Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-42308 State: PUBLISHED Published: 2024-03-12T00:00:00 Last Updated: 2024-08-21T15:15:22.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Manage Fastrack Subjects in Code-Projects Exam Form Submission 1.0 allows attackers to run arbitrary code via the "Subject Name" and "Subject Code" Section. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ASR511-OO7/CVE-2023-42308/blob/main/CVE-7
CVE ID: CVE-2023-42319 State: PUBLISHED Published: 2023-10-18T00:00:00 Last Updated: 2024-09-13T16:28:14.721Z Vendors: n/a Products: n/a Problem Types: n/a Description: Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint [is not] designed to withstand attacks by hostile clients, nor handle huge amounts of clients/traffic. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://geth.ethereum.org/docs/fundamentals/security - https://blog.mevsec.com/posts/geth-d
Vulnrichment: References: - https://geth.ethereum.org/docs/fundamentals/security - https://blog.mevsec.com/posts/geth-dos-with-graphql/
CVE ID: CVE-2023-42320 State: PUBLISHED Published: 2023-09-18T00:00:00 Last Updated: 2024-09-25T17:23:24.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Tenda AC10V4 v.US_AC10V4.0si_V16.03.10.13_cn_TDC01 allows a remote attacker to cause a denial of service via the mac parameter in the GetParentControlInfo function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/aixiao0621/Tenda/blob/main/AC10/0.md
CVE ID: CVE-2023-42321 State: PUBLISHED Published: 2023-09-20T00:00:00 Last Updated: 2024-09-25T14:09:56.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability in icmsdev iCMSv.7.0.16 allows a remote attacker to execute arbitrary code via the user.admincp.php, members.admincp.php, and group.admincp.php files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.icmsdev.com/ - https://gist.github.com/ChubbyZ/cb4b8fd818846dec3e9d70863e7955bc
CVE ID: CVE-2023-42322 State: PUBLISHED Published: 2023-09-20T00:00:00 Last Updated: 2024-09-24T20:30:56.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.icmsdev.com/ - https://gist.github.com/ChubbyZ/0ddb9772231d9a8c5b5345883abcb0a6
CVE ID: CVE-2023-42323 State: PUBLISHED Published: 2023-10-30T00:00:00 Last Updated: 2024-09-09T20:02:19.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability in DouHaocms v.3.3 allows a remote attacker to execute arbitrary code via the adminAction.class.php file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mnbvcxz131421/douhaocms/blob/main/README.md
CVE ID: CVE-2023-42325 State: PUBLISHED Published: 2023-11-14T00:00:00 Last Updated: 2024-11-26T21:04:40.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dynamic.php page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.netgate.com/downloads/pfSense-SA-23_09.webgui.asc - https://www.sonarsource.com/blog/pfsense-vulnerabilities-sonarcloud/
CVE ID: CVE-2023-42326 State: PUBLISHED Published: 2023-11-14T00:00:00 Last Updated: 2024-08-02T19:16:51.038Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components. Additional Analyst Notes: - CVE Program Container: References: - https://docs.netgate.com/downloads/pfSense-SA-23_10.webgui.asc - https://www.sonarsource.com/blog/pfsense-vulnerabilities-sonarcloud/
CVE ID: CVE-2023-42327 State: PUBLISHED Published: 2023-11-14T00:00:00 Last Updated: 2024-08-02T19:16:51.036Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.php page. Additional Analyst Notes: - CVE Program Container: References: - https://docs.netgate.com/downloads/pfSense-SA-23_08.webgui.asc - https://www.sonarsource.com/blog/pfsense-vulnerabilities-sonarcloud/
CVE ID: CVE-2023-42328 State: PUBLISHED Published: 2023-09-18T00:00:00 Last Updated: 2024-09-25T17:58:39.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the hardcoded session cookie. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://peppermint.sh/ - https://blockomat2100.github.io/posts/2023-09-04-damn-vulnerable-ticket-system/ - https://github.com/Peppermint-Lab/peppermint/blob/446a20b870bc68157eaafcb7275c289d76bfb29e/apps/client/pages/api/auth/%5B...nextauth%5D.js#L65
CVE ID: CVE-2023-42331 State: PUBLISHED Published: 2023-09-20T00:00:00 Last Updated: 2024-09-25T14:01:56.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: A file upload vulnerability in EliteCMS v1.01 allows a remote attacker to execute arbitrary code via the manage_uploads.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Num-Nine/CVE/issues/2 - https://github.com/Num-Nine/CVE/issues/4 - https://github.com/Num-Nine/CVE/wiki/Any-file-is-uploaded-to-eliteCMS1.01
