Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-5435 State: PUBLISHED Published: 2023-10-31T08:32:49.428Z Last Updated: 2025-02-05T18:54:07.636Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: gopiplus Products: Up down image slideshow gallery Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Up down image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with sub
nd lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0b72cf6f-4924-4fa5-8e1a-4054dfe73be0?source=cve - https://plugins.trac.wordpress.org/browser/up-down-image-slideshow-gallery/trunk/up-down-image-slideshow-gallery.php?rev=2827173#L208 - https://plugins.trac.wordpress.org/changeset/2985497/up-down-image-slideshow-g
-slideshow-gallery.php?rev=2827173#L208 - https://plugins.trac.wordpress.org/changeset/2985497/up-down-image-slideshow-gallery#file1
CVE ID: CVE-2023-5436 State: PUBLISHED Published: 2023-10-31T08:32:53.078Z Last Updated: 2025-02-05T18:53:05.695Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: gopiplushotmailcom Products: Vertical marquee plugin Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Vertical marquee plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level
ficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cd90d9c0-0cab-4fd3-b016-106032f300f7?source=cve - https://plugins.trac.wordpress.org/browser/vertical-marquee-plugin/trunk/vertical-marquee-plugin.php?rev=2827080#L170 - https://plugins.trac.wordpress.org/changeset/2985561/vertical-marquee-plugin#file2
CVE ID: CVE-2023-5437 State: PUBLISHED Published: 2023-10-31T08:32:52.624Z Last Updated: 2025-02-05T18:53:13.427Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: gopiplus Products: WP fade in text news Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The WP fade in text news plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and abov
preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b4accf10-710e-4cba-8d61-04e422324f9d?source=cve - https://plugins.trac.wordpress.org/browser/wp-fade-in-text-news/trunk/wp-fade-in-text-news.php?rev=2827202#L236 - https://plugins.trac.wordpress.org/changeset/2985398/wp-fade-in-text-news#file2
CVE ID: CVE-2023-5438 State: PUBLISHED Published: 2023-10-31T08:32:52.175Z Last Updated: 2025-02-05T18:53:21.163Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: gopiplus Products: wp image slideshow Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The wp image slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above pe
aration on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7e24383b-5b0f-4114-908b-4c2778632f73?source=cve - https://plugins.trac.wordpress.org/browser/wp-image-slideshow/trunk/wp-image-slideshow.php?rev=2827205#L189 - https://plugins.trac.wordpress.org/changeset/2985394/wp-image-slideshow#file2
CVE ID: CVE-2023-5439 State: PUBLISHED Published: 2023-10-31T08:32:50.799Z Last Updated: 2025-02-05T18:53:41.426Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: gopiplus Products: Wp photo text slider 50 Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Wp photo text slider 50 plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and
ient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/515502b5-c344-4855-aff1-57833233c5d2?source=cve - https://plugins.trac.wordpress.org/browser/wp-photo-text-slider-50/trunk/wp-photo-text-slider-50.php?rev=2827206#L196 - https://plugins.trac.wordpress.org/changeset/2985502/wp-photo-text-slider-50#file1
CVE ID: CVE-2023-5441 State: PUBLISHED Published: 2023-10-05T20:30:09.121Z Last Updated: 2025-02-13T17:25:29.661Z Severity: MEDIUM (CVSS 6.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-476 Description: NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/b54cbdf5-3e85-458d-bb38-9ea2c0b669f2 - https://github.com/vim/vim/commit/20d161ace307e28690229b68584f2d84556f8960 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDDWD25AZIHBA
4556f8960 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDDWD25AZIHBAA44HQT75OWLQ5UMDKU3/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VGTVLUV7UCXXCZAIQIUCLG6JXAVYT3HE/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XPT7NMYJRLBPIALGSE24UWTY6F774GZW/
CVE ID: CVE-2023-5442 State: REJECTED Published: N/A Last Updated: 2024-01-04T19:08:27.574Z Description: No description available.
