Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-26152 State: PUBLISHED Published: 2023-10-03T05:00:02.779Z Last Updated: 2024-09-23T13:30:21.983Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P) Vendors: n/a Products: static-server Problem Types: CWE-22 Description: All versions of the package static-server are vulnerable to Directory Traversal due to improper input sanitization passed via the validPath function of server.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-STATICSERVER-5722341 - https://gist.github.com/lirantal/1f7021703a2065ecaf9ec9e06a3a346d - https://github.com/nbluis/static-server/blob/master/serv
s://gist.github.com/lirantal/1f7021703a2065ecaf9ec9e06a3a346d - https://github.com/nbluis/static-server/blob/master/server.js%23L218-L223
CVE ID: CVE-2023-26153 State: PUBLISHED Published: 2023-10-06T05:00:01.453Z Last Updated: 2024-09-19T18:33:07.893Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P) Vendors: n/a Products: geokit-rails Problem Types: CWE-78 Description: Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie. This issue can be exploited remotely via a malicious cookie value. **Note:** An attacker can use this vulnerability to execute commands on the host system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-
ional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-RUBY-GEOKITRAILS-5920323 - https://gist.github.com/CalumHutton/b7aa1c2e71c8d4386463ac14f686901d - https://github.com/geokit/geokit-rails/blob/master/lib/geokit-rails/ip_geocode_lookup.rb%23L37 - https://github.com/geokit/geokit-rails/commit/7ffc5813e57f6f417987043e1039925fd0865c43 - https://github.com/geokit/geokit-rails/commit/a93dfe49fb9aeae7164e2f8c4041450a04b5482f
CVE ID: CVE-2023-26154 State: PUBLISHED Published: 2023-12-06T05:00:02.795Z Last Updated: 2024-08-02T11:39:06.653Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: pubnub, com.pubnub:pubnub, Pubnub, github.com/pubnub/go, github.com/pubnub/go/v7, pubnub/pubnub, pubnub/c-core, com.pubnub:pubnub-kotlin, pubnub/swift, PubNub Problem Types: CWE-331 Description: Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0;
om/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0; versions of the package pubnub before 0.4.0; versions of the package pubnub/c-core before 4.5.0; versions of the package com.pubnub:pubnub-kotlin before 7.7.0; versions of the package pubnub/swift before 6.2.0; versions of the package pubnub before 5.2.0; versions of the package pubnub before 4.3.0 are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less se
, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file. **Note:** In order to exploit this vulnerability, the attacker needs to invest resources in preparing the attack and brute-force the encryption. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-PUBNUB-5840690 - https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098371 - https://security.snyk.io/vuln/SNYK-DOTNET-PUBNUB-6098372 - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGO-
https://security.snyk.io/vuln/SNYK-DOTNET-PUBNUB-6098372 - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGO-6098373 - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGOV7-6098374 - https://security.snyk.io/vuln/SNYK-PYTHON-PUBNUB-6098375 - https://security.snyk.io/vuln/SNYK-PHP-PUBNUBPUBNUB-6098376 - https://security.snyk.io/vuln/SNYK-RUBY-PUBNUB-6098377 - https://security.snyk.io/vuln/SNYK-RUST-PUBNUB-6098378 - https://security.snyk.io/vuln/SNYK-UNMANAGED-PUBNUBCCORE-6098379 - https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098380 - https://security.snyk.io/vuln/SNYK-SWIFT-PUBNUBSWIFT-6098381 - https://security.snyk.io/vuln/SNYK-COCOAPODS-PUBNUB-6098384 - https://sec
.snyk.io/vuln/SNYK-SWIFT-PUBNUBSWIFT-6098381 - https://security.snyk.io/vuln/SNYK-COCOAPODS-PUBNUB-6098384 - https://security.snyk.io/vuln/SNYK-PUB-PUBNUB-6098385 - https://gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0 - https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js%23L70 - https://github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119
CVE ID: CVE-2023-26155 State: PUBLISHED Published: 2023-10-14T05:00:00.965Z Last Updated: 2024-09-17T13:35:42.463Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: node-qpdf Problem Types: CWE-78 Description: All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize its parameter input, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they can specify the input pdf file path. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNY
