Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-4749 State: PUBLISHED Published: 2023-09-04T00:31:04.684Z Last Updated: 2024-08-02T07:37:59.644Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Inventory Management System Problem Types: CWE-73 Description: A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file index.php. The manipulation of the argument page leads to file inclusion. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-238638 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP V
lic and may be used. VDB-238638 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.238638 - https://vuldb.com/?ctiid.238638 - https://skypoc.wordpress.com/2023/09/03/%e3%80%90code-audit%e3%80%91open-source-ample-inventory-management-system-v1-0-by-mayuri_k-has-a-file-inclusion-vulnerability/
CVE ID: CVE-2023-4750 State: PUBLISHED Published: 2023-09-04T13:47:02.921Z Last Updated: 2025-02-13T17:18:01.237Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-416 Description: Use After Free in GitHub repository vim/vim prior to 9.0.1857. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/1ab3ebdf-fe7d-4436-b483-9a586e03b0ea - https://github.com/vim/vim/commit/fc68299d436cf87453e432daa77b6d545df4d7ed - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITRVK4FB74RZDIGTZJXOZMUW6X6F4TNF/ - https://lists.fedoraproject.org/archives/list/
CVE ID: CVE-2023-4751 State: PUBLISHED Published: 2023-09-03T18:54:47.173Z Last Updated: 2025-02-13T17:18:02.214Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1331. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/db7be8d6-6cb7-4ae5-9c4e-805423afa378 - https://github.com/vim/vim/commit/e1121b139480f53d1b06f84f3e4574048108fa0b - https://support.apple.com/kb/HT213984 - http://seclists.org/fulldisclosure/2023/Oct/24
CVE ID: CVE-2023-4752 State: PUBLISHED Published: 2023-09-04T13:46:57.231Z Last Updated: 2025-11-03T20:36:05.394Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-416 Description: Use After Free in GitHub repository vim/vim prior to 9.0.1858. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/85f62dd7-ed84-4fa2-b265-8a369a318757 - https://github.com/vim/vim/commit/ee9166eb3b41846661a39b662dc7ebe8b5e15139 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITRVK4FB74RZDIGTZJXOZMUW6X6F4TNF/ - https://lists.fedoraproject.org/archives/list/
ounce@lists.fedoraproject.org/message/ITRVK4FB74RZDIGTZJXOZMUW6X6F4TNF/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PFE3LDFRZ7EGWA5AU7YHYL62ELBOFZWQ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I56ITJAFMFAQ2G3BMGTCGM3GS62V2DTR/ - https://lists.debian.org/debian-lts-announce/2023/09/msg00035.html - https://support.apple.com/kb/HT213984 - http://seclists.org/fulldisclosure/2023/Oct/24
CVE ID: CVE-2023-4753 State: PUBLISHED Published: 2023-09-21T09:16:56.550Z Last Updated: 2024-08-02T07:37:59.961Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-20 Description: OpenHarmony v3.2.1 and prior version has a system call function usage error. Local attackers can crash kernel by the error input. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-11.md
CVE ID: CVE-2023-4754 State: PUBLISHED Published: 2023-09-04T08:24:38.003Z Last Updated: 2024-09-19T15:35:51.496Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: gpac Products: gpac/gpac Problem Types: CWE-787 Description: Out-of-bounds Write in GitHub repository gpac/gpac prior to 2.3-DEV. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/b7ed24ad-7d0b-40b7-8f4d-3c18a906620c - https://github.com/gpac/gpac/commit/7e2e92feb1b30fac1d659f6620d743b5a188ffe0
CVE ID: CVE-2023-4755 State: PUBLISHED Published: 2023-09-04T13:46:46.060Z Last Updated: 2024-09-19T15:35:40.223Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: gpac Products: gpac/gpac Problem Types: CWE-416 Description: Use After Free in GitHub repository gpac/gpac prior to 2.3-DEV. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/463474b7-a4e8-42b6-8b30-e648a77ee6b3 - https://github.com/gpac/gpac/commit/895ac12da168435eb8db3f96978ffa4c69d66c3a
CVE ID: CVE-2023-4756 State: PUBLISHED Published: 2023-09-04T08:24:56.615Z Last Updated: 2024-09-19T15:35:24.697Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: gpac Products: gpac/gpac Problem Types: CWE-121 Description: Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/2342da0e-f097-4ce7-bfdc-3ec0ba446e05 - https://github.com/gpac/gpac/commit/6914d016e2b540bac2c471c4aea156ddef8e8e01
CVE ID: CVE-2023-4757 State: PUBLISHED Published: 2024-01-16T15:56:36.620Z Last Updated: 2025-06-20T17:06:07.342Z Vendors: Unknown Products: Staff / Employee Business Directory for Active Directory Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Staff / Employee Business Directory for Active Directory WordPress plugin before 1.2.3 does not sanitize and escape data returned from the LDAP server before rendering it in the page, allowing users who can control their entries in the LDAP directory to inject malicious javascript which could be used against high-privilege users such as a site admin. Additional Analyst Notes:
