Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-38829 State: PUBLISHED Published: 2023-09-11T00:00:00 Last Updated: 2024-09-26T14:35:02.727Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in NETIS SYSTEMS WF2409E v.3.6.42541 allows a remote attacker to execute arbitrary code via the ping and traceroute functions of the diagnostic tools component in the admin management interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/adhikara13/CVE-2023-38829-NETIS-WF2409E
CVE ID: CVE-2023-38830 State: PUBLISHED Published: 2023-08-10T00:00:00 Last Updated: 2024-10-09T20:27:22.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information leak in PHPJabbers Yacht Listing Script v1.0 allows attackers to export clients' credit card numbers from the Reservations module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.phpjabbers.com/yacht-listing-script - https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-2-4fa5e2ccfe2e
CVE ID: CVE-2023-38831 State: PUBLISHED Published: 2023-08-23T00:00:00.000Z Last Updated: 2025-10-21T23:05:40.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023. Additional Analyst Notes: - CISA ADP V
ly the benign file. This was exploited in the wild in April through October 2023. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ - https://www.bleepingcomputer.com/news/security/winrar-zero-day-exploited-since-april-to-hack-trading-accounts/ - https://news.ycombinator.com/item?id=37236100 - http://packetstormsecurity.com/files/174573/WinRAR-Remote-Code-Execution.html - https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/
CVE ID: CVE-2023-38836 State: PUBLISHED Published: 2023-08-21T00:00:00 Last Updated: 2024-10-07T17:08:40.086Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://boidcms.com - https://github.com/BoidCMS/BoidCMS/issues/27 - http://packetstormsecurity.com/files/175026/BoidCMS-2.0.0-Shell-Upload.html
CVE ID: CVE-2023-38838 State: PUBLISHED Published: 2023-08-17T00:00:00 Last Updated: 2024-10-08T15:05:44.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Kidus Minimati v.1.0.0 allows a remote attacker to obtain sensitive information via the edit.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://kidus.com - http://minimati.com - https://github.com/kiduswb/minimati/issues/1
CVE ID: CVE-2023-38839 State: PUBLISHED Published: 2023-08-18T00:00:00 Last Updated: 2024-10-07T19:42:15.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Kidus Minimati v.1.0.0 allows a remote attacker to obtain sensitive information via theID parameter in the fulldelete.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kiduswb/minimati/issues/2
CVE ID: CVE-2023-38840 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-10-08T20:45:54.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bitwarden Desktop 2023.7.0 and below allows an attacker with local access to obtain sensitive information via the Bitwarden.exe process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://redmaple.tech/blogs/2023/extract-bitwarden-vault-passwords/ - https://github.com/markuta/bw-dump - https://github.com/bitwarden/desktop/issues/476 - https://github.com/bitwarden/clients/pull/5813
CVE ID: CVE-2023-38843 State: PUBLISHED Published: 2023-08-17T00:00:00 Last Updated: 2024-10-08T15:04:06.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Atlos v.1.0 allows an authenticated attacker to execute arbitrary code via a crafted payload into the description field in the incident function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/senzee1984/ff30f0914db39d2741ab17332f0fc6e1 - https://github.com/atlosdotorg/atlos
CVE ID: CVE-2023-38844 State: PUBLISHED Published: 2024-02-21T00:00:00 Last Updated: 2024-08-29T14:47:18.086Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in PMB v.7.4.7 and earlier allows a remote attacker to execute arbitrary code via the thesaurus parameter in export_skos.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nexacybersecurity.blogspot.com/2024/02/journey-finding-vulnerabilities-in-pmb-library-management-system.html
CVE ID: CVE-2023-38845 State: PUBLISHED Published: 2023-10-25T00:00:00 Last Updated: 2024-09-12T14:32:54.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Anglaise Company Anglaise.Company v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liff.line.me/1657030660-8nDEQNbe - https://github.com/syz913/CVE-reports/blob/main/CVE-2023-38845.md
CVE ID: CVE-2023-38846 State: PUBLISHED Published: 2023-10-25T00:00:00 Last Updated: 2024-09-12T14:32:07.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Marbre Lapin Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liff.line.me/1657925980-KmmGkje5 - https://github.com/syz913/CVE-reports/blob/main/CVE-2023-38846.md
CVE ID: CVE-2023-38847 State: PUBLISHED Published: 2023-10-25T00:00:00 Last Updated: 2024-09-12T14:20:19.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in CHRISTINA JAPAN Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liff.line.me/1657631315-oX5J26Ak - https://github.com/syz913/CVE-reports/blob/main/CVE-2023-38847.md
CVE ID: CVE-2023-38848 State: PUBLISHED Published: 2023-10-25T00:00:00 Last Updated: 2024-09-12T14:19:48.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in rmc R Beauty CLINIC Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liff.line.me/1657640647-Wk2xYj38 - https://github.com/syz913/CVE-reports/blob/main/CVE-2023-38848.md