CVE ID: CVE-2023-42334 State: PUBLISHED Published: 2023-09-20T00:00:00 Last Updated: 2024-09-25T13:56:42.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Indirect Object Reference (IDOR) in Fl3xx Dispatch 2.10.37 and fl3xx Crew 2.10.37 allows a remote attacker to escalate privileges via the user parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://0xhunter20.medium.com/an-idor-lead-to-viewing-other-users-files-cve-2023-42334-702de328c453
CVE ID: CVE-2023-42335 State: PUBLISHED Published: 2023-09-20T00:00:00 Last Updated: 2024-09-25T13:45:08.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted File Upload vulnerability in Fl3xx Dispatch 2.10.37 and fl3xx Crew 2.10.37 allows a remote attacker to execute arbitrary code via the add attachment function in the New Expense component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://0xhunter20.medium.com/how-i-found-unrestricted-file-upload-in-fl3xx-ios-app-cve-2023-42335-6b1a72da6d65
CVE ID: CVE-2023-42336 State: PUBLISHED Published: 2023-09-16T00:00:00 Last Updated: 2024-09-25T18:02:14.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in NETIS SYSTEMS WF2409Ev4 v.1.0.1.705 allows a remote attacker to execute arbitrary code and obtain sensitive information via the password parameter in the /etc/shadow.sample component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/adhikara13/CVE/blob/main/netis_WF2409E/Root_Hard_Code.md
CVE ID: CVE-2023-42358 State: PUBLISHED Published: 2024-01-03T00:00:00.000Z Last Updated: 2025-06-18T15:26:14.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial of service (DoS) via a crafted request to the E2Manager API component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.o-ran-sc.org/browse/RIC-1009
CVE ID: CVE-2023-42359 State: PUBLISHED Published: 2023-09-18T00:00:00 Last Updated: 2024-09-25T17:51:08.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Exam Form Submission in PHP with Source Code v.1.0 allows a remote attacker to escalate privileges via the val-username parameter in /index.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://upbeat-washer-def.notion.site/Exam-Form-Submission-In-PHP-SQL-Injection-in-index-php-bd71962db712459488019d531ab2f6f2?pvs=4
CVE ID: CVE-2023-42361 State: PUBLISHED Published: 2023-11-07T00:00:00 Last Updated: 2024-09-05T13:22:24.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: Local File Inclusion vulnerability in Midori-global Better PDF Exporter for Jira Server and Jira Data Center v.10.3.0 and before allows an attacker to view arbitrary files and cause other impacts via use of crafted image during PDF export. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://marketplace.atlassian.com/apps/5167/better-pdf-exporter-for-jira?tab=versions&hosting=server - https://marketplace.atlassian.com/apps/5167/better-pdf-exporter-for-jira?tab=versions&hosting=data
ions&hosting=server - https://marketplace.atlassian.com/apps/5167/better-pdf-exporter-for-jira?tab=versions&hosting=datacenter - https://gccybermonks.com/posts/pdfjira/
CVE ID: CVE-2023-42362 State: PUBLISHED Published: 2023-09-14T00:00:00 Last Updated: 2024-09-25T18:24:18.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in Teller Web App v.4.4.0 allows a remote attacker to execute arbitrary commands and obtain sensitive information via uploading a crafted file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Mr-n0b3dy/CVE-2023-42362
CVE ID: CVE-2023-42363 State: PUBLISHED Published: 2023-11-27T00:00:00 Last Updated: 2024-08-02T19:16:50.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.busybox.net/show_bug.cgi?id=15865
CVE ID: CVE-2023-42364 State: PUBLISHED Published: 2023-11-27T00:00:00.000Z Last Updated: 2025-11-03T20:35:58.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.busybox.net/show_bug.cgi?id=15868
CVE ID: CVE-2023-42365 State: PUBLISHED Published: 2023-11-27T00:00:00.000Z Last Updated: 2025-11-03T20:35:59.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.busybox.net/show_bug.cgi?id=15871
CVE ID: CVE-2023-42366 State: PUBLISHED Published: 2023-11-27T00:00:00 Last Updated: 2024-12-06T13:09:27.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.busybox.net/show_bug.cgi?id=15874
CVE ID: CVE-2023-42371 State: PUBLISHED Published: 2023-09-18T00:00:00 Last Updated: 2024-09-25T17:48:50.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Summernote Rich Text Editor v.0.8.18 and before allows a remote attacker to execute arbitrary code via a crafted script to the insert link function in the editor component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://summernote.org/ - https://hacker.soarescorp.com/cve/2023-42371/