ct malicious javascript which could be used against high-privilege users such as a site admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0b953413-cf41-4de7-ac1f-c6cb995fb158/
CVE ID: CVE-2023-4758 State: PUBLISHED Published: 2023-09-04T15:47:36.284Z Last Updated: 2024-09-19T15:33:10.151Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: gpac Products: gpac/gpac Problem Types: CWE-126 Description: Buffer Over-read in GitHub repository gpac/gpac prior to 2.3-DEV. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/2f496261-1090-45ac-bc89-cc93c82090d6 - https://github.com/gpac/gpac/commit/193633b1648582444fc99776cd741d7ba0125e86
CVE ID: CVE-2023-4759 State: PUBLISHED Published: 2023-09-12T09:12:10.254Z Last Updated: 2024-08-02T07:37:59.574Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Eclipse Foundation Products: Eclipse JGit Problem Types: CWE-59, CWE-178 Description: Arbitrary File Overwrite in Eclipse JGit <= 6.6.0 In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive filesystem, or when a checkout from a clone of such a repository is performed on a case-insensitive filesystem. This can hap
system, or when a checkout from a clone of such a repository is performed on a case-insensitive filesystem. This can happen on checkout (DirCacheCheckout), merge (ResolveMerger via its WorkingTreeUpdater), pull (PullCommand using merge), and when applying a patch (PatchApplier). This can be exploited for remote code execution (RCE), for instance if the file written outside the working tree is a git filter that gets executed on a subsequent git command. The issue occurs only on case-insensitive filesystems, like the default filesystems on Windows and macOS. The user performing the clone or checkout must have the rights to create symbolic links for the problem to occur, and symbolic links must
ng the clone or checkout must have the rights to create symbolic links for the problem to occur, and symbolic links must be enabled in the git configuration. Setting git configuration option core.symlinks = false before checking out avoids the problem. The issue was fixed in Eclipse JGit version 6.6.1.202309021850-r and 6.7.0.202309050840-r, available via Maven Central https://repo1.maven.org/maven2/org/eclipse/jgit/ and repo.eclipse.org https://repo.eclipse.org/content/repositories/jgit-releases/ . A backport is available in 5.13.3 starting from 5.13.3.202401111512-r. The JGit maintainers would like to thank RyotaK for finding and reporting this issue. Additional Analyst Notes: - CISA ADP V
JGit maintainers would like to thank RyotaK for finding and reporting this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/11 - https://projects.eclipse.org/projects/technology.jgit/releases/6.6.1 - https://git.eclipse.org/c/jgit/jgit.git/commit/?id=9072103f3b3cf64dd12ad2949836ab98f62dabf1
CVE ID: CVE-2023-4760 State: PUBLISHED Published: 2023-09-21T07:35:35.790Z Last Updated: 2024-09-24T16:26:06.907Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: Eclipse Foundation Products: Eclipse RAP Problem Types: CWE-22, CWE-23 Description: In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component. The reason for this is a not completely secure extraction of the file name in the FileUploadProcessor.stripFileName(String name) method. As soon as this finds a / in the path, everything before it is removed, but potentially \ (backslashes) coming further back are kept. For ex
s a / in the path, everything before it is removed, but potentially \ (backslashes) coming further back are kept. For example, a file name such as /..\..\webapps\shell.war can be used to upload a file to a Tomcat server under Windows, which is then saved as ..\..\webapps\shell.war in its webapps directory and can then be executed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/160 - https://github.com/eclipse-rap/org.eclipse.rap/pull/141
CVE ID: CVE-2023-4761 State: PUBLISHED Published: 2023-09-05T21:57:42.150Z Last Updated: 2025-06-25T14:24:59.245Z Vendors: Google Products: Chrome Problem Types: Out of bounds memory access Description: Out of bounds memory access in FedCM in Google Chrome prior to 116.0.5845.179 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop.html - https://crbug.com/1476403 - https://www.debian.org/security/2023/dsa-5491 -
/09/stable-channel-update-for-desktop.html - https://crbug.com/1476403 - https://www.debian.org/security/2023/dsa-5491 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27NR3KG553CG6LGPMP6SHWEVHTYPL6RC/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/ - https://security.gentoo.org/glsa/202311-11 - https://security.gentoo.org/glsa/202312-07 - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-4762 State: PUBLISHED Published: 2023-09-05T21:57:42.402Z Last Updated: 2025-10-21T23:05:39.693Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop.html - https://crbug.com/1473247 - https://www.debian.org/security/2023/dsa-5491 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.
