Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-1055 State: PUBLISHED Published: 2023-02-27T00:00:00.000Z Last Updated: 2025-03-11T14:02:59.854Z Vendors: n/a Products: Red Hat Directory Server Problem Types: CWE-200 Description: A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bu
ta confidentiality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2173517#c0 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZOYQ5TCV6ZEPMDV4CSLK3KINAAO4SRI/
CVE ID: CVE-2023-1056 State: PUBLISHED Published: 2023-02-27T11:08:22.362Z Last Updated: 2024-08-02T05:32:46.368Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Doctors Appointment System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Doctors Appointment System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /edoc/doctor/patient.php. The manipulation of the argument search12 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221821 was assigned to this vulnerability. Addi
oit has been disclosed to the public and may be used. The identifier VDB-221821 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221821 - https://vuldb.com/?ctiid.221821 - https://github.com/E1CHO/cve_hub/blob/main/edoc%20doctor%20appointment%20system/edoc%20docker%20search.pdf
CVE ID: CVE-2023-1057 State: PUBLISHED Published: 2023-02-27T11:08:24.026Z Last Updated: 2024-08-02T05:32:46.385Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Doctors Appointment System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Doctors Appointment System 1.0. It has been rated as critical. Affected by this issue is the function edoc of the file login.php. The manipulation of the argument usermail leads to sql injection. VDB-221822 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221822 - https://vuldb.com/?c
ty. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221822 - https://vuldb.com/?ctiid.221822 - https://github.com/E1CHO/cve_hub/blob/main/edoc%20doctor%20appointment%20system/edoc%20doctor%20appointment%20system%20vlun1.pdf
CVE ID: CVE-2023-1058 State: PUBLISHED Published: 2023-02-27T11:08:26.113Z Last Updated: 2024-08-02T05:32:46.339Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Doctors Appointment System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Doctors Appointment System 1.0. This affects an unknown part of the file create-account.php. The manipulation of the argument newemail leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221823. Additional Analyst Notes: - CVE Pr
ublic and may be used. The associated identifier of this vulnerability is VDB-221823. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221823 - https://vuldb.com/?ctiid.221823 - https://github.com/E1CHO/cve_hub/blob/main/edoc%20doctor%20appointment%20system/edoc%20doctor%20appointment%20system%20vlun2.pdf
CVE ID: CVE-2023-1059 State: PUBLISHED Published: 2023-02-27T11:08:27.930Z Last Updated: 2025-05-17T09:56:48.826Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Doctors Appointment System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in SourceCodester Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/doctors.php of the component Parameter Handler. The manipulation of the argument search/id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.221824 - https://vuldb.com/?ctiid.221824 - https://vuldb.com/?submit.95222 - https://github.com/E1CHO/cve_hub/blob/main/edoc%20doctor%20appointment%20system/edoc%20doctor%20appointment%20system%20vlun3.pdf - https://www.sourcecodester.com/
CVE ID: CVE-2023-1060 State: PUBLISHED Published: 2023-03-31T09:02:04.236Z Last Updated: 2025-02-11T18:42:12.829Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: YKM Products: YKM CRM Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YKM YKM CRM allows Reflected XSS.This issue affects YKM CRM: before 23.03.30. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0189
CVE ID: CVE-2023-1061 State: PUBLISHED Published: 2023-02-27T11:08:30.134Z Last Updated: 2025-05-17T09:57:25.418Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Doctors Appointment System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Doctors Appointment System 1.0. This issue affects some unknown processing of the file /admin/edit-doc.php. The manipulation of the argument email/oldmail leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: References: - ht
it has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221825 - https://vuldb.com/?ctiid.221825 - https://vuldb.com/?submit.95223 - https://github.com/E1CHO/cve_hub/blob/main/edoc%20doctor%20appointment%20system/edoc%20doctor%20appointment%20system%20vlun4.pdf - https://www.sourcecodester.com/
CVE ID: CVE-2023-1062 State: PUBLISHED Published: 2023-02-27T11:08:31.912Z Last Updated: 2024-08-02T05:32:46.350Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Doctors Appointment System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Doctors Appointment System 1.0. Affected is an unknown function of the file /admin/add-new.php of the component Parameter Handler. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-221826 is the identifier assigned to this vulnerabili
The exploit has been disclosed to the public and may be used. VDB-221826 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221826 - https://vuldb.com/?ctiid.221826 - https://github.com/E1CHO/cve_hub/blob/main/edoc%20doctor%20appointment%20system/edoc%20doctor%20appointment%20system%20vlun5.pdf