CVE ID: CVE-2023-42374 State: PUBLISHED Published: 2024-02-13T00:00:00.000Z Last Updated: 2025-04-24T15:40:49.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in mystenlabs Sui Blockchain before v.1.6.3 allow a remote attacker to execute arbitrary code and cause a denial of service via a crafted compressed script to the Sui node component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://medium.com/%40Beosin_com/memory-bomb-vulnerability-causes-sui-node-to-crash-7e8e3ef5057c - https://github.com/MystenLabs/sui/commit/42d4ad103a21d23fecd7c0271453da41604e71e9 - https://beosin.com/resources/%22memory-bomb%22-vulnerability-
Labs/sui/commit/42d4ad103a21d23fecd7c0271453da41604e71e9 - https://beosin.com/resources/%22memory-bomb%22-vulnerability-causes-sui-node-to-crash?lang=en-US
CVE ID: CVE-2023-42387 State: PUBLISHED Published: 2023-09-18T00:00:00 Last Updated: 2024-09-25T17:47:57.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in TDSQL Chitu management platform v.10.3.19.5.0 allows a remote attacker to obtain sensitive information via get_db_info function in install.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ranhn/TDSQL.git - https://github.com/ranhn/TDSQL
CVE ID: CVE-2023-42398 State: PUBLISHED Published: 2023-09-15T00:00:00 Last Updated: 2024-09-25T15:28:49.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in zzCMS v.2023 allows a remote attacker to execute arbitrary code and obtain sensitive information via the ueditor component in controller.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/laterfuture/php-audit/blob/main/CVE-2023-42398%E2%80%94%E2%80%94ZZCMS2023%20SSRF
CVE ID: CVE-2023-42399 State: PUBLISHED Published: 2023-09-19T00:00:00 Last Updated: 2024-09-24T20:37:02.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via the rich text editor component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://jodit.com - https://xdsoft.net - https://github.com/xdan/jodit/issues/1017
CVE ID: CVE-2023-42404 State: PUBLISHED Published: 2025-04-28T00:00:00.000Z Last Updated: 2025-04-28T17:52:21.479Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: OneVision Products: Workspace Problem Types: CWE-94 Description: OneVision Workspace before WS23.1 SR1 (build w31.040) allows arbitrary Java EL execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.onevision.com/ - https://code-white.com/public-vulnerability-list/
CVE ID: CVE-2023-42405 State: PUBLISHED Published: 2023-09-14T00:00:00 Last Updated: 2024-09-25T18:23:07.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in FIT2CLOUD RackShift v1.7.1 allows attackers to execute arbitrary code via the `sort` parameter to taskService.list(), bareMetalService.list(), and switchService.list(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/fit2cloud/rackshift/issues/79
CVE ID: CVE-2023-42406 State: PUBLISHED Published: 2023-10-26T00:00:00 Last Updated: 2024-09-10T19:36:34.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in D-Link Online behavior audit gateway DAR-7000 V31R02B1413C allows a remote attacker to obtain sensitive information and execute arbitrary code via the editrole.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/flyyue2001/cve/blob/main/D-LINK%20-DAR-7000_sql_:sysmanage:editrole.php.md - https://github.com/1dreamGN/CVE/blob/main/CVE-2023-42406.md
CVE ID: CVE-2023-42419 State: PUBLISHED Published: 2024-03-05T05:23:16.947Z Last Updated: 2024-08-02T19:16:51.043Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: Cybellum Products: Maintenance Server Problem Types: cwe-321 Use of Hard-coded Cryptographic Key Description: Maintenance Server, in Cybellum's QCOW air-gapped distribution (China Edition), versions 2.15.5 through 2.27, was compiled with a hard-coded private cryptographic key. An attacker with administrative privileges & access to the air-gapped server could potentially use this key to run commands on the server. The issue was resolved in version 2.28. Earlier versions, including all Cybellum 1.x vers
to run commands on the server. The issue was resolved in version 2.28. Earlier versions, including all Cybellum 1.x versions, and distributions for the rest of the world remain unaffected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cybellum.com/
CVE ID: CVE-2023-42425 State: PUBLISHED Published: 2023-10-31T00:00:00 Last Updated: 2024-09-12T13:46:41.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Turing Video Turing Edge+ EVC5FD v.1.38.6 allows remote attacker to execute arbitrary code and obtain sensitive information via the cloud connection components. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://turing.com - https://gist.github.com/stevenliuturing/306bb689737cec5d3a5760c34d65932c
