Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
e-for-desktop_16.html - https://crbug.com/1435166 - https://www.debian.org/security/2023/dsa-5404 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73XUIHJ6UT75VFPDPLJOXJON7MVIKVZI/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXFL4TDAH72PRCPD5UPZMJMKIMVOPLTI/ - https://security.gentoo.org/glsa/202309-17 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2023-2724 State: PUBLISHED Published: 2023-05-16T18:45:34.232Z Last Updated: 2025-05-05T16:00:30.247Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type confusion in V8 in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html - https://crbug.com/1433211 - https://www.debian.org/security/2023/dsa-5404 - https://lists.fedoraproject.org/archives/list/package-announce@list
11 - https://www.debian.org/security/2023/dsa-5404 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73XUIHJ6UT75VFPDPLJOXJON7MVIKVZI/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXFL4TDAH72PRCPD5UPZMJMKIMVOPLTI/ - http://packetstormsecurity.com/files/173131/Chrome-Internal-JavaScript-Object-Access-Via-Origin-Trials.html - https://security.gentoo.org/glsa/202309-17 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2023-2725 State: PUBLISHED Published: 2023-05-16T18:45:34.352Z Last Updated: 2025-05-05T16:00:18.773Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html - https://crbug.com/1442516 - https://www.debian.org/security/2023/dsa-5404 - https://lis
nel-update-for-desktop_16.html - https://crbug.com/1442516 - https://www.debian.org/security/2023/dsa-5404 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73XUIHJ6UT75VFPDPLJOXJON7MVIKVZI/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXFL4TDAH72PRCPD5UPZMJMKIMVOPLTI/ - https://security.gentoo.org/glsa/202309-17 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2023-2726 State: PUBLISHED Published: 2023-05-16T18:45:34.470Z Last Updated: 2025-05-05T16:00:09.161Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in WebApp Installs in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious web app to bypass install dialog via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html - https://crbug.com/1442018 - https://www.debian.org/security/2023/dsa
2023/05/stable-channel-update-for-desktop_16.html - https://crbug.com/1442018 - https://www.debian.org/security/2023/dsa-5404 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73XUIHJ6UT75VFPDPLJOXJON7MVIKVZI/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXFL4TDAH72PRCPD5UPZMJMKIMVOPLTI/ - https://security.gentoo.org/glsa/202309-17 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2023-2727 State: PUBLISHED Published: 2023-07-03T20:05:04.329Z Last Updated: 2025-02-13T16:45:04.559Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Kubernetes Products: Kubernetes Problem Types: CWE-20 Description: Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8 - https://github.com/kub
nrichment: References: - https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8 - https://github.com/kubernetes/kubernetes/issues/118640 - http://www.openwall.com/lists/oss-security/2023/07/06/2 - https://security.netapp.com/advisory/ntap-20230803-0004/
CVE ID: CVE-2023-2728 State: PUBLISHED Published: 2023-07-03T20:06:11.796Z Last Updated: 2025-02-13T16:45:20.353Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Kubernetes Products: Kubernetes Problem Types: CWE-20 Description: Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are us
only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8 - https://github.com/kubernetes/kubernetes/issues/118640 - http://www.openwall.com/lists/oss-security/2023/07/06/3 - https://security.netapp.com/advisory/ntap-20230803-0004/
CVE ID: CVE-2023-2729 State: PUBLISHED Published: 2023-06-13T07:11:54.850Z Last Updated: 2025-01-03T15:24:12.653Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Synology Products: DiskStation Manager (DSM), Unified Controller (DSMUC), Synology Router Manager (SRM) Problem Types: CWE-330: Use of Insufficiently Random Values Description: Use of insufficiently random values vulnerability in User Management Functionality in Synology DiskStation Manager (DSM) before 7.2-64561 allows remote attackers to obtain user credential via unspecified vectors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.synology.com
tors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_23_07 - https://www.synology.com/en-global/security/advisory/Synology_SA_23_08
CVE ID: CVE-2023-2730 State: PUBLISHED Published: 2023-05-16T00:00:00.000Z Last Updated: 2025-01-22T21:17:58.930Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pimcore/pimcore/commit/8ab06bfbb5a05a1b190731d9c7476ec45f5ee878 - https://huntr.dev/bounties/6c6f5c26-d545-4e7b-82bb-1fe28006c885
