Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-3449 State: PUBLISHED Published: 2023-06-28T17:31:02.974Z Last Updated: 2024-08-02T06:55:03.607Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBOS Products: OA Problem Types: CWE-89 Description: A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects the function actionExport of the file ?r=recruit/interview/export&interviews=x of the component Interview Management Export. The manipulation of the argument interviews leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-232546 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted e
he public and may be used. VDB-232546 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.232546 - https://vuldb.com/?ctiid.232546 - https://github.com/MinimoAgoni/cve/blob/main/iboa%20oa.md
CVE ID: CVE-2023-3450 State: PUBLISHED Published: 2023-06-28T18:00:04.678Z Last Updated: 2024-11-08T18:09:15.715Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: Ruijie Products: RG-BCR860 Problem Types: CWE-78 Description: A vulnerability was found in Ruijie RG-BCR860 2.5.13 and classified as critical. This issue affects some unknown processing of the component Network Diagnostic Page. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-232547. NOTE: The vendor was contacted early about this disclosure but did not respond in any
this vulnerability is VDB-232547. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.232547 - https://vuldb.com/?ctiid.232547 - https://github.com/RCEraser/cve/blob/main/RG-BCR860.md
CVE ID: CVE-2023-3451 State: REJECTED Published: N/A Last Updated: 2023-07-26T22:55:02.316Z Description: No description available.
CVE ID: CVE-2023-3452 State: PUBLISHED Published: 2023-08-12T02:05:19.117Z Last Updated: 2024-10-11T16:54:05.577Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: flightbycanto Products: Canto Problem Types: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Description: The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit les
remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a76077c6-700a-4d21-a930-b0d6455d959c?source=cve - https://plugins.trac.wordpress.org/browser/canto/trunk/includes/lib/tree.php?rev=2841358#L5 - https://plugins.trac.wordpress.org/changeset/2951888/canto/trunk/includes/lib/tree.php
CVE ID: CVE-2023-3453 State: PUBLISHED Published: 2023-08-23T21:14:17.553Z Last Updated: 2024-09-30T19:13:47.408Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: ETIC Telecom Products: Remote Access Server (RAS) Problem Types: CWE-1188 Description: ETIC Telecom RAS versions 4.7.0 and prior the web management portal authentication disabled by default. This could allow an attacker with adjacent network access to alter the configuration of the device or cause a denial-of-service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-208-01
CVE ID: CVE-2023-3454 State: PUBLISHED Published: 2024-04-04T17:03:54.171Z Last Updated: 2025-02-13T16:55:37.820Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Brocade Products: Fabric OS Problem Types: CWE-78 Description: Remote code execution (RCE) vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow an attacker to execute arbitrary code and use this to gain root access to the Brocade switch. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/23215 - https://security.netapp.com/advisory/ntap-20240628-0004/
CVE ID: CVE-2023-3455 State: PUBLISHED Published: 2023-07-05T12:19:46.945Z Last Updated: 2024-11-20T21:16:12.867Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-200 Description: Key management vulnerability on system. Successful exploitation of this vulnerability may affect service availability and integrity. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2023/7/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202307-0000001587168858
CVE ID: CVE-2023-3456 State: PUBLISHED Published: 2023-07-06T12:34:21.446Z Last Updated: 2024-11-21T14:12:13.951Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-20 Description: Vulnerability of kernel raw address leakage in the hang detector module. Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2023/7/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202307-0000001587168858
CVE ID: CVE-2023-3457 State: PUBLISHED Published: 2023-06-29T13:31:03.915Z Last Updated: 2024-08-02T06:55:03.495Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Shopping Website Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Shopping Website 1.0. It has been classified as critical. Affected is an unknown function of the file index.php. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-232674 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: Refer