CVE ID: CVE-2023-42426 State: PUBLISHED Published: 2023-09-25T00:00:00 Last Updated: 2024-09-24T17:31:05.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Froala Froala Editor v.4.1.1 allows remote attackers to execute arbitrary code via the 'Insert link' parameter in the 'Insert Image' component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://froala.com - https://www.youtube.com/watch?v=Me33Dx1_XqQ - https://github.com/b0marek/CVE-2023-42426
CVE ID: CVE-2023-42427 State: PUBLISHED Published: 2024-06-03T03:44:54.434Z Last Updated: 2024-08-02T19:16:51.029Z Vendors: Japan System Techniques Co., Ltd. Products: UNIVERSAL PASSPORT RX Problem Types: Cross-site scripting (XSS) Description: Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.7, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is using the product. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jast-gakuen.com/products/unipa/ - https://jvn.jp/en/jp/JVN43215077/
CVE ID: CVE-2023-42428 State: PUBLISHED Published: 2023-11-17T04:37:21.879Z Last Updated: 2024-08-02T19:16:51.154Z Vendors: CubeCart Limited Products: CubeCart Problem Types: Directory traversal Description: Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to delete directories and files in the system. Additional Analyst Notes: - CVE Program Container: References: - https://forums.cubecart.com/topic/58736-cubecart-653-released-security-update/ - https://jvn.jp/en/jp/JVN22220399/
CVE ID: CVE-2023-42429 State: PUBLISHED Published: 2024-01-19T20:03:08.555Z Last Updated: 2025-06-17T21:19:23.535Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel NUC BIOS firmware Problem Types: escalation of privilege, CWE-92 Description: Improper buffer restrictions in some Intel NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01028.html
CVE ID: CVE-2023-42431 State: PUBLISHED Published: 2023-10-30T10:48:21.487Z Last Updated: 2024-09-06T18:06:33.247Z Severity: LOW (CVSS 2.1 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: Hallo Welt! GmbH Products: BlueSpice Problem Types: CWE-20 Description: Cross-site Scripting (XSS) vulnerability in BlueSpiceAvatars extension of BlueSpice allows logged in user to inject arbitrary HTML into the profile image dialog on Special:Preferences. This only applies to the genuine user context. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2023-02
CVE ID: CVE-2023-42433 State: PUBLISHED Published: 2024-05-16T20:47:38.359Z Last Updated: 2024-08-02T19:16:51.052Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Endurance Gaming Mode software installers Problem Types: escalation of privilege, CWE-276 Description: Incorrect default permissions in some Endurance Gaming Mode software installers before version 1.3.937.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00965.html
CVE ID: CVE-2023-42435 State: PUBLISHED Published: 2023-10-19T18:19:28.035Z Last Updated: 2024-09-11T20:09:11.707Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: DEXMA Products: DexGate Problem Types: CWE-352 Description: The affected product is vulnerable to a cross-site request forgery vulnerability, which may allow an attacker to perform actions with the permissions of a victim user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-271-02
CVE ID: CVE-2023-42436 State: PUBLISHED Published: 2023-12-26T07:22:50.373Z Last Updated: 2024-08-02T19:16:51.003Z Vendors: WESEEK, Inc. Products: GROWI Problem Types: Cross-site scripting (XSS) Description: Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product. Additional Analyst Notes: - CVE Program Container: References: - https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/ - https://jvn.jp/en/jp/JVN18715935/
CVE ID: CVE-2023-42437 State: REJECTED Published: N/A Last Updated: 2025-02-13T17:09:18.914Z Description: No description available.
CVE ID: CVE-2023-42438 State: PUBLISHED Published: 2023-10-25T18:31:56.057Z Last Updated: 2025-02-13T17:09:19.433Z Vendors: Apple Products: macOS Problem Types: Visiting a malicious website may lead to user interface spoofing Description: An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.1. Visiting a malicious website may lead to user interface spoofing. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213984 - https://support.apple.com/kb/HT213984 - http://seclists.org/fulldisclosure/2023/Oct/24
CVE ID: CVE-2023-42439 State: PUBLISHED Published: 2023-09-15T20:22:19.102Z Last Updated: 2024-09-25T17:28:23.632Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: GeoNode Products: geonode Problem Types: CWE-918 Description: GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returning any data from the internal network. The application is using a whitelist, but the whitelist can be bypassed. The bypass will trick the applicat