Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-48273 State: PUBLISHED Published: 2024-06-11T16:29:13.786Z Last Updated: 2024-08-02T21:23:39.456Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: WP OnlineSupport, Essential Plugin Products: Preloader for Website Problem Types: CWE-862 Description: Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Preloader for Website.This issue affects Preloader for Website: from n/a through 1.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/preloader-for-website/wordpress-preloader-for-website-plugin-1-2-2-unauthenticated-broken-access-contr
ase/vulnerability/preloader-for-website/wordpress-preloader-for-website-plugin-1-2-2-unauthenticated-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-48274 State: PUBLISHED Published: 2024-12-09T11:30:32.378Z Last Updated: 2024-12-09T13:59:57.533Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Mondial Relay WooCommerce - WCMultiShipping Products: WCMultiShipping Problem Types: CWE-862 Description: Missing Authorization vulnerability in Mondial Relay WooCommerce - WCMultiShipping WCMultiShipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCMultiShipping: from n/a through 2.3.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wc-multishipping/vulnerability/wordpress-wcmultiship
ent: References: - https://patchstack.com/database/wordpress/plugin/wc-multishipping/vulnerability/wordpress-wcmultishipping-plugin-2-3-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-48275 State: PUBLISHED Published: 2024-03-26T20:45:45.533Z Last Updated: 2024-08-06T15:11:23.467Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Trustindex.io Products: Widgets for Google Reviews Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Trustindex.Io Widgets for Google Reviews.This issue affects Widgets for Google Reviews: from n/a through 11.0.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-reviews-plugin-for-google/wordpress-widgets-for-google-reviews-plugin-11-0-2-arbitrary-file-upload-vuln
vulnerability/wp-reviews-plugin-for-google/wordpress-widgets-for-google-reviews-plugin-11-0-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2023-48276 State: PUBLISHED Published: 2024-06-04T10:20:30.301Z Last Updated: 2024-08-02T21:23:39.448Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Nitin Rathod Products: WP Forms Puzzle Captcha Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Nitin Rathod WP Forms Puzzle Captcha allows Functionality Bypass.This issue affects WP Forms Puzzle Captcha: from n/a through 4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-forms-puzzle-captcha/wordpress-wp-forms-puzzle-captcha-plugin-4-1-captcha-b
s://patchstack.com/database/vulnerability/wp-forms-puzzle-captcha/wordpress-wp-forms-puzzle-captcha-plugin-4-1-captcha-bypass-vulnerability?_s_id=cve
CVE ID: CVE-2023-48277 State: PUBLISHED Published: 2024-12-09T11:39:26.619Z Last Updated: 2024-12-09T18:38:42.761Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SuperPWA Products: Super Progressive Web Apps Problem Types: CWE-862 Description: Missing Authorization vulnerability in SuperPWA Super Progressive Web Apps allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Super Progressive Web Apps: from n/a through 2.2.21. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/super-progressive-web-apps/vulnerability/wordpress-super-progressive-web-apps-plugin-2-
ck.com/database/wordpress/plugin/super-progressive-web-apps/vulnerability/wordpress-super-progressive-web-apps-plugin-2-2-21-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-48278 State: PUBLISHED Published: 2023-11-30T16:08:50.313Z Last Updated: 2024-08-02T21:23:39.443Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Nitin Rathod Products: WP Forms Puzzle Captcha Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Nitin Rathod WP Forms Puzzle Captcha allows Stored XSS.This issue affects WP Forms Puzzle Captcha: from n/a through 4.1. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-forms-puzzle-captcha/wordpress-wp-forms-puzzle-captcha-plugin-4-1-csrf-to-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-48279 State: PUBLISHED Published: 2023-11-30T13:14:04.226Z Last Updated: 2025-06-03T13:53:56.760Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Seraphinite Solutions Products: Seraphinite Post .DOCX Source Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Seraphinite Solutions Seraphinite Post .DOCX Source allows Cross Site Request Forgery.This issue affects Seraphinite Post .DOCX Source: from n/a through 2.16.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/seraphinite-post-docx-source/wordpress-seraphinite-post-d
