrary message contents by a specially crafted /groupmsg command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2023-2793 State: PUBLISHED Published: 2023-06-16T09:02:34.751Z Last Updated: 2024-12-06T23:00:16.890Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Mattermost Products: Mattermost Problem Types: CWE-400 Description: Mattermost fails to validate links on external websites when constructing a preview for a linked website, allowing an attacker to cause a denial-of-service by a linking to a specially crafted webpage in a message. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2023-2794 State: PUBLISHED Published: 2024-04-10T10:15:43.908Z Last Updated: 2025-11-04T18:14:26.729Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Problem Types: CWE-119 Description: A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_deliver() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for this memcpy length in decode_submit(), but it was forgotten in decode_deliver(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https
ten in decode_deliver(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2255387
CVE ID: CVE-2023-2795 State: PUBLISHED Published: 2023-06-27T13:17:25.903Z Last Updated: 2024-11-27T17:01:10.772Z Vendors: Unknown Products: CodeColorer Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The CodeColorer WordPress plugin before 0.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2d6ecd21-3dd4-423d-80e7-277c45080a9f
CVE ID: CVE-2023-2796 State: PUBLISHED Published: 2023-07-10T12:40:07.475Z Last Updated: 2025-02-13T16:45:37.979Z Vendors: Unknown Products: EventON Problem Types: CWE-862 Missing Authorization Description: The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e9ef793c-e5a3-4c55-beee-56b0909f7a0d - http://packetstormsecurity.com/files/173984/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object
55-beee-56b0909f7a0d - http://packetstormsecurity.com/files/173984/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object-Reference.html
CVE ID: CVE-2023-2797 State: PUBLISHED Published: 2023-06-16T09:03:17.656Z Last Updated: 2024-12-06T22:59:54.420Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Github Plugin Problem Types: CWE-74 Description: Mattermost fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting a specially crafted permalink on a channel. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2023-2798 State: PUBLISHED Published: 2023-05-25T13:54:52.191Z Last Updated: 2024-08-02T06:33:05.702Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Problem Types: CWE-400 Description: Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). If HtmlUnit is running on user supplied web pages, an attacker may supply content that causes HtmlUnit to crash by a stack overflow. This effect may support a denial of service attack.This issue affects htmlunit before 2.70.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/HtmlUnit/htmlunit/commit/940dc7fd - https://bugs.chromium.org/p/
CVE Program Container: References: - https://github.com/HtmlUnit/htmlunit/commit/940dc7fd - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54613
CVE ID: CVE-2023-2799 State: PUBLISHED Published: 2023-05-18T15:31:03.350Z Last Updated: 2024-11-22T19:49:26.896Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: cnoa Products: OA Problem Types: CWE-259 Description: A vulnerability, which was classified as problematic, has been found in cnoa OA up to 5.1.1.5. Affected by this issue is some unknown functionality of the file /index.php?app=main&func=passport&action=login. The manipulation leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229376. NOTE: The vendor was contacted early about this disclosure but did not res
entifier of this vulnerability is VDB-229376. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.229376 - https://vuldb.com/?ctiid.229376 - https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/The-default-password-vulnerability-exists-in-the-intelligent-cooperative-office-system.md - https://github.com/Peanut886/Vulnerability/blob/main/imgs/2023-Guangzhou%20Xiezhong%20Software%20Technology%20Co.%2C%20LTD/2023-04-10(2).jpg
CVE ID: CVE-2023-2800 State: PUBLISHED Published: 2023-05-18T00:00:00 Last Updated: 2025-01-21T20:09:18.683Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: huggingface Products: huggingface/transformers Problem Types: CWE-377 Description: Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/a3867b4e-6701-4418-8c20-3c6e7084a44a - https://github.com/huggingface/transformers/commit/80ca92470938bbcc348e2d9cf4734c7c25cb1c43
CVE ID: CVE-2023-2801 State: PUBLISHED Published: 2023-06-06T18:03:32.459Z Last Updated: 2025-02-13T16:45:38.503Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Grafana Products: Grafana, Grafana Enterprise Problem Types: CWE-820 Description: Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly. This might enable malicious users to crash Gr
s, but it's also possible to cause this by calling the query API directly. This might enable malicious users to crash Grafana instances through that endpoint. Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://grafana.com/security/security-advisories/cve-2023-2801/ - https://security.netapp.com/advisory/ntap-20230706-0002/
CVE ID: CVE-2023-2802 State: PUBLISHED Published: 2023-08-14T19:10:20.199Z Last Updated: 2024-10-09T13:20:30.277Z Vendors: Unknown Products: Ultimate Addons for Contact Form 7 Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c5cc136a-2fa6-44ff-b5b5-26d367
rogram Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c5cc136a-2fa6-44ff-b5b5-26d367937df9
CVE ID: CVE-2023-2803 State: PUBLISHED Published: 2023-08-14T19:10:17.443Z Last Updated: 2024-10-09T13:22:02.104Z Vendors: Unknown Products: Ultimate Addons for Contact Form 7 Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ec640d47-bb22-478d-9668-1dab72f12f8d
CVE ID: CVE-2023-2804 State: PUBLISHED Published: 2023-05-25T00:00:00 Last Updated: 2025-01-16T15:17:27.071Z Vendors: n/a Products: libjpeg-turbo Problem Types: CWE-122 Description: A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrgext.c file. The vulnerability can only be exploited with 12-bit data precision for which the range of the sample data type exceeds the valid sample range, hence, an attacker could craft a 12-bit lossless JPEG image that contains out-of-range 12-bit samples. An application attempting to decompress such image using merged upsampling would lead to segmentation fault or buffer overflows, causing an a
ting to decompress such image using merged upsampling would lead to segmentation fault or buffer overflows, causing an application to crash. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libjpeg-turbo/libjpeg-turbo/issues/675 - https://bugzilla.redhat.com/show_bug.cgi?id=2208447 - https://access.redhat.com/security/cve/CVE-2023-2804 - https://github.com/libjpeg-turbo/libjpeg-turbo/commit/9f756bc67a84d4566bf74a0c2432aa55da404021 - https://github.com/libjpeg-turbo/libjpeg-turbo/issues/668#issuecomment-1492586118 - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01006.html