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-NODEQPDF-5747918 - https://github.com/nrhirani/node-qpdf/issues/23
CVE ID: CVE-2023-26156 State: PUBLISHED Published: 2023-11-09T05:00:01.023Z Last Updated: 2024-09-04T13:41:09.422Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: chromedriver Problem Types: CWE-78 Description: Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This could lead to unauthorized access and potentially malicious actions on the host system. **Note:** An attacker must have access to the system running the vulnerable chromedriver library to exploit it. The success of exploitation also depends on the permissions and privileges of
rable chromedriver library to exploit it. The success of exploitation also depends on the permissions and privileges of the process running chromedriver. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-CHROMEDRIVER-6049539 - https://gist.github.com/mcoimbra/47b1da554a80795c45126d51e41b2b18 - https://github.com/giggio/node-chromedriver/commit/de961e34e023afcf4fa5c0faeeec69aaa6c3c815
CVE ID: CVE-2023-26157 State: PUBLISHED Published: 2024-01-02T05:00:02.461Z Last Updated: 2024-11-14T19:31:31.880Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: libredwg Problem Types: CWE-400 Description: Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section->num_pages in decode_r2007.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBREDWG-6070730 - https://github.com/LibreDWG/libredwg/commit/c8cf03ce4c2315b146caf582ea061c0460193bcc - https://github.com/LibreDWG/
30 - https://github.com/LibreDWG/libredwg/commit/c8cf03ce4c2315b146caf582ea061c0460193bcc - https://github.com/LibreDWG/libredwg/issues/850
CVE ID: CVE-2023-26158 State: PUBLISHED Published: 2023-12-08T05:00:01.350Z Last Updated: 2024-08-02T11:39:06.604Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:P) Vendors: n/a Products: mockjs Problem Types: CWE-1321 Description: All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the object prototype. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attrib
tes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). User controlled inputs inside the extend() method of the Mock.Handler, Mock.Random, Mock.RE.Handler or Mock.Util, will allow an attacker to exploit this vulnerability. Workaround By using a denylist of dangerous attributes, this weakness can be eliminated. Add the following line in the Util.extend function: js js if (["__proto__", "constructor", "prototype"].includes(name)) continue js // src/mock/handler.js Util.extend = function extend() { var target = arguments[0] || {
pe"].includes(name)) continue js // src/mock/handler.js Util.extend = function extend() { var target = arguments[0] || {}, i = 1, length = arguments.length, options, name, src, copy, clone if (length === 1) { target = this i = 0 } for (; i < length; i++) { options = arguments[i] if (!options) continue for (name in options) { if (["__proto__", "constructor", "prototype"].includes(name)) continue src = target[name] copy = options[name] if (target === copy) continue if (copy === undefined) continue if (Util.isArray(copy) || Util.isObject(copy)) { if (Util.isArray(copy)) clone = src && Util.isArray(src) ? src : [] if (Util.isObject(copy)) clone = src && Util.isObject(src) ? src : {} target[name]
= src && Util.isArray(src) ? src : [] if (Util.isObject(copy)) clone = src && Util.isObject(src) ? src : {} target[name] = Util.extend(clone, copy) } else { target[name] = copy } } } return target } Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-MOCKJS-6051365 - https://github.com/nuysoft/Mock/blob/00ce04b92eb464e664a4438430903f2de96efb47/dist/mock.js%23L721-L755
CVE ID: CVE-2023-26159 State: PUBLISHED Published: 2024-01-02T05:00:00.659Z Last Updated: 2025-11-03T21:47:30.161Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: follow-redirects Problem Types: CWE-20 Description: Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches. Additional A
alicious site, potentially leading to information disclosure, phishing attacks, or other security breaches. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-6141137 - https://github.com/follow-redirects/follow-redirects/issues/235 - https://github.com/follow-redirects/follow-redirects/pull/236 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZ425BFKNBQ6AK7I5SAM56TWON5OF2XM/