t: References: - https://patchstack.com/database/vulnerability/seraphinite-post-docx-source/wordpress-seraphinite-post-docx-source-plugin-2-16-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-48280 State: PUBLISHED Published: 2024-06-12T09:23:00.509Z Last Updated: 2024-08-02T21:23:39.482Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Consensu.IO Products: Consensu.io Problem Types: CWE-862 Description: Missing Authorization vulnerability in Consensu.IO Consensu.Io.This issue affects Consensu.Io: from n/a through 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/consensu-io/wordpress-consensu-io-plugin-1-0-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-48281 State: PUBLISHED Published: 2023-11-30T13:09:34.941Z Last Updated: 2024-08-02T21:23:39.454Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Super Blog Me Products: Broken Link Checker for YouTube Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Super Blog Me Broken Link Checker for YouTube allows Cross Site Request Forgery.This issue affects Broken Link Checker for YouTube: from n/a through 1.3. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/broken-link-checker-for-youtube/wordpress-broken-link-checker-for-youtube-plugin-1-3-cross-site
m/database/vulnerability/broken-link-checker-for-youtube/wordpress-broken-link-checker-for-youtube-plugin-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-48282 State: PUBLISHED Published: 2023-11-30T13:07:22.536Z Last Updated: 2024-08-02T21:23:39.490Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Andrea Landonio Products: Taxonomy filter Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Andrea Landonio Taxonomy filter allows Cross Site Request Forgery.This issue affects Taxonomy filter: from n/a through 2.2.9. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/taxonomy-filter/wordpress-taxonomy-filter-plugin-2-2-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-48283 State: PUBLISHED Published: 2023-11-30T13:04:48.707Z Last Updated: 2024-08-02T21:23:39.584Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: PressTigers Products: Simple Testimonials Showcase Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Testimonials Showcase allows Cross Site Request Forgery.This issue affects Simple Testimonials Showcase: from n/a through 1.1.5. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/simple-testimonials-showcase/wordpress-simple-testimonials-showcase-plugin-1-1-5-cross-site-request-forger
vulnerability/simple-testimonials-showcase/wordpress-simple-testimonials-showcase-plugin-1-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-48284 State: PUBLISHED Published: 2023-11-30T13:01:43.381Z Last Updated: 2024-08-02T21:23:39.465Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WebToffee Products: Decorator – WooCommerce Email Customizer Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WebToffee Decorator – WooCommerce Email Customizer allows Cross Site Request Forgery.This issue affects Decorator – WooCommerce Email Customizer: from n/a through 1.2.7. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/decorator-woocommerce-email-customizer/wordpress-decorator-woocommerce-ema
https://patchstack.com/database/vulnerability/decorator-woocommerce-email-customizer/wordpress-decorator-woocommerce-email-customizer-plugin-1-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-48285 State: PUBLISHED Published: 2024-06-04T10:23:00.172Z Last Updated: 2024-08-02T21:23:39.488Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Tips and Tricks HQ Products: Stripe Payments Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Tips and Tricks HQ Stripe Payments allows Code Injection.This issue affects Stripe Payments: from n/a through 2.0.79. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/stripe-payments/wordpress-accept-stripe-payments-plugin-2-0-79-content-inj
https://patchstack.com/database/vulnerability/stripe-payments/wordpress-accept-stripe-payments-plugin-2-0-79-content-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-48286 State: PUBLISHED Published: 2024-12-09T11:30:30.762Z Last Updated: 2024-12-10T16:49:06.106Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) Vendors: Tips and Tricks HQ, wptipsntricks Products: Stripe Payments Problem Types: CWE-862 Description: Missing Authorization vulnerability in Tips and Tricks HQ, wptipsntricks Stripe Payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stripe Payments: from n/a through 2.0.79. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/stripe-payments/vulnerability/wordpress-accept-stripe-payments-plugin-2-0