d. VDB-232674 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.232674 - https://vuldb.com/?ctiid.232674 - https://github.com/qwegz/CveList/blob/main/Shopping%20Website%20(E-Commerce)%20%20index.php%20has%20Sqlinjection.pdf
CVE ID: CVE-2023-3458 State: PUBLISHED Published: 2023-06-29T13:31:04.889Z Last Updated: 2024-08-02T06:55:03.351Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Shopping Website Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Shopping Website 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file forgot-password.php. The manipulation of the argument contact leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-232675. Additional Analyst Notes: - C
the public and may be used. The associated identifier of this vulnerability is VDB-232675. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.232675 - https://vuldb.com/?ctiid.232675 - https://github.com/AD-Appledog/CveHubList/blob/main/Shopping%20Website%20(E-Commerce)%20forgot-password.php%20has%20Sqlinjection.pdf
CVE ID: CVE-2023-3459 State: PUBLISHED Published: 2023-07-18T02:39:24.563Z Last Updated: 2024-10-16T18:57:21.392Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: webtoffee Products: Export and Import Users and Customers Problem Types: CWE-863 Incorrect Authorization Description: The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_update_customer' function called via an AJAX action in versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with shop manager-level permissions to change user passwords and potentially take ov
ssible for authenticated attackers, with shop manager-level permissions to change user passwords and potentially take over administrator accounts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/47337214-9cc3-4b12-bb71-9acbab3649b7?source=cve - https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/tags/2.4.1/admin/modules/user/import/import.php#L446 - https://plugins.trac.wordpress.org/changeset/2938705/users-customers-import-export-for-wp-woocommerce#file201
CVE ID: CVE-2023-3460 State: PUBLISHED Published: 2023-07-04T07:23:28.852Z Last Updated: 2024-11-25T16:47:17.644Z Vendors: Unknown Products: Ultimate Member Problem Types: CWE-269 Improper Privilege Management Description: The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/694235c7-4469-4ffd-a722-9225b19e98d7 - https://blog.wpscan.com/hacking-campaign-actively-exploiting-ul
com/vulnerability/694235c7-4469-4ffd-a722-9225b19e98d7 - https://blog.wpscan.com/hacking-campaign-actively-exploiting-ultimate-member-plugin/
CVE ID: CVE-2023-3462 State: PUBLISHED Published: 2023-07-31T22:40:23.432Z Last Updated: 2024-10-21T18:04:40.093Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: HashiCorp Products: Vault, Vault Enterprise Problem Types: CWE-203 Description: HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://di
1.14.1 and 1.13.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2023-24-vaults-ldap-auth-method-allows-for-user-enumeration/56714
CVE ID: CVE-2023-3463 State: PUBLISHED Published: 2023-07-19T13:40:22.326Z Last Updated: 2024-10-21T18:16:08.986Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H) Vendors: GE Digital Products: CIMPLICITY Problem Types: CWE-122 Description: All versions of GE Digital CIMPLICITY that are not adhering to SDG guidance and accepting documents from untrusted sources are vulnerable to memory corruption issues due to insufficient input validation, including issues such as out-of-bounds reads and writes, use-after-free, stack-based buffer overflows, uninitialized pointers, and a heap-based buffer overflow. Successful exploitation could allow an attacker to execute arbitrary co
ized pointers, and a heap-based buffer overflow. Successful exploitation could allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-06
CVE ID: CVE-2023-3464 State: PUBLISHED Published: 2023-06-29T20:31:03.852Z Last Updated: 2024-08-02T06:55:03.356Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SimplePHPscripts Products: Classified Ads Script Problem Types: CWE-79 Description: A vulnerability was found in SimplePHPscripts Classified Ads Script 1.8. It has been classified as problematic. Affected is an unknown function of the file /preview.php of the component URL Parameter Handler. The manipulation of the argument p leads to cross site scripting. It is possible to launch the attack remotely. It is recommended to upgrade the affected component. VDB-232710 is the identifier assigned to this vulnerability. Addition
