Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-4571 State: PUBLISHED Published: 2023-08-30T16:19:39.150Z Last Updated: 2025-02-28T11:03:56.113Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Splunk Products: Splunk ITSI Problem Types: CWE-117 Description: In Splunk IT Service Intelligence (ITSI) versions below below 4.13.3, 4.15.3, or 4.17.1, a malicious actor can inject American National Standards Institute (ANSI) escape codes into Splunk ITSI log files that, when a vulnerable terminal application reads them, can run malicious code in the vulnerable application. This attack requires a user to use a terminal application that translates ANSI escape codes to read the malicious log file loca
tack requires a user to use a terminal application that translates ANSI escape codes to read the malicious log file locally in the vulnerable terminal. The vulnerability also requires additional user interaction to succeed. The vulnerability does not directly affect Splunk ITSI. The indirect impact on Splunk ITSI can vary significantly depending on the permissions in the vulnerable terminal application, as well as where and how the user reads the malicious log file. For example, users can copy the malicious file from Splunk ITSI and read it on their local machine. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0810
CVE ID: CVE-2023-4572 State: PUBLISHED Published: 2023-08-29T19:48:55.614Z Last Updated: 2025-02-13T17:14:08.764Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in MediaStream in Google Chrome prior to 116.0.5845.140 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_29.html - https://crbug.com/1472492 - https://www.debian.org/security/2023/dsa-5487 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.
.debian.org/security/2023/dsa-5487 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27NR3KG553CG6LGPMP6SHWEVHTYPL6RC/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-4573 State: PUBLISHED Published: 2023-09-11T07:59:57.732Z Last Updated: 2024-09-26T15:12:39.082Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory corruption in IPC CanvasTranslator Description: When receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1846687 - htt
CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1846687 - https://www.mozilla.org/security/advisories/mfsa2023-34/ - https://www.mozilla.org/security/advisories/mfsa2023-35/ - https://www.mozilla.org/security/advisories/mfsa2023-36/ - https://www.mozilla.org/security/advisories/mfsa2023-37/ - https://www.mozilla.org/security/advisories/mfsa2023-38/
CVE ID: CVE-2023-4574 State: PUBLISHED Published: 2023-09-11T08:00:40.693Z Last Updated: 2024-09-26T15:07:28.548Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory corruption in IPC ColorPickerShownCallback Description: When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Additional A
ts Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1846688 - https://www.mozilla.org/security/advisories/mfsa2023-34/ - https://www.mozilla.org/security/advisories/mfsa2023-35/ - https://www.mozilla.org/security/advisories/mfsa2023-36/ - https://www.mozilla.org/security/advisories/mfsa2023-37/ - https://www.mozilla.org/security/advisories/mfsa2023-38/
CVE ID: CVE-2023-4575 State: PUBLISHED Published: 2023-09-11T08:00:45.746Z Last Updated: 2024-09-26T15:05:57.551Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory corruption in IPC FilePickerShownCallback Description: When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Additional Ana
Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1846689 - https://www.mozilla.org/security/advisories/mfsa2023-34/ - https://www.mozilla.org/security/advisories/mfsa2023-35/ - https://www.mozilla.org/security/advisories/mfsa2023-36/ - https://www.mozilla.org/security/advisories/mfsa2023-37/ - https://www.mozilla.org/security/advisories/mfsa2023-38/
CVE ID: CVE-2023-4576 State: PUBLISHED Published: 2023-09-11T08:00:51.770Z Last Updated: 2024-09-26T15:03:13.589Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Integer Overflow in RecordedSourceSurfaceCreation Description: On Windows, an integer overflow could occur in `RecordedSourceSurfaceCreation` which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Additional Analyst Notes: - CVE Pro
ox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1846694 - https://www.mozilla.org/security/advisories/mfsa2023-34/ - https://www.mozilla.org/security/advisories/mfsa2023-35/ - https://www.mozilla.org/security/advisories/mfsa2023-36/ - https://www.mozilla.org/security/advisories/mfsa2023-37/ - https://www.mozilla.org/security/advisories/mfsa2023-38/
CVE ID: CVE-2023-4577 State: PUBLISHED Published: 2023-09-11T08:01:02.684Z Last Updated: 2024-09-19T20:02:40.096Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory corruption in JIT UpdateRegExpStatics Description: When `UpdateRegExpStatics` attempted to access `initialStringHeap` it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1847397 - https://www.mozil
ntainer: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1847397 - https://www.mozilla.org/security/advisories/mfsa2023-34/ - https://www.mozilla.org/security/advisories/mfsa2023-36/ - https://www.mozilla.org/security/advisories/mfsa2023-38/
