Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20075. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1252/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE ID: CVE-2023-35748 State: PUBLISHED Published: 2024-05-07T22:55:02.706Z Last Updated: 2024-09-18T18:29:10.648Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-2622 Problem Types: CWE-121 Description: D-Link DAP-2622 DDP Firmware Upgrade Server IPv6 Address Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-su
ecific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20076. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1253/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE ID: CVE-2023-35749 State: PUBLISHED Published: 2024-05-07T22:55:03.505Z Last Updated: 2024-09-18T18:29:11.346Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-2622 Problem Types: CWE-121 Description: D-Link DAP-2622 DDP Firmware Upgrade Filename Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data
exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20077. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1254/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE ID: CVE-2023-35750 State: PUBLISHED Published: 2024-05-03T01:58:02.698Z Last Updated: 2024-09-18T18:29:12.128Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: D-Link Products: DAP-2622 Problem Types: CWE-200 Description: D-Link DAP-2622 DDP Get SSID List WPA PSK Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can le
service. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. . Was ZDI-CAN-20078. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1255/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE ID: CVE-2023-35751 State: PUBLISHED Published: 2024-05-03T01:58:03.487Z Last Updated: 2024-09-18T18:29:12.840Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-2622 Problem Types: CWE-121 Description: D-Link DAP-2622 DDP Set AG Profile Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied d
law exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20079. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1256/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE ID: CVE-2023-35752 State: PUBLISHED Published: 2024-05-03T01:58:04.190Z Last Updated: 2024-09-18T18:29:13.571Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-2622 Problem Types: CWE-121 Description: D-Link DAP-2622 DDP Set AG Profile Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied d
law exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20080. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1257/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE ID: CVE-2023-35753 State: PUBLISHED Published: 2024-05-03T01:58:04.905Z Last Updated: 2024-09-18T18:29:14.265Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-2622 Problem Types: CWE-121 Description: D-Link DAP-2622 DDP Set AG Profile UUID Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior
s within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20081. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1258/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE ID: CVE-2023-35754 State: PUBLISHED Published: 2024-05-03T01:58:05.630Z Last Updated: 2024-09-18T18:29:14.997Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-2622 Problem Types: CWE-121 Description: D-Link DAP-2622 DDP Set AG Profile NMS URL Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data pr
ists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20082. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1259/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE ID: CVE-2023-35755 State: PUBLISHED Published: 2024-05-03T01:58:06.337Z Last Updated: 2024-09-18T18:29:15.690Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-2622 Problem Types: CWE-121 Description: D-Link DAP-2622 DDP Set Date-Time Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied da
aw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20083. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1260/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE ID: CVE-2023-35756 State: PUBLISHED Published: 2024-05-03T01:58:07.214Z Last Updated: 2024-09-18T18:29:16.397Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-2622 Problem Types: CWE-121 Description: D-Link DAP-2622 DDP Set Date-Time Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied da
aw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20084. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1261/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE ID: CVE-2023-35757 State: PUBLISHED Published: 2024-05-07T22:55:04.334Z Last Updated: 2024-09-18T18:29:17.141Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-2622 Problem Types: CWE-121 Description: D-Link DAP-2622 DDP Set Date-Time NTP Server Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data
exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20085. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1262/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE ID: CVE-2023-35759 State: PUBLISHED Published: 2023-06-23T00:00:00 Last Updated: 2024-08-02T16:30:44.708Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Progress WhatsUp Gold before 23.0.0, an SNMP-related application endpoint failed to adequately sanitize malicious input. This could allow an unauthenticated attacker to execute arbitrary code in a victim's browser, aka XSS. Additional Analyst Notes: - CVE Program Container: References: - https://community.progress.com/s/article/Product-Alert-Bulletin-June-2023 - http://packetstormsecurity.com/files/176978/WhatsUp-Gold-2022-22.1.0-Build-39-Cross-Site-Scripting.html
CVE ID: CVE-2023-35762 State: PUBLISHED Published: 2023-11-20T16:25:56.318Z Last Updated: 2024-08-29T20:44:07.383Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: INEA Products: ME RTU Problem Types: CWE-78 Description: Versions of INEA ME RTU firmware 3.36b and prior are vulnerable to operating system (OS) command injection, which could allow remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-02
CVE ID: CVE-2023-35763 State: PUBLISHED Published: 2023-07-18T17:23:43.966Z Last Updated: 2024-10-21T15:56:28.486Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: iagona Products: ScrutisWeb Problem Types: CWE-321 Use of Hard-coded Cryptographic Key Description: Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a cryptographic vulnerability that could allow an unauthenticated user to decrypt encrypted passwords into plaintext. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-03
CVE ID: CVE-2023-35764 State: PUBLISHED Published: 2024-04-03T07:10:07.459Z Last Updated: 2024-08-12T20:21:25.142Z Vendors: AYS Pro Plugins Products: Survey Maker Problem Types: Insufficient verification of data authenticity Description: Insufficient verification of data authenticity issue in Survey Maker prior to 3.6.4 allows a remote unauthenticated attacker to spoof an IP address when posting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/survey-maker/ - https://jvn.jp/en/jp/JVN51098626/