CVE ID: CVE-2023-26203 State: PUBLISHED Published: 2023-05-03T21:27:00.343Z Last Updated: 2024-10-23T14:27:47.396Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiNAC Problem Types: CWE-798 Description: A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions may allow an authenticated attacker to access to the database via shell commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-520
CVE ID: CVE-2023-26204 State: PUBLISHED Published: 2023-06-13T08:41:46.337Z Last Updated: 2024-10-22T20:45:34.996Z Severity: LOW (CVSS 3.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:U/RC:C) Vendors: Fortinet Products: FortiSIEM Problem Types: CWE-256 Description: A plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions may allow an attacker able to access user DB content to impersonate any admin user on the device GUI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
in user on the device GUI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-141
CVE ID: CVE-2023-26205 State: PUBLISHED Published: 2023-11-14T18:05:48.807Z Last Updated: 2024-10-22T20:52:47.757Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:F/RL:U/RC:C) Vendors: Fortinet Products: FortiADC Problem Types: CWE-284 Description: An improper access control vulnerability [CWE-284] in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated low-privileged attacker to escalate their privileges to super_admin via a specific crafted configuration of fabric automation CLI script. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortigua
n CLI script. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-292
CVE ID: CVE-2023-26206 State: PUBLISHED Published: 2024-02-15T13:59:23.207Z Last Updated: 2024-08-02T11:39:06.654Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:U/RL:X/RC:X) Vendors: Fortinet Products: FortiNAC Problem Types: CWE-79 Description: An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC 9.4.0 - 9.4.2, 9.2.0 - 9.2.8, 9.1.0 - 9.1.10 and 7.2.0 allows an attacker to execute unauthorized code or commands via the name fields observed in the policy audit logs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-063
CVE ID: CVE-2023-26207 State: PUBLISHED Published: 2023-06-13T08:41:45.823Z Last Updated: 2024-10-22T20:45:42.886Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:C) Vendors: Fortinet Products: FortiProxy, FortiOS Problem Types: CWE-532 Description: An insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4 and FortiProxy 7.0.0 through 7.0.10. 7.2.0 through 7.2.1 allows an attacker to read certain passwords in plain text. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-455
CVE ID: CVE-2023-26208 State: PUBLISHED Published: 2023-03-09T14:55:08.396Z Last Updated: 2024-10-22T20:47:53.846Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:X) Vendors: Fortinet Products: FortiAuthenticator Problem Types: CWE-307 Description: A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiAuthenticator 6.4.x and before allows a remote unauthenticated attacker to partially exhaust CPU and memory via sending numerous HTTP requests to the login form. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-20-078
CVE ID: CVE-2023-26209 State: PUBLISHED Published: 2023-03-09T14:55:17.873Z Last Updated: 2024-10-22T20:47:45.870Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:X) Vendors: Fortinet Products: FortiDeceptor Problem Types: CWE-307 Description: A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiDeceptor 3.1.x and before allows a remote unauthenticated attacker to partially exhaust CPU and memory via sending numerous HTTP requests to the login form. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-20-078
CVE ID: CVE-2023-26210 State: PUBLISHED Published: 2023-06-13T08:41:46.873Z Last Updated: 2024-10-23T14:26:13.951Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:C) Vendors: Fortinet Products: FortiADCManager, FortiADC Problem Types: CWE-78 Description: Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] in Fortinet FortiADCManager version 7.1.0 and before 7.0.0, FortiADC version 7.2.0 and before 7.1.2 allows a local authenticated attacker to execute arbitrary shell code as `root` user via crafted CLI requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
de as `root` user via crafted CLI requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-076
CVE ID: CVE-2023-26211 State: PUBLISHED Published: 2024-08-13T15:51:56.864Z Last Updated: 2024-08-13T16:00:04.582Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:X) Vendors: Fortinet Products: FortiSOAR Problem Types: CWE-79 Description: An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSOAR 7.3.0 through 7.3.2 allows an authenticated, remote attacker to inject arbitrary web script or HTML via the Communications module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-088