CVE ID: CVE-2023-2731 State: PUBLISHED Published: 2023-05-17T00:00:00.000Z Last Updated: 2025-01-22T18:22:52.418Z Vendors: n/a Products: libtiff Problem Types: CWE-476 Description: A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attacker to craft specific input data that can cause the program to dereference a NULL pointer when decompressing a TIFF format file, resulting in a program crash or denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/libtiff/libtiff/-/issues/548 - https://bugzilla.redhat.com/show_bug.cgi?id=2207635 - https://
nces: - https://gitlab.com/libtiff/libtiff/-/issues/548 - https://bugzilla.redhat.com/show_bug.cgi?id=2207635 - https://github.com/libsdl-org/libtiff/commit/9be22b639ea69e102d3847dca4c53ef025e9527b - https://access.redhat.com/security/cve/CVE-2023-2731 - https://security.netapp.com/advisory/ntap-20230703-0009/
CVE ID: CVE-2023-2732 State: PUBLISHED Published: 2023-05-25T02:05:35.897Z Last Updated: 2025-01-13T16:32:12.754Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: inspireui Products: MStore API Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they hav
possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f00761a7-fe24-49a3-b3e3-a471e05815c1?source=cve - https://plugins.trac.wordpress.org/browser/mstore-api/tags/3.9.0/controllers/listing-rest-api/class.api.fields.php#L1079 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2916124%40mstore-api&old=2915729%40mstore-api&sfp_email=&sfph_mail=#file58
CVE ID: CVE-2023-2733 State: PUBLISHED Published: 2023-05-25T02:05:34.551Z Last Updated: 2025-01-13T16:47:09.488Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: inspireui Products: MStore API Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. This is due to insufficient verification on the user being supplied during the coupon redemption REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if th
es it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c726d8f0-7f2a-414b-9d73-a053921074d9?source=cve - https://plugins.trac.wordpress.org/browser/mstore-api/tags/3.9.0/controllers/flutter-woo.php#L734 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2913397%40mstore-api&old=2910707%40mstore-api&sfp_email=&sfph_mail=#file60
CVE ID: CVE-2023-2734 State: PUBLISHED Published: 2023-05-25T02:05:31.657Z Last Updated: 2025-01-13T16:47:16.763Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: inspireui Products: MStore API Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, i
makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5881d16c-84e8-4610-8233-cfa5a94fe3f9?source=cve - https://plugins.trac.wordpress.org/browser/mstore-api/tags/3.9.0/controllers/flutter-woo.php#L911 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2915729%40mstore-api&old=2913397%40mstore-api&sfp_email=&sfph_mail=#file59
CVE ID: CVE-2023-2735 State: PUBLISHED Published: 2023-05-20T02:03:22.910Z Last Updated: 2025-02-05T19:44:45.769Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: trainingbusinesspros Products: WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Groundhogg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gh_form' shortcode in versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for a
9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note this only works with legacy contact forms. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4938206e-2ea4-47ed-a307-87cf67dd74a4?source=cve - https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/includes/shortcodes.php#L51 - https://plugins.trac.wordpress.org/browser/groundhogg/tags/2
owser/groundhogg/tags/2.7.9.8/includes/shortcodes.php#L51 - https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/includes/form/form.php#L187 - https://plugins.trac.wordpress.org/changeset/2914493/groundhogg/trunk/includes/better-meta-compat.php
CVE ID: CVE-2023-2736 State: PUBLISHED Published: 2023-05-20T02:03:23.875Z Last Updated: 2025-01-13T16:48:29.235Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: trainingbusinesspros Products: WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8. This is due to missing nonce validation in the 'ajax_edit_contact' function. This makes it possible for authenticated attackers to receive the auto login link via shortcode and then modify the ass
This makes it possible for authenticated attackers to receive the auto login link via shortcode and then modify the assigned user to the auto login link to elevate verified user privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9bf472f1-5980-48ee-aa10-aad19b6f2456?source=cve - https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/includes/shortcodes.php#L99 - https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/admin/contacts/contacts-page.