.debian.org/security/2023/dsa-5491 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27NR3KG553CG6LGPMP6SHWEVHTYPL6RC/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/ - https://security.gentoo.org/glsa/202311-11 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4762 - https://security.gentoo.org/glsa/202312-07 - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-4763 State: PUBLISHED Published: 2023-09-05T21:57:42.607Z Last Updated: 2025-05-05T15:18:47.778Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Networks in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop.html - https://crbug.com/1469928 - https://www.debian.org/security/2023/dsa-5491 - https://lists.fedoraproject.org/archives/list/package-announce@l
69928 - https://www.debian.org/security/2023/dsa-5491 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27NR3KG553CG6LGPMP6SHWEVHTYPL6RC/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/ - https://security.gentoo.org/glsa/202311-11 - https://security.gentoo.org/glsa/202312-07 - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-4764 State: PUBLISHED Published: 2023-09-05T21:57:42.716Z Last Updated: 2025-02-13T17:18:05.809Z Vendors: Google Products: Chrome Problem Types: Incorrect security UI Description: Incorrect security UI in BFCache in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop.html - https://crbug.com/1447237 - https://www.debian.org/security/2023/dsa-5491 - https://lists.fedoraproject.org/archives/li
https://crbug.com/1447237 - https://www.debian.org/security/2023/dsa-5491 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27NR3KG553CG6LGPMP6SHWEVHTYPL6RC/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/ - https://security.gentoo.org/glsa/202311-11 - https://security.gentoo.org/glsa/202312-07 - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-4765 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:19.193Z Description: No description available.
CVE ID: CVE-2023-4766 State: PUBLISHED Published: 2023-09-14T18:12:14.981Z Last Updated: 2024-09-25T19:30:41.781Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Movus Products: Movus Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Movus allows SQL Injection.This issue affects Movus: before 20230913. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0524
CVE ID: CVE-2023-4767 State: PUBLISHED Published: 2023-11-03T10:41:24.845Z Last Updated: 2024-09-05T13:59:18.678Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ManageEngine Products: Desktop Central Problem Types: CWE-93 Description: A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via the fileName parameter in /STATE_ID/1613157927228/InvSWMetering.csv. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/n
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-manageengine-desktop-central
CVE ID: CVE-2023-4768 State: PUBLISHED Published: 2023-11-03T10:42:59.426Z Last Updated: 2024-09-05T13:59:05.415Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ManageEngine Products: Desktop Central Problem Types: CWE-93 Description: A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via the fileName parameter in /STATE_ID/1613157927228/InvSWMetering.pdf. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/n
CVE ID: CVE-2023-4769 State: PUBLISHED Published: 2023-11-03T10:55:13.914Z Last Updated: 2024-09-05T18:05:51.428Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ManageEngine Products: Desktop Central Problem Types: CWE-918 Description: A SSRF vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0, specifically the /smtpConfig.do component. This vulnerability could allow an authenticated attacker to launch targeted attacks, such as a cross-port attack, service enumeration and other attacks via HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-manageengine-desktop-central
CVE ID: CVE-2023-4770 State: PUBLISHED Published: 2023-11-30T13:32:43.408Z Last Updated: 2024-08-02T07:37:59.774Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: 4D Products: 4D.exe, 4D Server.exe Problem Types: CWE-427 Description: An uncontrolled search path element vulnerability has been found on 4D and 4D server Windows executables applications, affecting version 19 R8 100218. This vulnerability consists in a DLL hijacking by replacing x64 shfolder.dll in the installation path, causing an arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/uncontrolled-search-path-e
es: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/uncontrolled-search-path-element-vulnerability-4d-and-4d-windows-server
CVE ID: CVE-2023-4771 State: PUBLISHED Published: 2023-11-16T14:08:47.418Z Last Updated: 2024-10-01T14:50:24.839Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: CKSource Products: CKEditor Problem Types: CWE-79 Description: A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /ckeditor/samples/old/ajax.html file and retrieve an authorized user's information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-cksource
lnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-cksource-ckeditor
CVE ID: CVE-2023-4772 State: PUBLISHED Published: 2023-09-07T01:52:16.285Z Last Updated: 2025-02-05T19:30:35.949Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: satollo Products: Newsletter – Send awesome emails from WordPress Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'newsletter_form' shortcode in versions up to, and including, 7.8.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level
d output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/87da5300-1add-44fc-a3e0-e8912f946c84?source=cve - https://plugins.trac.wordpress.org/browser/newsletter/tags/7.8.9/subscription/subscription.php#L1653 - https://plugins.trac.wordpress.org/changeset/2955097/newsletter#file21
CVE ID: CVE-2023-4773 State: PUBLISHED Published: 2023-09-06T03:28:19.694Z Last Updated: 2025-02-05T19:31:14.056Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: miled Products: WordPress Social Login Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WordPress Social Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wordpress_social_login_meta' shortcode in versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level an
utput escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b987822d-2b1b-4f79-988b-4bd731864b63?source=cve - https://plugins.trac.wordpress.org/browser/wordpress-social-login/tags/3.0.4/includes/widgets/wsl.auth.widgets.php#L413