CVE ID: CVE-2023-38849 State: PUBLISHED Published: 2023-10-25T00:00:00 Last Updated: 2024-09-11T19:06:55.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in tire-sales Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liff.line.me/1657203739-yvGg5PjN - https://github.com/syz913/CVE-reports/blob/main/CVE-2023-38849.md
CVE ID: CVE-2023-38850 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-10-08T20:42:18.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Michaelrsweet codedoc v.3.7 allows an attacker to cause a denial of service via the codedoc.c:1742 comppnent. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/michaelrsweet/codedoc/issues/15
CVE ID: CVE-2023-38851 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-10-08T20:41:25.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the xls_parseWorkBook function in xls.c:1018. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libxls/libxls/issues/124
CVE ID: CVE-2023-38852 State: PUBLISHED Published: 2023-08-15T00:00:00.000Z Last Updated: 2025-11-04T22:04:54.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the unicode_decode_wcstombs function in xlstool.c:266. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libxls/libxls/issues/124 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JQYGEBDBCOWBRHOW44BSSRADUOZBXHUE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fe
rg/message/JQYGEBDBCOWBRHOW44BSSRADUOZBXHUE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YHBUPYF2NX34HNAWZ3WYHKWU3KWVQUSV/
CVE ID: CVE-2023-38853 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-10-08T20:40:53.910Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the xls_parseWorkBook function in xls.c:1015. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libxls/libxls/issues/124
CVE ID: CVE-2023-38854 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-10-08T20:39:47.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the transcode_latin1_to_utf8 function in xlstool.c:296. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libxls/libxls/issues/124
CVE ID: CVE-2023-38855 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-10-08T20:38:40.158Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the get_string function in xlstool.c:395. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libxls/libxls/issues/124
CVE ID: CVE-2023-38856 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-10-08T20:37:41.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the get_string function in xlstool.c:411. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libxls/libxls/issues/124
CVE ID: CVE-2023-38857 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-11-26T21:38:45.309Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the stcoin function in mp4read.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/knik0/faad2/issues/171 - https://security.gentoo.org/glsa/202401-13
CVE ID: CVE-2023-38858 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-08-02T17:54:38.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the mp4info function in mp4read.c:1039. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/knik0/faad2/issues/173 - https://security.gentoo.org/glsa/202401-13
CVE ID: CVE-2023-38860 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-10-09T13:16:52.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hwchase17/langchain/issues/7641
CVE ID: CVE-2023-38861 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-10-09T13:15:07.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Wavlink WL_WNJ575A3 v.R75A3_V1410_220513 allows a remote attacker to execute arbitrary code via username parameter of the set_sys_adm function in adm.cgi. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TTY-flag/my_iot_vul/tree/main/WAVLINK/WL-WN575A3
CVE ID: CVE-2023-38862 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-10-09T13:12:25.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the destination parameter of sub_431F64 function in bin/webmgnt. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TTY-flag/my_iot_vul/tree/main/COMFAST/CF-XR11/Command_Inject1
CVE ID: CVE-2023-38863 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-10-09T13:11:38.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the ifname and mac parameters in the sub_410074 function at bin/webmgnt. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TTY-flag/my_iot_vul/tree/main/COMFAST/CF-XR11/Command_Inject4
CVE ID: CVE-2023-38864 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-10-09T13:10:46.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the protal_delete_picname parameter in the sub_41171C function at bin/webmgnt. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TTY-flag/my_iot_vul/tree/main/COMFAST/CF-XR11/Command_Inject3
CVE ID: CVE-2023-38865 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-10-09T13:08:57.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_4143F0. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter timestr. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TTY-flag/my_iot_vul/tree/main/COMFAST/CF-XR11/Command_Inject5
