Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-1596 State: PUBLISHED Published: 2023-05-15T12:15:36.699Z Last Updated: 2025-01-24T20:50:15.320Z Vendors: Unknown Products: tagDiv Composer Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The tagDiv Composer WordPress plugin before 4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/cada9be9-522a-4ce8-847d-c8fff2ddcc07
CVE ID: CVE-2023-1597 State: PUBLISHED Published: 2023-07-10T12:40:40.136Z Last Updated: 2024-11-08T18:23:26.292Z Vendors: Unknown Products: tagDiv Cloud Library Problem Types: CWE-269 Improper Privilege Management, CWE-352 Cross-Site Request Forgery (CSRF) Description: The tagDiv Cloud Library WordPress plugin before 2.7 does not have authorisation and CSRF in an AJAX action accessible to both unauthenticated and authenticated users, allowing unauthenticated users to change arbitrary user metadata, which could lead to privilege escalation by setting themselves as an admin of the blog. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.co
of the blog. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4eafe111-8874-4560-83ff-394abe7a803b
CVE ID: CVE-2023-1598 State: REJECTED Published: N/A Last Updated: 2023-04-02T00:00:00 Description: No description available.
CVE ID: CVE-2023-1601 State: REJECTED Published: N/A Last Updated: 2023-05-24T00:00:00 Description: No description available.
CVE ID: CVE-2023-1602 State: PUBLISHED Published: 2023-06-29T01:56:56.799Z Last Updated: 2024-10-28T13:03:05.779Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: kaizencoders Products: Short URL Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Short URL plugin for WordPress is vulnerable to stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping in versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages th
for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a5f29f35-da79-4389-a0a5-a1be0b0b8996?source=cve - https://wordpress.org/plugins/shorten-url/#developers - https://plugins.trac.wordpress.org/changeset/2931815/shorten-url/trunk/shorten-url.php
CVE ID: CVE-2023-1603 State: PUBLISHED Published: 2023-03-23T17:13:31.049Z Last Updated: 2025-02-25T17:14:37.879Z Vendors: Devolutions Products: Server Problem Types: n/a Description: Permission bypass when importing or synchronizing entries in User vault in Devolutions Server 2022.3.13 and prior versions allows users with restricted rights to bypass entry permission via id collision. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2023-0008
CVE ID: CVE-2023-1604 State: PUBLISHED Published: 2024-08-17T07:34:24.648Z Last Updated: 2024-08-19T13:47:59.751Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: kaizencoders Products: Short URL Problem Types: CWE-352 Description: The Short URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.8. This is due to missing or incorrect nonce validation on the configuration_page function. This makes it possible for unauthenticated attackers to add and import redirects, including comments containing cross-site scripting as detailed in CVE-2023-1602, granted they can trick a site administrator into performing an
ining cross-site scripting as detailed in CVE-2023-1602, granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b926243c-ed12-4afe-ac72-932d4d871019?source=cve - https://plugins.trac.wordpress.org/browser/shorten-url/trunk/shorten-url.php#L322
CVE ID: CVE-2023-1605 State: PUBLISHED Published: 2023-03-23T00:00:00.000Z Last Updated: 2025-02-25T19:30:41.323Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: radareorg Products: radareorg/radare2 Problem Types: CWE-400 Description: Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/9dddcf5b-7dd4-46cc-abf9-172dce20bab2 - https://github.com/radareorg/radare2/commit/508a6307045441defd1bef0999a1f7052097613f
CVE ID: CVE-2023-1606 State: PUBLISHED Published: 2023-03-23T19:00:05.667Z Last Updated: 2024-08-02T05:57:24.389Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: novel-plus Problem Types: CWE-89 Description: A vulnerability was found in novel-plus 3.6.2 and classified as critical. Affected by this issue is some unknown functionality of the file DictController.java. The manipulation of the argument orderby leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223736. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.22
s vulnerability is VDB-223736. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.223736 - https://vuldb.com/?ctiid.223736 - https://github.com/OYyunshen/Poc/blob/main/Novel-PlusSqli1.pdf
CVE ID: CVE-2023-1607 State: PUBLISHED Published: 2023-03-23T19:31:03.194Z Last Updated: 2024-08-02T05:57:24.230Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: novel-plus Problem Types: CWE-89 Description: A vulnerability was found in novel-plus 3.6.2. It has been classified as critical. This affects an unknown part of the file /common/sysFile/list. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223737 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?i
as assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.223737 - https://vuldb.com/?ctiid.223737 - https://github.com/1610349395/novel-plus-v3.6.2----SQL-Injection-Vulnerability-/blob/main/novel-plus%20v3.6.2%20--%20%20SQL%20Injection%20Vulnerability%20.md
CVE ID: CVE-2023-1608 State: PUBLISHED Published: 2023-03-23T19:31:04.190Z Last Updated: 2024-08-02T05:57:24.179Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Zhong Bang Products: CRMEB Java Problem Types: CWE-89 Description: A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4. It has been declared as critical. This vulnerability affects the function getAdminList of the file /api/admin/store/product/list. The manipulation of the argument cateId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-223738 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program
ic and may be used. VDB-223738 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.223738 - https://vuldb.com/?ctiid.223738 - https://github.com/crmeb/crmeb_java/issues/11
CVE ID: CVE-2023-1609 State: PUBLISHED Published: 2023-03-23T20:00:05.271Z Last Updated: 2024-08-02T05:57:24.983Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Zhong Bang Products: CRMEB Java Problem Types: CWE-79 Description: A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4. It has been rated as problematic. This issue affects the function save of the file /api/admin/store/product/save. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223739. Additional Analyst Notes: - CVE Program Container: References: - https:
