Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-4357 State: PUBLISHED Published: 2023-08-15T17:07:12.100Z Last Updated: 2025-02-13T17:13:20.345Z Vendors: Google Products: Chrome Problem Types: Insufficient validation of untrusted input Description: Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html - https://crbug.com/1458911 - https://www.debian.org/security/2023/dsa-5479 - https://lists
l-update-for-desktop_15.html - https://crbug.com/1458911 - https://www.debian.org/security/2023/dsa-5479 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-4358 State: PUBLISHED Published: 2023-08-15T17:07:12.327Z Last Updated: 2025-07-03T14:07:12.594Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in DNS in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html - https://crbug.com/1466415 - https://www.debian.org/security/2023/dsa-5479 - https://lists.fedoraproject.org/archives/list/package-announce@li
6415 - https://www.debian.org/security/2023/dsa-5479 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-4359 State: PUBLISHED Published: 2023-08-15T17:07:12.596Z Last Updated: 2025-02-13T17:13:21.471Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in App Launcher in Google Chrome on iOS prior to 116.0.5845.96 allowed a remote attacker to potentially spoof elements of the security UI via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html - https://crbug.com/1443722 - https://www.debian.org/security/2023/dsa-5479 - https://lists.fedoraproject.org/arch
.html - https://crbug.com/1443722 - https://www.debian.org/security/2023/dsa-5479 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-4360 State: PUBLISHED Published: 2023-08-15T17:07:12.895Z Last Updated: 2025-02-13T17:13:22.039Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Color in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html - https://crbug.com/1462723 - https://www.debian.org/security/2023/dsa-5479 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedor
tps://www.debian.org/security/2023/dsa-5479 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-4361 State: PUBLISHED Published: 2023-08-15T17:07:13.235Z Last Updated: 2025-02-13T17:13:23.207Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Autofill in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html - https://crbug.com/1465230 - https://www.debian.org/security/2023/dsa-5479 - https://lists.fedoraproject.org/archives/list/package
rbug.com/1465230 - https://www.debian.org/security/2023/dsa-5479 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-4362 State: PUBLISHED Published: 2023-08-15T17:07:13.419Z Last Updated: 2025-02-13T17:13:23.740Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in Mojom IDL in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process and gained control of a WebUI process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html - https://crbug.com/1316379 - https://www.debi
releases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html - https://crbug.com/1316379 - https://www.debian.org/security/2023/dsa-5479 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-4363 State: PUBLISHED Published: 2023-08-15T17:07:13.589Z Last Updated: 2025-02-13T17:13:24.879Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in WebShare in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to spoof the contents of a dialog URL via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html - https://crbug.com/1367085 - https://www.debian.org/security/2023/dsa-5479 - https://lists.fedoraproject.org/archives/list/p
ps://crbug.com/1367085 - https://www.debian.org/security/2023/dsa-5479 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-4364 State: PUBLISHED Published: 2023-08-15T17:07:13.761Z Last Updated: 2025-02-13T17:13:25.395Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Permission Prompts in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html - https://crbug.com/1406922 - https://www.debian.org/security/2023/dsa-5479 - https://lists.fedoraproject.org/archives/list/package-announc
/1406922 - https://www.debian.org/security/2023/dsa-5479 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-4365 State: PUBLISHED Published: 2023-08-15T17:07:14.017Z Last Updated: 2025-02-13T17:13:26.800Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Fullscreen in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html - https://crbug.com/1431043 - https://www.debian.org/security/2023/dsa-5479 - https://lists.fedoraproject.org/archives/list/package-announce@lists.
- https://www.debian.org/security/2023/dsa-5479 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-4366 State: PUBLISHED Published: 2023-08-15T17:07:14.202Z Last Updated: 2025-02-13T17:13:28.461Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Extensions in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html - https://crbug.com/1450784 - https://www.debian.org/security/2023/dsa-5479 - https://lists.fedoraproject.org/arc
5.html - https://crbug.com/1450784 - https://www.debian.org/security/2023/dsa-5479 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-4367 State: PUBLISHED Published: 2023-08-15T17:07:14.441Z Last Updated: 2025-02-13T17:13:29.028Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in Extensions API in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html - https://crbug.com/1467743 - https://www.debian.org/secur
gleblog.com/2023/08/stable-channel-update-for-desktop_15.html - https://crbug.com/1467743 - https://www.debian.org/security/2023/dsa-5479 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-4368 State: PUBLISHED Published: 2023-08-15T17:07:14.687Z Last Updated: 2025-02-13T17:13:29.531Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in Extensions API in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html - https://crbug.com/1467751 - https://www.debian.org/security/2023/dsa-5479 - https
e-channel-update-for-desktop_15.html - https://crbug.com/1467751 - https://www.debian.org/security/2023/dsa-5479 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-4369 State: PUBLISHED Published: 2023-08-15T17:07:14.872Z Last Updated: 2025-05-05T15:52:35.107Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in Systems Extensions in Google Chrome on ChromeOS prior to 116.0.5845.120 allowed an attacker who convinced a user to install a malicious extension to bypass file restrictions via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-chromeos_25.html - https://crbug.com/1464456
CVE ID: CVE-2023-4371 State: PUBLISHED Published: 2023-08-15T15:00:06.067Z Last Updated: 2024-08-02T07:24:04.944Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: phpRecDB Problem Types: CWE-79 Description: A vulnerability was found in phpRecDB 1.3.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument r/view leads to cross site scripting. The attack may be launched remotely. VDB-237194 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: Re
tacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.237194 - https://vuldb.com/?ctiid.237194
CVE ID: CVE-2023-4372 State: PUBLISHED Published: 2024-01-11T08:32:29.982Z Last Updated: 2025-06-17T21:09:11.924Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: litespeedtech Products: LiteSpeed Cache Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'esi' shortcode in versions up to, and including, 5.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject ar
attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/27026f0f-c85e-4409-9973-4b9cb8a90da5?source=cve - https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/5.5.1/src/esi.cls.php#L480 - https://github.com/litespeedtech/lscache_wp/commit/95a407d9f192b37ac6cf96d2aa50f240e3e6b2d7#diff-7b2c514b58d1b8a71655607bdfab87cedb013bc1b8927ce0b49a89ddf4a7e01cR495 - https://plugins.trac.wordpress.