CVE ID: CVE-2023-4578 State: PUBLISHED Published: 2023-09-11T08:01:17.333Z Last Updated: 2024-09-19T20:02:19.081Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception Description: When calling `JS::CheckRegExpSyntax` a Syntax Error could have been set which would end in calling `convertToRuntimeErrorAndClear`. A path in the function could attempt to allocate memory when none is available which would have caused a newly created Out of Memory exception to be mishandled as a Syntax Error. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Additional
ed as a Syntax Error. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1839007 - https://www.mozilla.org/security/advisories/mfsa2023-34/ - https://www.mozilla.org/security/advisories/mfsa2023-36/ - https://www.mozilla.org/security/advisories/mfsa2023-38/
CVE ID: CVE-2023-4579 State: PUBLISHED Published: 2023-09-11T08:01:28.695Z Last Updated: 2025-02-13T17:14:11.060Z Vendors: Mozilla Products: Firefox Problem Types: Persisted search terms were formatted as URLs Description: Search queries in the default search engine could appear to have been the currently navigated URL if the search query itself was a well formed URL. This could have led to a site spoofing another if it had been maliciously set as the default search engine. This vulnerability affects Firefox < 117. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1842766 - https://www.mozilla.org/security/a
DP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1842766 - https://www.mozilla.org/security/advisories/mfsa2023-34/ - https://security.gentoo.org/glsa/202401-10
CVE ID: CVE-2023-4580 State: PUBLISHED Published: 2023-09-11T08:01:38.784Z Last Updated: 2024-09-19T20:01:56.161Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Push notifications saved to disk unencrypted Description: Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1843046 - https://www.mozilla.org/security/advisories/mfsa2023-34/ - https://www.mozilla.
la.mozilla.org/show_bug.cgi?id=1843046 - https://www.mozilla.org/security/advisories/mfsa2023-34/ - https://www.mozilla.org/security/advisories/mfsa2023-36/ - https://www.mozilla.org/security/advisories/mfsa2023-38/
CVE ID: CVE-2023-4581 State: PUBLISHED Published: 2023-09-11T08:01:45.092Z Last Updated: 2024-09-26T16:04:42.184Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: XLL file extensions were downloadable without warnings Description: Excel `.xll` add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=184
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1843758 - https://www.mozilla.org/security/advisories/mfsa2023-34/ - https://www.mozilla.org/security/advisories/mfsa2023-35/ - https://www.mozilla.org/security/advisories/mfsa2023-36/ - https://www.mozilla.org/security/advisories/mfsa2023-37/ - https://www.mozilla.org/security/advisories/mfsa2023-38/
CVE ID: CVE-2023-4582 State: PUBLISHED Published: 2023-09-11T08:01:51.968Z Last Updated: 2024-09-19T20:00:33.566Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Buffer Overflow in WebGL glGetProgramiv Description: Due to large allocation checks in Angle for glsl shaders being too lenient a buffer overflow could have occured when allocating too much private shader memory on mac OS. *This bug only affects Firefox on macOS. Other operating systems are unaffected.* This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.or
2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1773874 - https://www.mozilla.org/security/advisories/mfsa2023-34/ - https://www.mozilla.org/security/advisories/mfsa2023-36/ - https://www.mozilla.org/security/advisories/mfsa2023-38/
CVE ID: CVE-2023-4583 State: PUBLISHED Published: 2023-09-11T08:02:01.933Z Last Updated: 2024-09-19T19:57:57.681Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Browsing Context potentially not cleared when closing Private Window Description: When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
< 115.2, and Thunderbird < 115.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1842030 - https://www.mozilla.org/security/advisories/mfsa2023-34/ - https://www.mozilla.org/security/advisories/mfsa2023-36/ - https://www.mozilla.org/security/advisories/mfsa2023-38/
CVE ID: CVE-2023-4584 State: PUBLISHED Published: 2023-09-11T08:02:21.634Z Last Updated: 2024-08-02T07:31:06.567Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 Description: Memory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunder
ited to run arbitrary code. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1843968%2C1845205%2C1846080%2C1846526%2C1847529 - https://www.mozilla.org/security/advisories/mfsa2023-34/ - https://www.mozilla.org/security/advisories/mfsa2023-35/ - https://www.mozilla.org/security/advisories/mfsa2023-36/ - https://www.mozilla.org/security/advisories/mfsa2023-37/ - https://www.mozilla.org/security/advisories/mfsa2023-38/
CVE ID: CVE-2023-4585 State: PUBLISHED Published: 2023-09-11T08:02:24.976Z Last Updated: 2024-09-19T19:08:45.148Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2 Description: Memory safety bugs present in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc
R < 115.2, and Thunderbird < 115.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1751583%2C1841082%2C1847904%2C1848999 - https://www.mozilla.org/security/advisories/mfsa2023-34/ - https://www.mozilla.org/security/advisories/mfsa2023-36/ - https://www.mozilla.org/security/advisories/mfsa2023-38/
CVE ID: CVE-2023-4586 State: PUBLISHED Published: 2023-10-04T10:46:15.010Z Last Updated: 2025-11-20T17:55:46.993Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Red Hat Data Grid 8.4.6 Problem Types: CWE-20 Description: A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:7676 - https://access.redhat.com/security/cve/CVE-2023-4586 - https://bugzilla.redhat.com/show_bug.cgi?id=2235564