es/shortcodes.php#L99 - https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/admin/contacts/contacts-page.php#L542 - https://plugins.trac.wordpress.org/changeset/2914493/groundhogg/tags/2.7.10/admin/contacts/contacts-page.php
CVE ID: CVE-2023-2737 State: PUBLISHED Published: 2023-08-16T15:45:29.540Z Last Updated: 2024-10-01T18:19:57.696Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: Thales Products: SafeNet Authtentication Service Agent Problem Types: CWE-276 Description: Improper log permissions in SafeNet Authentication Service Version 3.4.0 on Windows allows an authenticated attacker to cause a denial of service via local privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=08f460ba47bba550c0e42e61e36d432f&sysparm_article=KB0027485
CVE ID: CVE-2023-2738 State: PUBLISHED Published: 2023-05-16T15:00:04.971Z Last Updated: 2024-08-02T06:33:05.530Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Tongda Products: OA Problem Types: CWE-434 Description: A vulnerability classified as critical has been found in Tongda OA 11.10. This affects the function actionGetdata of the file GatewayController.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-229149 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional
his vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.229149 - https://vuldb.com/?ctiid.229149 - https://github.com/RCEraser/cve/blob/main/tongda.md
CVE ID: CVE-2023-2739 State: PUBLISHED Published: 2023-05-16T15:31:03.717Z Last Updated: 2024-08-02T06:33:05.319Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Gira Products: HomeServer Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in Gira HomeServer up to 4.12.0.220829 beta. This vulnerability affects unknown code of the file /hslist. The manipulation of the argument lst with the input debug%27"><img%20src=x%20onerror=alert(document.cookie)> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-229150 is the identifier assigned to this vulnerability. NOTE: T
t has been disclosed to the public and may be used. VDB-229150 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.229150 - https://vuldb.com/?ctiid.229150
CVE ID: CVE-2023-2740 State: PUBLISHED Published: 2023-05-16T16:31:03.385Z Last Updated: 2024-08-02T06:33:05.552Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Guest Management System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Guest Management System 1.0. Affected by this issue is some unknown functionality of the file dateTest.php of the component GET Parameter Handler. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is V
unched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229160. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.229160 - https://vuldb.com/?ctiid.229160 - https://github.com/xryj920/CVE/blob/main/XSS.md
CVE ID: CVE-2023-2742 State: PUBLISHED Published: 2023-06-19T10:52:43.675Z Last Updated: 2025-04-23T16:20:59.876Z Vendors: Unknown Products: AI ChatBot Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The AI ChatBot WordPress plugin before 4.5.5 does not sanitize and escape its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f689442a-a851-4140-a10c-ac579f9da142
CVE ID: CVE-2023-2743 State: PUBLISHED Published: 2023-06-27T13:17:05.869Z Last Updated: 2025-05-05T15:59:57.520Z Vendors: Unknown Products: WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The ERP WordPress plugin before 1.12.4 does not sanitise and escape the employee_name parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/517c6aa4-a56d-4f13-b370-7c864dd9c7db
CVE ID: CVE-2023-2744 State: PUBLISHED Published: 2023-06-27T13:17:11.163Z Last Updated: 2025-02-13T16:45:23.489Z Vendors: Unknown Products: WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting Problem Types: CWE-89 SQL Injection Description: The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/435da8a1-9955-46d7-a508-b57
E Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/435da8a1-9955-46d7-a508-b5738259e731 - http://packetstormsecurity.com/files/175106/WordPress-WP-ERP-1.12.2-SQL-Injection.html
CVE ID: CVE-2023-2745 State: PUBLISHED Published: 2023-05-17T08:36:44.034Z Last Updated: 2025-04-24T18:22:33.536Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: WordPress Foundation Products: WordPress Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to p
ker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/edcf46b6-368e-49c0-b2c3-99bf6e2d358f?source=cve - https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/ - https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=55765%40%2F&new=55765%40%2F&sfp_email=&sfph_mail= - http://packetstormsecurity.com/files/172426/WordPress-Core-6.2-XSS-CSRF-Directory-Traversal.html - https://lists.debian.org/debian-
etstormsecurity.com/files/172426/WordPress-Core-6.2-XSS-CSRF-Directory-Traversal.html - https://lists.debian.org/debian-lts-announce/2023/06/msg00024.html
CVE ID: CVE-2023-2746 State: PUBLISHED Published: 2023-07-11T13:15:04.152Z Last Updated: 2024-11-07T17:27:54.204Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Rockwell Automation Products: Enhanced HIM Problem Types: CWE-352 Description: The Rockwell Automation Enhanced HIM software contains an API that the application uses that is not protected sufficiently and uses incorrect Cross-Origin Resource Sharing (CORS) settings and, as a result, is vulnerable to a Cross Site Request Forgery (CSRF) attack. To exploit this vulnerability, a malicious user would have to convince a user to click on an untrusted link through a social engineering attack or successfu