CVE ID: CVE-2023-35765 State: PUBLISHED Published: 2023-07-06T23:01:56.339Z Last Updated: 2024-10-24T13:25:22.604Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: PiiGAB Products: M-Bus SoftwarePack Problem Types: CWE-256 Description: PiiGAB M-Bus stores credentials in a plaintext file, which could allow a low-level user to gain admin credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-187-01
CVE ID: CVE-2023-35767 State: PUBLISHED Published: 2023-11-08T15:31:29.693Z Last Updated: 2024-11-11T14:27:36.821Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Helix, Helix Products: Helix Core, Helix Swarm Problem Types: CWE-400 Description: In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Jason Geffner. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://perforce.com
CVE ID: CVE-2023-35769 State: PUBLISHED Published: 2024-02-14T13:38:07.684Z Last Updated: 2024-08-07T19:28:41.258Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) CIP software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path in some Intel(R) CIP software before version 2.4.10577 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00959.html
CVE ID: CVE-2023-35772 State: PUBLISHED Published: 2023-06-19T13:54:25.261Z Last Updated: 2024-10-10T18:35:03.851Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Alain Gonzalez Products: Google Map Shortcode Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Alain Gonzalez Google Map Shortcode plugin <= 3.1.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/google-map-shortcode/wordpress-google-map-shortcode-plugin-3-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-35773 State: PUBLISHED Published: 2023-07-11T12:42:38.927Z Last Updated: 2024-10-07T17:28:43.551Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Danny Hearnah - ChubbyNinjaa Products: Template Debugger Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Danny Hearnah - ChubbyNinjaa Template Debugger plugin <= 3.1.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/quick-edit-template-link/wordpress-template-debugger-plugin-3-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-35774 State: PUBLISHED Published: 2023-07-11T08:05:47.913Z Last Updated: 2024-10-11T15:06:25.898Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: LWS Products: LWS Tools Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Tools plugin <= 2.4.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/lws-tools/wordpress-lws-tools-plugin-2-4-1-multiple-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-35775 State: PUBLISHED Published: 2023-06-19T13:32:21.783Z Last Updated: 2025-02-19T21:29:27.423Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: WP Backup Solutions Products: WP Backup Manager Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Backup Solutions WP Backup Manager plugin <= 1.13.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-backup-manager/wordpress-wp-backup-manager-plugin-1-13-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-35776 State: PUBLISHED Published: 2023-06-19T13:27:26.697Z Last Updated: 2024-10-10T18:35:57.570Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Beplus Products: Sermon'e – Sermons Online Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Beplus Sermon'e – Sermons Online plugin <= 1.0.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/sermone-online-sermons-management/wordpress-sermon-e-sermons-online-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-35777 State: PUBLISHED Published: 2024-12-13T14:23:40.469Z Last Updated: 2024-12-13T18:38:01.198Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: The Events Calendar Products: The Events Calendar Problem Types: CWE-862 Description: Missing Authorization vulnerability in The Events Calendar The Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.1.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/the-events-calendar/vulnerability/wordpress-the-events-calendar-plugin-6-1-2-2-broken-
ack.com/database/wordpress/plugin/the-events-calendar/vulnerability/wordpress-the-events-calendar-plugin-6-1-2-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-35778 State: PUBLISHED Published: 2023-07-11T11:11:39.425Z Last Updated: 2024-10-07T17:33:20.748Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Neha Goel Products: Recent Posts Slider Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Neha Goel Recent Posts Slider plugin <= 1.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/recent-posts-slider/wordpress-recent-posts-slider-plugin-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-35779 State: PUBLISHED Published: 2023-06-19T13:21:16.714Z Last Updated: 2024-10-10T18:34:40.298Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Seed Webs Products: Seed Fonts Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Seed Webs Seed Fonts plugin <= 2.3.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/seed-fonts/wordpress-seed-fonts-plugin-2-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-35780 State: PUBLISHED Published: 2023-07-11T11:04:24.781Z Last Updated: 2024-10-07T17:33:49.854Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Andy Whalen Products: Galleria Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Andy Whalen Galleria plugin <= 1.0.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/galleria/wordpress-galleria-plugin-1-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-35781 State: PUBLISHED Published: 2023-07-11T07:58:24.909Z Last Updated: 2024-10-11T16:08:22.063Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: LWS Products: LWS Cleaner Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in LWS Cleaner plugin <= 2.3.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/lws-cleaner/wordpress-lws-cleaner-plugin-2-3-0-multiple-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-35782 State: PUBLISHED Published: 2023-06-16T00:00:00 Last Updated: 2024-12-17T17:06:42.651Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:L/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The ipandlanguageredirect extension before 5.1.2 for TYPO3 allows SQL Injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-ext-sa-2023-005
CVE ID: CVE-2023-35783 State: PUBLISHED Published: 2023-06-16T00:00:00 Last Updated: 2024-12-11T20:19:31.739Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AC:L/AV:N/A:L/C:L/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The ke_search (aka Faceted Search) extension before 4.0.3, 4.1.x through 4.6.x before 4.6.6, and 5.x before 5.0.2 for TYPO3 allows XSS via indexed data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-ext-sa-2023-004