f240e3e6b2d7#diff-7b2c514b58d1b8a71655607bdfab87cedb013bc1b8927ce0b49a89ddf4a7e01cR495 - https://plugins.trac.wordpress.org/changeset/2977143/litespeed-cache#file348
CVE ID: CVE-2023-4373 State: PUBLISHED Published: 2023-08-21T18:36:23.305Z Last Updated: 2024-10-03T17:54:55.052Z Vendors: Devolutions Products: Remote Desktop Manager Description: Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 and earlier permits a user to initiate a connection without proper execution rights via the remote tools feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2023-0015/
CVE ID: CVE-2023-4374 State: PUBLISHED Published: 2023-08-16T04:36:01.177Z Last Updated: 2025-02-05T19:35:47.865Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: frogerme Products: WP Remote Users Sync Problem Types: CWE-862 Missing Authorization Description: The WP Remote Users Sync plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'refresh_logs_async' functions in versions up to, and including, 1.2.11. This makes it possible for authenticated attackers with subscriber privileges or above, to view logs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
criber privileges or above, to view logs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2e87cfc4-8e7c-47d6-80fc-9c293cdd8acb?source=cve - https://plugins.trac.wordpress.org/browser/wp-remote-users-sync/trunk/inc/class-wprus-logger.php#L117 - https://plugins.trac.wordpress.org/changeset/2946667/wp-remote-users-sync#file130
CVE ID: CVE-2023-4376 State: PUBLISHED Published: 2023-09-19T19:06:03.304Z Last Updated: 2025-04-23T16:16:28.220Z Vendors: Unknown Products: Serial Codes Generator and Validator with WooCommerce Support Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Serial Codes Generator and Validator with WooCommerce Support WordPress plugin before 2.4.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://w
in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/13910e52-5302-4252-8bee-49dd1f0e180a
CVE ID: CVE-2023-4377 State: REJECTED Published: N/A Last Updated: 2025-04-29T22:15:53.517Z Description: No description available.
CVE ID: CVE-2023-4378 State: PUBLISHED Published: 2023-09-01T10:30:31.991Z Last Updated: 2025-05-23T04:04:11.867Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-201 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A malicious Maintainer can, under specific circumstances, leak the sentry token by changing the configured URL in the Sentry error tracking settings page. This was as a result of an incomplete fix for CVE-2022-4365. Additional Analyst Notes: - CVE
or tracking settings page. This was as a result of an incomplete fix for CVE-2022-4365. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/422134 - https://hackerone.com/reports/2104591
CVE ID: CVE-2023-4379 State: PUBLISHED Published: 2023-11-09T21:01:10.733Z Last Updated: 2024-10-03T06:23:14.529Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/415496
CVE ID: CVE-2023-4380 State: PUBLISHED Published: 2023-10-04T14:24:35.121Z Last Updated: 2025-11-20T18:27:32.482Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9 Problem Types: CWE-532 Description: A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality, integrity, and availability. Additional Analyst Notes: - CVE Program Container: Refere
g in the loss of confidentiality, integrity, and availability. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:4693 - https://access.redhat.com/security/cve/CVE-2023-4380 - https://bugzilla.redhat.com/show_bug.cgi?id=2232324
CVE ID: CVE-2023-4381 State: PUBLISHED Published: 2023-08-16T11:02:27.189Z Last Updated: 2024-10-03T13:37:37.360Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: instantsoft Products: instantsoft/icms2 Problem Types: CWE-620 Description: Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/666c2617-e3e9-4955-9c97-2f8ed5262cc3 - https://github.com/instantsoft/icms2/commit/58f8b9941b53b606a1b15a4364005cd2b1965507
CVE ID: CVE-2023-4382 State: PUBLISHED Published: 2023-08-16T19:31:03.426Z Last Updated: 2024-11-21T15:03:18.901Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: tdevs Products: Hyip Rio Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in tdevs Hyip Rio 2.1. Affected by this issue is some unknown functionality of the file /user/settings of the component Profile Settings. The manipulation of the argument avatar leads to cross site scripting. The attack may be launched remotely. VDB-237314 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
igned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.237314 - https://vuldb.com/?ctiid.237314 - http://packetstormsecurity.com/files/174212/Hyip-Rio-2.1-Cross-Site-Scripting-File-Upload.html
CVE ID: CVE-2023-4383 State: PUBLISHED Published: 2023-08-16T20:00:05.068Z Last Updated: 2024-08-02T07:24:05.062Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: MicroWorld Products: eScan Anti-Virus Problem Types: CWE-279 Description: A vulnerability, which was classified as critical, was found in MicroWorld eScan Anti-Virus 7.0.32 on Linux. This affects an unknown part of the file runasroot. The manipulation leads to incorrect execution-assigned permissions. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-237315. NOTE: The vendor was contacted earl
blic and may be used. The associated identifier of this vulnerability is VDB-237315. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.237315 - https://vuldb.com/?ctiid.237315 - https://gist.github.com/dmknght/ac489cf3605ded09b3925521afee3003