is recommended to upgrade the affected component. VDB-232710 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.232710 - https://vuldb.com/?ctiid.232710 - https://simplephpscripts.com/guestbook-script-php/guestbook/preview.php
CVE ID: CVE-2023-3465 State: PUBLISHED Published: 2023-06-29T21:00:04.953Z Last Updated: 2024-08-02T06:55:03.573Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SimplePHPscripts Products: Classified Ads Script Problem Types: CWE-79 Description: A vulnerability was found in SimplePHPscripts Classified Ads Script 1.8. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file user.php of the component HTTP POST Request Handler. The manipulation of the argument title leads to cross site scripting. The attack can be launched remotely. It is recommended to upgrade the affected component. The associated identifier of this vulnerability i
aunched remotely. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-232711. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.232711 - https://vuldb.com/?ctiid.232711 - https://simplephpscripts.com/guestbook-script-php/guestbook/preview.php
CVE ID: CVE-2023-3466 State: PUBLISHED Published: 2023-07-19T18:21:05.262Z Last Updated: 2024-10-21T21:09:28.424Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Citrix Products: NetScaler ADC , NetScaler Gateway Problem Types: CWE-20 Description: Reflected Cross-Site Scripting (XSS) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467
CVE ID: CVE-2023-3467 State: PUBLISHED Published: 2023-07-19T18:35:56.843Z Last Updated: 2024-10-24T17:43:49.602Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Citrix Products: NetScaler ADC , NetScaler Gateway Problem Types: CWE-269 Description: Privilege Escalation to root administrator (nsroot) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467
CVE ID: CVE-2023-3469 State: PUBLISHED Published: 2023-06-30T00:00:19.692Z Last Updated: 2024-11-12T15:05:06.489Z Severity: MEDIUM (CVSS 5.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/3565cfc9-82c4-4db8-9b8f-494dd81b56ca - https://github.com/thorsten/phpmyfaq/commit/04a0183c25dd425f4c2bfb5f75b7650b932ae278
CVE ID: CVE-2023-3470 State: PUBLISHED Published: 2023-08-02T15:54:14.218Z Last Updated: 2024-10-22T12:34:45.503Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: F5 Products: BIG-IP Problem Types: CWE-1391 Description: Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. The predictable nature of the password allows an authenticated user with TMSH access to the BIG-IP system, or anyone with physical access to the FIPS HSM, the information required to generate the correct password. On vCMP systems, all Guests share the same deterministic password, allowing those with TMSH access on one Gue
password. On vCMP systems, all Guests share the same deterministic password, allowing those with TMSH access on one Guest to access keys of a different Guest. The following BIG-IP hardware platforms are affected: 10350v-F, i5820-DF, i7820-DF, i15820-DF, 5250v-F, 7200v-F, 10200v-F, 6900-F, 8900-F, 11000-F, and 11050-F. The BIG-IP rSeries r5920-DF and r10920-DF are not affected, nor does the issue affect software FIPS implementations or network HSM configurations. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000135449
CVE ID: CVE-2023-3471 State: PUBLISHED Published: 2023-09-06T04:04:41.149Z Last Updated: 2024-09-26T20:23:16.623Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Panasonic Products: KW Watcher Problem Types: CWE-119 Description: Buffer overflow vulnerability in Panasonic KW Watcher versions 1.00 through 2.82 may allow attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www3.panasonic.biz/ac/e/fasys/software_info/eco/kwwatcher_versioninfo.jsp - https://www3.panasonic.biz/ac/j/fasys/software_info/eco/tol_kwwatcher.jsp
CVE ID: CVE-2023-3472 State: PUBLISHED Published: 2023-09-06T04:05:43.051Z Last Updated: 2024-09-26T20:21:43.039Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Panasonic Products: KW Watcher on Windows Problem Types: CWE-416 Description: Use after free vulnerability in Panasonic KW Watcher versions 1.00 through 2.82 may allow attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www3.panasonic.biz/ac/e/fasys/software_info/eco/kwwatcher_versioninfo.jsp - https://www3.panasonic.biz/ac/j/fasys/software_info/eco/tol_kwwatcher.jsp