CVE ID: CVE-2023-38866 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-10-09T13:08:01.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_415588. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter interface and display_name. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TTY-flag/my_iot_vul/tree/main/COMFAST/CF-XR11/Command_Inject2
CVE ID: CVE-2023-38870 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-24T13:11:39.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1. The cash book has a feature to list accomplishments by category, and the 'category_id' parameter is vulnerable to SQL Injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gugoan/economizzer - https://www.economizzer.org - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38870
CVE ID: CVE-2023-38871 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-24T13:11:05.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password functionalities. The app reacts differently when a user or email address is valid, and when it's not. This may allow an attacker to determine whether a user or email address is valid, or brute force valid usernames and email addresses. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gugoan/economizzer - https://www.economizzer.o
gram Container: - CISA ADP Vulnrichment: References: - https://github.com/gugoan/economizzer - https://www.economizzer.org - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38871
CVE ID: CVE-2023-38872 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-23T19:36:32.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Direct Object Reference (IDOR) vulnerability in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1 allows any unauthenticated attacker to access cash book entry attachments of any other user, if they know the Id of the attachment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gugoan/economizzer - https://www.economizzer.org - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38872
CVE ID: CVE-2023-38873 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-23T19:33:26.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer is vulnerable to Clickjacking. Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top-level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both. Additional Analyst Notes: - CVE Progra
them to another page, most likely owned by another application, domain, or both. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gugoan/economizzer - https://www.economizzer.org - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38873
CVE ID: CVE-2023-38874 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-08-02T17:54:39.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). A malicious attacker can upload a PHP web shell as an attachment when adding a new cash book entry. Afterwards, the attacker may visit the web shell and execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gugoan/economizzer - https://www.economizzer.org - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-20
m/gugoan/economizzer - https://www.economizzer.org - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38874
CVE ID: CVE-2023-38875 State: PUBLISHED Published: 2023-09-20T00:00:00 Last Updated: 2024-09-25T15:06:46.088Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'validator' parameter in '/reset-password'. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38875
CVE ID: CVE-2023-38876 State: PUBLISHED Published: 2023-09-20T00:00:00 Last Updated: 2024-09-25T15:05:46.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'selector' parameter in '/reset-password'. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38876
CVE ID: CVE-2023-38877 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-23T19:28:13.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: A host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This allows an attacker to reset other users' passwords. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.economizzer.org - https://github
lyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.economizzer.org - https://github.com/gugoan/economizzer/ - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38877
CVE ID: CVE-2023-38878 State: PUBLISHED Published: 2023-09-11T00:00:00 Last Updated: 2024-09-26T14:33:26.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in DevCode OpenSTAManager versions 2.4.24 to 2.4.47 may allow a remote attacker to execute arbitrary JavaScript in the web browser of a victim by injecting a malicious payload into the 'error' and 'error_description' parameters of 'oauth2.php'. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/devcode-it/openstamanager - https://openstamanager.com/ - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2
ode-it/openstamanager - https://openstamanager.com/ - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38878
CVE ID: CVE-2023-38879 State: PUBLISHED Published: 2023-11-20T00:00:00 Last Updated: 2024-08-02T17:54:39.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'filename' parameter of 'DownloadWindow.php'. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Classic - https://www.os4ed.com/ - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38879