CVE ID: CVE-2023-1063 State: PUBLISHED Published: 2023-02-27T11:08:33.552Z Last Updated: 2024-08-02T05:32:46.345Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Doctors Appointment System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Doctors Appointment System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/patient.php of the component Parameter Handler. The manipulation of the argument search leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnera
unched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221827. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221827 - https://vuldb.com/?ctiid.221827 - https://github.com/E1CHO/cve_hub/blob/main/edoc%20doctor%20appointment%20system/edoc%20doctor%20appointment%20system%20vlun6.pdf
CVE ID: CVE-2023-1064 State: PUBLISHED Published: 2023-03-01T12:51:08.179Z Last Updated: 2025-03-07T18:52:17.728Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Uzay Baskul Products: Weighbridge Automation Software Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Uzay Baskul Weighbridge Automation Software allows SQL Injection.This issue affects Weighbridge Automation Software: before 1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0115
CVE ID: CVE-2023-1065 State: PUBLISHED Published: 2023-02-28T18:32:47.899Z Last Updated: 2025-03-07T18:37:42.258Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Snyk Products: Snyk Kubernetes Monitor Problem Types: CWE-287 Description: This vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, which could in turn obfuscate other, relevant, security issues. It does not expose the user of the integration to any direct security risk and no user data can be leaked. To exploit the vulnerability the attacker does not need to be authenticated to Snyk but does need to know the target's Integration ID (which
ability the attacker does not need to be authenticated to Snyk but does need to know the target's Integration ID (which may or may not be the same as the Organization ID, although this is an unpredictable UUID in either case). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/snyk/kubernetes-monitor - https://github.com/snyk/kubernetes-monitor/commit/5b9a7821680bbfb6c4a900ab05d898ce2b2cc157 - https://snyk.io/blog/api-auth-vuln-snyk-kubernetes-cve-2023-1065/ - https://github.com/snyk/kubernetes-monitor/pull/1275
CVE ID: CVE-2023-1067 State: PUBLISHED Published: 2023-02-27T00:00:00.000Z Last Updated: 2025-03-10T19:54:56.161Z Severity: MEDIUM (CVSS 5.2 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/31d17b34-f80d-49f2-86e7-97ae715cc045 - https://github.com/pimcore/pimcore/commit/4b5733266d7d6aeb4f221a15e005db83fc198edf
CVE ID: CVE-2023-1068 State: PUBLISHED Published: 2023-02-27T13:29:53.318Z Last Updated: 2025-01-13T17:04:16.753Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: teckel Products: Read More Excerpt Link Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Download Read More Excerpt Link plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.0. This is due to missing or incorrect nonce validation on the read_more_excerpt_link_menu_options() function. This makes it possible for unauthenticated attackers to update he plugin's settings via a forged request granted they can trick a site administr
or unauthenticated attackers to update he plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0359434b-9d88-4a40-8e9f-ec354c8de816 - https://plugins.trac.wordpress.org/changeset/2871098/read-more-excerpt-link/trunk/read-more-excerpt-link.php
CVE ID: CVE-2023-1069 State: PUBLISHED Published: 2023-03-27T15:37:34.972Z Last Updated: 2025-02-18T20:42:18.673Z Vendors: Unknown Products: Complianz, Complianz Premium Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/caacc50c-822
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/caacc50c-822e-46e9-bc0b-681349fd0dda
CVE ID: CVE-2023-1070 State: PUBLISHED Published: 2023-02-27T00:00:00.000Z Last Updated: 2025-03-10T19:58:33.350Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: nilsteampassnet Products: nilsteampassnet/teampass Problem Types: CWE-73 Description: External Control of File Name or Path in GitHub repository nilsteampassnet/teampass prior to 3.0.0.22. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/318bfdc4-7782-4979-956f-9ba2cc44889c - https://github.com/nilsteampassnet/teampass/commit/0af3574caba27a61b16dc25c94fa51ae12d2d967
CVE ID: CVE-2023-1071 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-10T20:58:46.736Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. Due to improper permissions checks it was possible for an unauthorised user to remove an issue from an epic. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/385434 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1071.json
CVE ID: CVE-2023-1072 State: PUBLISHED Published: 2023-03-09T00:00:00.000Z Last Updated: 2025-02-28T21:33:11.787Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 9.0 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible to trigger a resource depletion attack due to improper filtering for number of requests to read commits details. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
ests to read commits details. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/219619 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1072.json