CVE ID: CVE-2023-5443 State: PUBLISHED Published: 2023-10-27T13:00:11.166Z Last Updated: 2024-09-09T15:06:03.871Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: EDM Informatics Products: E-invoice Problem Types: CWE-1320 Description: Improper Protection for Outbound Error Messages and Alert Signals vulnerability in EDM Informatics E-invoice allows Account Footprinting.This issue affects E-invoice: before 2.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0610
CVE ID: CVE-2023-5444 State: PUBLISHED Published: 2023-11-17T09:47:20.014Z Last Updated: 2024-12-02T20:53:00.504Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Trellix Products: ePolicy Orchestrator Problem Types: CWE-352 Description: A Cross Site Request Forgery vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2 allows a remote low privilege user to successfully add a new user with administrator privileges to the ePO server. This impacts the dashboard area of the user interface. To exploit this the attacker must change the HTTP payload post submission, prior to it reaching the ePO server. Additional Analyst Notes: - CVE Program Container: - CI
TP payload post submission, prior to it reaching the ePO server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kcm.trellix.com/agent/index?page=content&id=SB10410
CVE ID: CVE-2023-5445 State: PUBLISHED Published: 2023-11-17T10:01:36.927Z Last Updated: 2024-08-02T07:59:44.718Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Trellix Products: ePolicy Orchestrator Problem Types: CWE-601 Description: An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL parameter for the purpose of redirecting URL request(s) to a malicious site. This impacts the dashboard area of the user interface. A user would need to be logged into ePO to trigger this vulnerability. To exploit this the attacker must change the HTTP payload post submission, prior to it
O to trigger this vulnerability. To exploit this the attacker must change the HTTP payload post submission, prior to it reaching the ePO server. Additional Analyst Notes: - CVE Program Container: References: - https://kcm.trellix.com/corporate/index?page=content&id=SB10410
CVE ID: CVE-2023-5447 State: PUBLISHED Published: 2024-05-11T02:41:19.627Z Last Updated: 2024-08-02T07:59:44.752Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Synaptics Products: Synaptics Fingerprint Driver Problem Types: CWE-414, CWE-416 Description: Missing lock check in SynHsaService may create a use-after-free condition which causes abnormal termination of the service, resulting in denial of service for the Synaptics Hardware Support App. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.synaptics.com/sites/default/files/2023-10/fingerprint-driver-HSAService-security-brief-2023-10-13.pdf
CVE ID: CVE-2023-5448 State: PUBLISHED Published: 2024-01-11T03:31:26.169Z Last Updated: 2024-11-14T14:46:38.778Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: avimegladon Products: WP Register Profile With Shortcode Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.9. This is due to missing or incorrect nonce validation on the update_password_validate function. This makes it possible for unauthenticated attackers to reset a user's password via a forged request granted they can trick the user into p
ble for unauthenticated attackers to reset a user's password via a forged request granted they can trick the user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ca564941-4780-4da2-b937-c9bd45966d81?source=cve - https://plugins.trac.wordpress.org/changeset/3018102
CVE ID: CVE-2023-5449 State: PUBLISHED Published: 2023-10-13T16:23:12.704Z Last Updated: 2024-09-18T14:20:49.159Z Vendors: HP Inc. Products: HP Displays Description: A potential security vulnerability has been identified in certain HP Displays supporting the Theft Deterrence feature which may allow a monitor’s Theft Deterrence to be deactivated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_9438665-9438794-16
CVE ID: CVE-2023-5450 State: PUBLISHED Published: 2023-10-10T12:31:48.600Z Last Updated: 2024-09-13T16:41:55.571Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: F5 Products: BIG-IP Edge Client Problem Types: CWE-345 Description: An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of privileges during the installation process. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000135040
CVE ID: CVE-2023-5451 State: PUBLISHED Published: 2024-03-04T15:54:43.711Z Last Updated: 2024-08-02T07:59:44.679Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Forcepoint Products: Next Generation Firewall Security Management Center Problem Types: CWE-79 Description: Forcepoint NGFW Security Management Center Management Server has SMC Downloads optional feature to offer standalone Management Client downloads and ECA configuration downloads. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Next Generation Firewall Security Management Center (SMC Downloads feature) allows Reflected XSS. This iss
in Forcepoint Next Generation Firewall Security Management Center (SMC Downloads feature) allows Reflected XSS. This issue affects Next Generation Firewall Security Management Center : before 6.10.13, from 6.11.0 before 7.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.forcepoint.com/s/article/000042395
CVE ID: CVE-2023-5452 State: PUBLISHED Published: 2023-10-06T19:27:24.872Z Last Updated: 2024-09-19T14:38:29.938Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: snipe Products: snipe/snipe-it Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/d6ed5ac1-2ad6-45fd-9492-979820bf60c8 - https://github.com/snipe/snipe-it/commit/eea2eabaeef16fc8f3a1d61b19c06e9fc8ed942a