tps://patchstack.com/database/wordpress/plugin/stripe-payments/vulnerability/wordpress-accept-stripe-payments-plugin-2-0-79-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-48287 State: PUBLISHED Published: 2024-12-09T11:30:29.944Z Last Updated: 2024-12-09T13:59:57.665Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Matat Technologies Products: TextMe SMS Problem Types: CWE-862 Description: Missing Authorization vulnerability in Matat Technologies TextMe SMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TextMe SMS: from n/a through 1.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/textme-sms-integration/vulnerability/wordpress-textme-sms-plugin-1-9-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-48288 State: PUBLISHED Published: 2023-12-21T14:05:57.204Z Last Updated: 2024-08-02T21:23:39.505Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: HM Plugin Products: WordPress Job Board and Recruitment Plugin – JobWP Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue affects WordPress Job Board and Recruitment Plugin – JobWP: from n/a through 2.1. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/jobwp/wordpress-jobwp-plugin-2-1-sensitive-data-exposure-
r: References: - https://patchstack.com/database/vulnerability/jobwp/wordpress-jobwp-plugin-2-1-sensitive-data-exposure-on-resume-files-vulnerability?_s_id=cve
CVE ID: CVE-2023-48289 State: PUBLISHED Published: 2023-11-30T11:20:51.662Z Last Updated: 2024-08-02T21:23:39.640Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: SpreadsheetConverter Products: Import Spreadsheets from Microsoft Excel Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpreadsheetConverter Import Spreadsheets from Microsoft Excel allows Stored XSS.This issue affects Import Spreadsheets from Microsoft Excel: from n/a through 10.1.3. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/import-spreadshee
al Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/import-spreadsheets-from-microsoft-excel/wordpress-import-spreadsheets-from-microsoft-excel-plugin-10-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-48290 State: PUBLISHED Published: 2024-06-04T10:25:21.178Z Last Updated: 2024-08-02T21:23:39.484Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: 10Web Form Builder Team Products: Form Maker by 10Web Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Functionality Bypass.This issue affects Form Maker by 10Web: from n/a through 1.15.20. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/form-maker/wordpress-form-maker-by-10web-plugin-1-15-20-captcha-
rences: - https://patchstack.com/database/vulnerability/form-maker/wordpress-form-maker-by-10web-plugin-1-15-20-captcha-bypass-vulnerability-vulnerability?_s_id=cve
CVE ID: CVE-2023-48291 State: PUBLISHED Published: 2023-12-21T09:30:46.557Z Last Updated: 2025-02-13T17:18:16.717Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-668 Description: Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't. This is a missing fix for CVE-2023-42792 in Apache Airflow 2.7.2 Users of Apache Airflow are strongly advised to upgrade to version 2.8.0 or newer to mitigate the ri
pache Airflow 2.7.2 Users of Apache Airflow are strongly advised to upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/apache/airflow/pull/34366 - https://lists.apache.org/thread/3nl0h014274yjlt1hd02z0q78ftyz0z3 - http://www.openwall.com/lists/oss-security/2023/12/21/1
CVE ID: CVE-2023-48292 State: PUBLISHED Published: 2023-11-20T18:02:42.934Z Last Updated: 2024-08-02T21:23:39.506Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki-contrib Products: application-admintools Problem Types: CWE-352 Description: The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request forgery vulnerability in the admin tool for executing shell commands on the server allows an attacker to execute arbitrary shell commands by tricking an admin into loading the URL with the shell command. A very simple possibility for an attack are comments. W
y tricking an admin into loading the URL with the shell command. A very simple possibility for an attack are comments. When the attacker can leave a comment on any page in the wiki it is sufficient to include an image with an URL like `/xwiki/bin/view/Admin/RunShellCommand?command=touch%20/tmp/attacked` in the comment. When an admin views the comment, the file `/tmp/attacked` will be created on the server. The output of the command is also vulnerable to XWiki syntax injection which offers a simple way to execute Groovy in the context of the XWiki installation and thus an even easier way to compromise the integrity and confidentiality of the whole XWiki installation. This has been patched by
en easier way to compromise the integrity and confidentiality of the whole XWiki installation. This has been patched by adding a form token check in version 4.5.1 of the admin tools. Some workarounds are available. The patch can be applied manually to the affected wiki pages. Alternatively, the document `Admin.RunShellCommand` can also be deleted if the possibility to run shell commands isn't needed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xwiki-contrib/application-admintools/security/advisories/GHSA-8jpr-ff92-hpf9 - https://github.com/xwiki-contrib/application-admintools/commit/03815c505c9f37006a0c56495e862dc549a39da8 - https://jira.xwiki.org/brow
b.com/xwiki-contrib/application-admintools/commit/03815c505c9f37006a0c56495e862dc549a39da8 - https://jira.xwiki.org/browse/ADMINTOOL-91