CVE ID: CVE-2023-4587 State: PUBLISHED Published: 2023-09-04T11:23:06.896Z Last Updated: 2024-08-02T07:31:06.516Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: ZKTeco Products: ZEM800 Problem Types: CWE-639 Description: An IDOR vulnerability has been found in ZKTeco ZEM800 product affecting version 6.60. This vulnerability allows a local attacker to obtain registered user backup files or device configuration files over a local network or through a VPN server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-zkteco-zem800
CVE ID: CVE-2023-4588 State: PUBLISHED Published: 2023-09-06T11:43:19.278Z Last Updated: 2024-09-06T14:12:59.302Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Delinea Products: Secret Server Problem Types: CWE-552 Description: File accessibility vulnerability in Delinea Secret Server, in its v10.9.000002 and v11.4.000002 versions. Exploitation of this vulnerability could allow an authenticated user with administrative privileges to create a backup file in the application's webroot directory, changing the default backup directory to the wwwroot folder, and download it with some configuration files such as encryption.config/ and database.config stored in th
wwroot folder, and download it with some configuration files such as encryption.config/ and database.config stored in the wwwroot directory, exposing the database credentials in plain text. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-delinea-secret-server
CVE ID: CVE-2023-4589 State: PUBLISHED Published: 2023-09-06T11:48:59.706Z Last Updated: 2024-09-26T17:56:10.176Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Delinea Products: Secret Server Problem Types: CWE-345 Description: Insufficient verification of data authenticity vulnerability in Delinea Secret Server, in its v10.9.000002 version. An attacker with an administrator account could perform software updates without proper integrity verification mechanisms. In this scenario, the update process lacks digital signatures and fails to validate the integrity of the update package, allowing the attacker to inject malicious applications during the update.
validate the integrity of the update package, allowing the attacker to inject malicious applications during the update. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-delinea-secret-server
CVE ID: CVE-2023-4590 State: PUBLISHED Published: 2023-11-27T12:08:04.771Z Last Updated: 2024-08-02T07:31:06.439Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Frhed Products: Frhed Problem Types: CWE-120 Description: Buffer overflow vulnerability in Frhed hex editor, affecting version 1.6.0. This vulnerability could allow an attacker to execute arbitrary code via a long filename argument through the Structured Exception Handler (SEH) registers. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/buffer-overflow-vulnerability-frhed
CVE ID: CVE-2023-4591 State: PUBLISHED Published: 2023-11-03T11:01:55.931Z Last Updated: 2024-09-05T15:09:56.489Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: WPN-XM Products: Serverstack Problem Types: CWE-829 Description: A local file inclusion vulnerability has been found in WPN-XM Serverstack affecting version 0.8.6, which would allow an unauthenticated user to perform a local file inclusion (LFI) via the /tools/webinterface/index.php?page parameter by sending a GET request. This vulnerability could lead to the loading of a PHP file on the server, leading to a critical webshell exploit. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
the server, leading to a critical webshell exploit. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wpn-xm-serverstack
CVE ID: CVE-2023-4592 State: PUBLISHED Published: 2023-11-03T11:04:22.389Z Last Updated: 2024-09-05T13:58:49.858Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: WPN-XM Products: Serverstack Problem Types: CWE-79 Description: A Cross-Site Scripting vulnerability has been detected in WPN-XM Serverstack affecting version 0.8.6. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload through the /tools/webinterface/index.php parameter and retrieve the cookie session details of an authenticated user, resulting in a session hijacking. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
lting in a session hijacking. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wpn-xm-serverstack
CVE ID: CVE-2023-4593 State: PUBLISHED Published: 2023-11-23T12:31:38.141Z Last Updated: 2024-10-01T14:49:56.728Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: BVRP Software Products: SLmail Problem Types: CWE-22 Description: Path traversal vulnerability whose exploitation could allow an authenticated remote user to bypass SecurityManager's intended restrictions and list a parent directory via any filename, such as a multiple ..%2F value affecting the 'dodoc' parameter in the /MailAdmin_dll.htm file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerab
m Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bvrp-software-slmail
CVE ID: CVE-2023-4594 State: PUBLISHED Published: 2023-11-23T12:35:23.929Z Last Updated: 2024-11-21T19:31:32.046Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: BVRP Software Products: SLmail Problem Types: CWE-79 Description: Stored XSS vulnerability. This vulnerability could allow an attacker to store a malicious JavaScript payload via GET and POST methods on multiple parameters in the MailAdmin_dll.htm file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bvrp-software-slmail