CVE ID: CVE-2023-5454 State: PUBLISHED Published: 2023-11-06T20:40:20.122Z Last Updated: 2025-02-26T21:16:22.092Z Vendors: Unknown Products: Templately Problem Types: CWE-284 Improper Access Control Description: The Templately WordPress plugin before 2.2.6 does not properly authorize the `saved-templates/delete` REST API call, allowing unauthenticated users to delete arbitrary posts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1854f77f-e12a-4370-9c44-73d16d493685
CVE ID: CVE-2023-5455 State: PUBLISHED Published: 2024-01-10T12:33:00.336Z Last Updated: 2025-11-20T18:06:12.304Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Supp
rvice, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 6 Problem Types: CWE-352 Description: A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testi
orm actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:0137 - https://access.redhat.com/errata/RHSA-2024:0138 - https://access.redhat.com/errata/RHSA-2024:0139 - https://access.redhat.com/errata/RHSA-2024:0140 - https:/
-2024:0138 - https://access.redhat.com/errata/RHSA-2024:0139 - https://access.redhat.com/errata/RHSA-2024:0140 - https://access.redhat.com/errata/RHSA-2024:0141 - https://access.redhat.com/errata/RHSA-2024:0142 - https://access.redhat.com/errata/RHSA-2024:0143 - https://access.redhat.com/errata/RHSA-2024:0144 - https://access.redhat.com/errata/RHSA-2024:0145 - https://access.redhat.com/errata/RHSA-2024:0252 - https://access.redhat.com/security/cve/CVE-2023-5455 - https://bugzilla.redhat.com/show_bug.cgi?id=2242828 - https://www.freeipa.org/release-notes/4-10-3.html - https://www.freeipa.org/release-notes/4-11-1.html - https://www.freeipa.org/release-notes/4-6-10.html - https://www.freeipa.or
//www.freeipa.org/release-notes/4-11-1.html - https://www.freeipa.org/release-notes/4-6-10.html - https://www.freeipa.org/release-notes/4-9-14.html
CVE ID: CVE-2023-5456 State: PUBLISHED Published: 2024-03-05T11:10:44.986Z Last Updated: 2024-08-02T07:59:44.637Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: AiLux Products: imx6 bundle Problem Types: CWE-798 Description: A CWE-798 “Use of Hard-coded Credentials” vulnerability in the MariaDB database of the web application allows a remote unauthenticated attacker to access the database service and all included data with the same privileges of the web application. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.nozominetworks.com/labs/vuln
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-5456
CVE ID: CVE-2023-5457 State: PUBLISHED Published: 2024-03-05T11:15:01.811Z Last Updated: 2024-08-23T20:20:12.620Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: AiLux Products: imx6 bundle Problem Types: CWE-1269 Description: A CWE-1269 “Product Released in Non-Release Configuration” vulnerability in the Django web framework used by the web application (due to the “debug” configuration parameter set to “True”) allows a remote unauthenticated attacker to access critical information and have other unspecified impacts to the confidentiality, integrity, and availability of the application. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2. Addition
tegrity, and availability of the application. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-5457
CVE ID: CVE-2023-5458 State: PUBLISHED Published: 2023-10-31T13:54:42.463Z Last Updated: 2024-08-02T07:59:44.751Z Vendors: Unknown Products: CITS Support svg, webp Media and TTF,OTF File Upload Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The CITS Support svg, webp Media and TTF,OTF File Upload WordPress plugin before 3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/47d15f1c-b9ca-494d-be8f-63c30e92f9b8
CVE ID: CVE-2023-5459 State: PUBLISHED Published: 2023-10-09T19:00:06.726Z Last Updated: 2024-09-19T18:16:29.338Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Delta Electronics Products: DVP32ES2 PLC Problem Types: CWE-404 Description: A vulnerability has been found in Delta Electronics DVP32ES2 PLC 1.48 and classified as critical. This vulnerability affects unknown code of the component Password Transmission Handler. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. VDB-241582 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not re
the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.241582 - https://vuldb.com/?ctiid.241582 - https://drive.google.com/drive/folders/1mUKkl_NPoUENpPUq-pdQQaEEGvKAaIFB
CVE ID: CVE-2023-5460 State: PUBLISHED Published: 2023-10-09T19:00:07.910Z Last Updated: 2024-08-02T07:59:44.643Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Delta Electronics Products: WPLSoft Problem Types: CWE-122 Description: A vulnerability was found in Delta Electronics WPLSoft up to 2.51 and classified as problematic. This issue affects some unknown processing of the component Modbus Data Packet Handler. The manipulation leads to heap-based buffer overflow. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-241583. NOTE: The vendor was contacted early about this disclosure but did not
identifier of this vulnerability is VDB-241583. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.241583 - https://vuldb.com/?ctiid.241583 - https://drive.google.com/drive/folders/1oYxs_KxK4Ftd7OsexGk6upkxhJ3-m8M3
CVE ID: CVE-2023-5461 State: PUBLISHED Published: 2023-10-09T20:00:06.688Z Last Updated: 2024-09-19T18:33:57.954Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Delta Electronics Products: WPLSoft Problem Types: CWE-319 Description: A vulnerability was found in Delta Electronics WPLSoft 2.51. It has been classified as problematic. Affected is an unknown function of the component Modbus Handler. The manipulation leads to cleartext transmission of sensitive information. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.