CVE ID: CVE-2023-1073 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-04-23T16:23:24.284Z Vendors: n/a Products: kernel Problem Types: CWE-119 Description: A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a malicious USB device. This flaw allows a local user to crash or potentially escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2173403 - https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/id=b12fece4c64857e5fab4290bf01b2e0317a88456 - https://www.openwa
org/pub/scm/linux/kernel/git/next/linux-next.git/commit/id=b12fece4c64857e5fab4290bf01b2e0317a88456 - https://www.openwall.com/lists/osssecurity/2023/01/17/3 - https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html - https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html - http://www.openwall.com/lists/oss-security/2023/11/05/2 - http://www.openwall.com/lists/oss-security/2023/11/05/3
CVE ID: CVE-2023-1074 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-03-19T15:44:36.435Z Vendors: n/a Products: kernel Problem Types: CWE-401 Description: A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may occur when a user starts a malicious networking service and someone connects to this service. This could allow a local user to starve resources, causing a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2173430 - https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=458e279f861d3f61796
_bug.cgi?id=2173430 - https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=458e279f861d3f61796894cd158b780765a1569f - https://www.openwall.com/lists/oss-security/2023/01/23/1 - https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html - https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html - http://www.openwall.com/lists/oss-security/2023/11/05/4
CVE ID: CVE-2023-1075 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-24T17:05:54.360Z Vendors: n/a Products: Linus kernel Problem Types: CWE-200 Description: A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field that overlaps with rec->tx_ready. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=ffe2a22562444720b05bdfeb999c03e810d84cbb
CVE ID: CVE-2023-1076 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-24T17:04:30.565Z Vendors: n/a Products: Linux kernel Problem Types: CWE-791 Description: A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing network filters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
ns, possibly bypassing network filters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=66b2c338adce580dfce2199591e65e2bab889cff - https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=a096ccca6e503a5c575717ff8a36ace27510ab0a - https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
CVE ID: CVE-2023-1077 State: PUBLISHED Published: 2023-03-27T00:00:00 Last Updated: 2024-08-02T05:32:46.360Z Vendors: n/a Products: Linux kernel Problem Types: CWE-843 Description: In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing memory corruption. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=7c4a5b89a0b5a57a64b601775b296abf77a9fe
- https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=7c4a5b89a0b5a57a64b601775b296abf77a9fe97 - https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html - https://security.netapp.com/advisory/ntap-20230511-0002/ - https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
CVE ID: CVE-2023-1078 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-05-05T16:07:12.732Z Vendors: n/a Products: Linux kernel Problem Types: CWE-787 Description: A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled by local user. It is known how to trigger this, which causes an out of bounds access, and a lock corruption. Additional Analyst Notes: - CVE Program Container:
r this, which causes an out of bounds access, and a lock corruption. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=f753a68980cf4b59a80fe677619da2b1804f526d - https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html - https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html - https://security.netapp.com/advisory/ntap-20230505-0004/ - http://www.openwall.com/lists/oss-security/2023/11/05/1
CVE ID: CVE-2023-1079 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T21:36:25.856Z Vendors: n/a Products: Linux kernel Problem Types: CWE-416 Description: A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconnecting in a malicious USB device, which advertises itself as an Asus device. Similarly to the previous known CVE-2023-25012, but in asus devices, the work_struct may be scheduled by the LED controller while the device is disconnecting, triggering a use-after-free on the struct asus_kbd_leds *led structure. A malicious USB device may exploit the issue to cause memory corruption with controlled
ct asus_kbd_leds *led structure. A malicious USB device may exploit the issue to cause memory corruption with controlled data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=4ab3a086d10eeec1424f2e8a968827a6336203df - https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html - https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
CVE ID: CVE-2023-1080 State: PUBLISHED Published: 2023-02-28T12:52:17.573Z Last Updated: 2025-01-13T17:04:05.382Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: gnpublisher Products: GN Publisher: Google News Compatible RSS Feeds Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The GN Publisher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execut