CVE ID: CVE-2023-48293 State: PUBLISHED Published: 2023-11-20T18:14:08.724Z Last Updated: 2024-10-11T15:23:39.463Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: xwiki-contrib Products: application-admintools Problem Types: CWE-352 Description: The XWiki Admin Tools Application provides tools to help the administration of XWiki. Prior to version 4.5.1, a cross-site request forgery vulnerability in the query on XWiki tool allows executing arbitrary database queries on the database of the XWiki installation. Among other things, this allows modifying and deleting all data of the wiki. This could be both used to damage the wiki and to create an account with eleva
ifying and deleting all data of the wiki. This could be both used to damage the wiki and to create an account with elevated privileges for the attacker, thus impacting the confidentiality, integrity and availability of the whole XWiki instance. A possible attack vector are comments on the wiki, by embedding an image with wiki syntax like `[[image:path:/xwiki/bin/view/Admin/QueryOnXWiki?query=DELETE%20FROM%20xwikidoc]]`, all documents would be deleted from the database when an admin user views this comment. This has been patched in Admin Tools Application 4.5.1 by adding form token checks. Some workarounds are available. The patch can also be applied manually to the affected pages. Alternativ
m token checks. Some workarounds are available. The patch can also be applied manually to the affected pages. Alternatively, if the query tool is not needed, by deleting the document `Admin.SQLToolsGroovy`, all database query tools can be deactivated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki-contrib/application-admintools/security/advisories/GHSA-4f4c-rhjv-4wgv - https://github.com/xwiki-contrib/application-admintools/commit/45298b4fbcafba6914537dcdd798a1e1385f9e46 - https://jira.xwiki.org/browse/ADMINTOOL-92
CVE ID: CVE-2023-48294 State: PUBLISHED Published: 2023-11-17T21:12:59.642Z Last Updated: 2024-08-02T21:23:39.485Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: librenms Products: librenms Problem Types: CWE-200 Description: LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions of LibreNMS when a user accesses their device dashboard, one request is sent to `graph.php` to access graphs generated on the particular Device. This request can be accessed by a low privilege user and they can enumerate devices on librenms with their id or hostn
. This request can be accessed by a low privilege user and they can enumerate devices on librenms with their id or hostname. Leveraging this vulnerability a low privilege user can see all devices registered by admin users. This vulnerability has been addressed in commit `489978a923` which has been included in release version 23.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/librenms/librenms/security/advisories/GHSA-fpq5-4vwm-78x4 - https://github.com/librenms/librenms/commit/489978a923ed52aa243d3419889ca298a8a6a7cf - https://github.com/librenms/librenms/blob/fa9303
com/librenms/librenms/commit/489978a923ed52aa243d3419889ca298a8a6a7cf - https://github.com/librenms/librenms/blob/fa93034edd40c130c2ff00667ca2498d84be6e69/html/graph.php#L19C1-L25C2
CVE ID: CVE-2023-48295 State: PUBLISHED Published: 2023-11-17T21:06:07.575Z Last Updated: 2024-08-10T15:48:41.284Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: librenms Products: librenms Problem Types: CWE-79 Description: LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Affected versions are subject to a cross site scripting (XSS) vulnerability in the device group popups. This issue has been addressed in commit `faf66035ea` which has been included in release version 23.11.0. Users are advised to upgrade. There are no known workarounds for this vulner
s been included in release version 23.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/librenms/librenms/security/advisories/GHSA-8phr-637g-pxrg - https://github.com/librenms/librenms/commit/faf66035ea1f4c1c4f34559b9d0ed40ee4a19f90 - https://github.com/librenms/librenms/blob/63eeeb71722237d1461a37bb6da99fda25e02c91/app/Http/Controllers/DeviceGroupController.php#L173C21-L173C21
CVE ID: CVE-2023-48296 State: PUBLISHED Published: 2024-03-25T18:19:43.561Z Last Updated: 2024-08-02T21:23:39.499Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: oroinc Products: orocommerce Problem Types: CWE-200 Description: OroPlatform is a PHP Business Application Platform (BAP). Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user. This vulnerability is fixed in 5.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/oroinc/orocommerce/security/advisories/GHSA-v7px-46v9-
chment: - CVE Program Container: References: - https://github.com/oroinc/orocommerce/security/advisories/GHSA-v7px-46v9-5qwp - https://github.com/oroinc/orocommerce/commit/41c526498012d44cd88852c63697f1ef53b61db8