CVE ID: CVE-2023-26213 State: PUBLISHED Published: 2023-03-03T00:00:00.000Z Last Updated: 2025-03-07T15:55:49.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_certificate - a crafted HTTP request allows an authenticated attacker to execute arbitrary commands. For example, a name field can contain :password and a password field can contain shell metacharacters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.barracuda.com/products/network-security/cloudgen-wan - http:/
tainer: - CISA ADP Vulnrichment: References: - https://www.barracuda.com/products/network-security/cloudgen-wan - http://seclists.org/fulldisclosure/2023/Mar/2 - https://sec-consult.com/vulnerability-lab/advisory/os-command-injection-in-barracuda-cloudgen-wan/ - https://campus.barracuda.com/product/cloudgenwan/doc/96024723/release-notes-8-3-1/
CVE ID: CVE-2023-26214 State: PUBLISHED Published: 2023-02-22T00:00:00.000Z Last Updated: 2025-03-12T16:02:30.926Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: TIBCO Software Inc. Products: TIBCO BusinessConnect Problem Types: In the worst case, if the victim is a privileged administrator, successful execution of these vulnerabilities can result in an attacker gaining full administrative access to the affected system. Description: The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker with network access to execute s
flected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO BusinessConnect: versions 7.3.0 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tibco.com/services/support/advisories
CVE ID: CVE-2023-26215 State: PUBLISHED Published: 2023-05-25T18:41:43.701Z Last Updated: 2025-01-16T18:38:07.866Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: TIBCO Software Inc. Products: TIBCO EBX Add-ons Problem Types: Any application user can potentially read files that would normally only be accessible by server administrators. Description: The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that allows an attacker with low-privileged application access to read system files that are accessible to the web server. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 4.5.16 and below. Additional Ana
the web server. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 4.5.16 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tibco.com/services/support/advisories
CVE ID: CVE-2023-26216 State: PUBLISHED Published: 2023-05-25T18:38:21.403Z Last Updated: 2025-01-16T19:13:55.888Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: TIBCO Software Inc. Products: TIBCO EBX Add-ons Problem Types: An application administrator without access to the underlying server could upload files that may be evaluated by the web server allowing them to perform actions with the privileges of the web server. Description: The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an exploitable vulnerability that allows an attacker to upload files to a directory accessible by the web server. Affected releases are TIBCO Software I
t allows an attacker to upload files to a directory accessible by the web server. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 4.5.16 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tibco.com/services/support/advisories
CVE ID: CVE-2023-26217 State: PUBLISHED Published: 2023-07-19T20:36:45.528Z Last Updated: 2024-10-24T17:36:09.865Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: TIBCO Software Inc. Products: TIBCO EBX Add-ons Problem Types: CWE-89 Description: The Data Exchange Add-on component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged user with import permissions and network access to the EBX server to execute arbitrary SQL statements on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 4.5.17 and below, versions 5.6.2 and below, version 6.1.0. Additional An
BCO Software Inc.'s TIBCO EBX Add-ons: versions 4.5.17 and below, versions 5.6.2 and below, version 6.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tibco.com/services/support/advisories
CVE ID: CVE-2023-26218 State: PUBLISHED Published: 2023-09-29T17:07:11.618Z Last Updated: 2024-09-23T16:26:35.804Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: TIBCO Software Inc. Products: TIBCO Nimbus Problem Types: CWE-79 Description: The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the victim's local system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. A