CVE ID: CVE-2023-3473 State: PUBLISHED Published: 2023-06-30T06:31:03.791Z Last Updated: 2024-08-02T06:55:03.373Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: Campcodes Products: Retro Cellphone Online Store Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in Campcodes Retro Cellphone Online Store 1.0. Affected is an unknown function of the file /admin/edit_product.php. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-232752. Additional Analyst Notes: - CVE Progra
o the public and may be used. The identifier of this vulnerability is VDB-232752. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.232752 - https://vuldb.com/?ctiid.232752 - https://github.com/E1CHO/cve_hub/blob/main/Retro%20Cellphone%20Online%20Store%20-%20vlun%204.pdf
CVE ID: CVE-2023-3474 State: PUBLISHED Published: 2023-06-30T06:31:04.753Z Last Updated: 2024-11-21T16:00:13.539Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SimplePHPscripts Products: Simple Blog Problem Types: CWE-79 Description: A vulnerability has been found in SimplePHPscripts Simple Blog 3.2 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. It is recommended to upgrade the affected component. The identifier VDB-232753 was assigned to this vulnerability. Additional Analyst Notes: - CVE
e the affected component. The identifier VDB-232753 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.232753 - https://vuldb.com/?ctiid.232753
CVE ID: CVE-2023-3475 State: PUBLISHED Published: 2023-06-30T07:00:05.168Z Last Updated: 2024-08-02T06:55:03.599Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SimplePHPscripts Products: Event Script Problem Types: CWE-79 Description: A vulnerability was found in SimplePHPscripts Event Script 2.1 and classified as problematic. Affected by this issue is some unknown functionality of the file preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. It is recommended to upgrade the affected component. VDB-232754 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Co
ected component. VDB-232754 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.232754 - https://vuldb.com/?ctiid.232754
CVE ID: CVE-2023-3476 State: PUBLISHED Published: 2023-06-30T07:00:06.339Z Last Updated: 2024-08-02T06:55:03.580Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SimplePHPscripts Products: GuestBook Script Problem Types: CWE-79 Description: A vulnerability was found in SimplePHPscripts GuestBook Script 2.2. It has been classified as problematic. This affects an unknown part of the file preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-232755. Additional Analyst Notes: - CVE Prog
affected component. The associated identifier of this vulnerability is VDB-232755. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.232755 - https://vuldb.com/?ctiid.232755
CVE ID: CVE-2023-3477 State: PUBLISHED Published: 2023-06-30T07:31:03.883Z Last Updated: 2024-08-02T06:55:03.558Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: RocketSoft Products: Rocket LMS Problem Types: CWE-79 Description: A vulnerability was found in RocketSoft Rocket LMS 1.7. It has been declared as problematic. This vulnerability affects unknown code of the file /contact/store of the component Contact Form. The manipulation of the argument name/subject/message leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-232756. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.232756
nerability is VDB-232756. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.232756 - https://vuldb.com/?ctiid.232756
CVE ID: CVE-2023-3478 State: PUBLISHED Published: 2023-06-30T12:00:03.793Z Last Updated: 2024-11-26T16:11:36.823Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: IBOS Products: OA Problem Types: CWE-89 Description: A vulnerability classified as critical was found in IBOS OA 4.5.5. Affected by this vulnerability is the function actionEdit of the file ?r=dashboard/roleadmin/edit&op=member of the component Add User Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-232759. NOTE: The vendor was contacted early abo
and may be used. The associated identifier of this vulnerability is VDB-232759. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.232759 - https://vuldb.com/?ctiid.232759 - https://github.com/ShuangbiaoDai/CVE/blob/main/ibos%20oa.md