identifier of this vulnerability is VDB-223739. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.223739 - https://vuldb.com/?ctiid.223739 - https://github.com/crmeb/crmeb_java/issues/12
CVE ID: CVE-2023-1610 State: PUBLISHED Published: 2023-03-23T20:00:06.354Z Last Updated: 2024-08-02T05:57:24.361Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: Rebuild Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in Rebuild up to 3.2.3. Affected by this issue is some unknown functionality of the file /project/tasks/list. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-223742 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Progr
ch to fix this issue. VDB-223742 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.223742 - https://vuldb.com/?ctiid.223742 - https://github.com/getrebuild/rebuild/issues/597
CVE ID: CVE-2023-1611 State: PUBLISHED Published: 2023-04-03T00:00:00.000Z Last Updated: 2025-02-13T14:57:52.797Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allows an attacker to crash the system and possibly cause a kernel information lea Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2181342 - https://lore.kernel.org/linux-btrfs/35b9a70650ea947387cf352914a8774b4f7e8a6f.1679481128.git.fdmanana%40suse.com/ - https://lists.fedoraproject.org/archives/list/package-announce%40l
4a8774b4f7e8a6f.1679481128.git.fdmanana%40suse.com/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWECAZ7V7EPSXMINO6Q6KWNKDY2CO6ZW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QCM6XO4HSPLGR3DFYWFRIA3GCBIHZR4/ - https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html - https://github.com/torvalds/linux/commit/2f1a6be12ab6c8470d5776e68644726c94257c54
CVE ID: CVE-2023-1612 State: PUBLISHED Published: 2023-03-23T20:31:03.701Z Last Updated: 2025-02-07T15:35:40.944Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: Rebuild Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in Rebuild up to 3.2.3. This affects an unknown part of the file /files/list-file. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-223743. Additional Analyst Notes: - CVE Program Container: - CIS
The associated identifier of this vulnerability is VDB-223743. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.223743 - https://vuldb.com/?ctiid.223743 - https://github.com/getrebuild/rebuild/issues/598
CVE ID: CVE-2023-1613 State: PUBLISHED Published: 2023-03-23T21:00:07.114Z Last Updated: 2024-08-02T05:57:24.784Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: Rebuild Problem Types: CWE-79 Description: A vulnerability has been found in Rebuild up to 3.2.3 and classified as problematic. This vulnerability affects unknown code of the file /feeds/post/publish. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-223744. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE P
is issue. The identifier of this vulnerability is VDB-223744. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.223744 - https://vuldb.com/?ctiid.223744 - https://github.com/getrebuild/rebuild/issues/596
CVE ID: CVE-2023-1614 State: PUBLISHED Published: 2023-05-02T07:04:57.754Z Last Updated: 2025-01-30T14:33:56.278Z Vendors: Unknown Products: WP Custom Author URL Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Custom Author URL WordPress plugin before 1.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/56abd1e2-0ea9-47f7-9a1b-2093ac15d39c
CVE ID: CVE-2023-1615 State: PUBLISHED Published: 2023-06-09T05:33:22.261Z Last Updated: 2024-12-23T16:19:24.930Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: psdtowpservice Products: Ultimate Addons for Contact Form 7 Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in versions up to, and including, 3.1.23. This makes it possible for authenticated attackers of any authorization level to append additional SQL queries into already existing queries that can be used to extract s
of any authorization level to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/817ca119-ddaf-4525-beee-68c4e0aac544?source=cve - https://wordpress.org/plugins/ultimate-addons-for-contact-form-7/#developers - https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/trunk/addons/database/database.php?rev=2897709#L255 - https://plugins.trac.wordpress.org/changeset/2901676/
CVE ID: CVE-2023-1616 State: PUBLISHED Published: 2023-03-24T07:31:04.075Z Last Updated: 2024-08-02T05:57:24.321Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: XiaoBingBy Products: TeaCMS Problem Types: CWE-79 Description: A vulnerability was found in XiaoBingBy TeaCMS up to 2.0.2. It has been classified as problematic. Affected is an unknown function of the component Article Title Handler. The manipulation with the input <script>alert(document.cookie)</script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223800. Additional Analyst Notes: - CV
closed to the public and may be used. The identifier of this vulnerability is VDB-223800. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.223800 - https://vuldb.com/?ctiid.223800 - https://gitee.com/xiaobingby/TeaCMS/issues/I6L9Z2
CVE ID: CVE-2023-1617 State: PUBLISHED Published: 2023-04-14T11:48:53.396Z Last Updated: 2025-02-06T19:48:05.890Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: B&R Industrial Automation Products: B&R VC4 Problem Types: CWE-287 Description: Improper Authentication vulnerability in B&R Industrial Automation B&R VC4 (VNC-Server modules). This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization. This issue affects B&R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.
unctionality provided in the visualization. This issue affects B&R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/downloads_br_productcatalogue/assets/1681046878970-en-original-1.0.pdf
CVE ID: CVE-2023-1618 State: PUBLISHED Published: 2023-05-19T04:19:42.944Z Last Updated: 2025-02-12T16:25:17.909Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Mitsubishi Electric Corporation Products: MELSEC WS Series WS0-GETH00200 Problem Types: CWE-489 Description: Active Debug Code vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 Serial number 2310 **** and prior allows a remote unauthenticated attacker to bypass authentication and illegally log into the affected module by connecting to it via telnet which is hidden function and is enabled by default when shipped from the factory. As a result, a remote attacker with unautho
is hidden function and is enabled by default when shipped from the factory. As a result, a remote attacker with unauthorized login can reset the module, and if certain conditions are met, he/she can disclose or tamper with the module's configuration or rewrite the firmware. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-002_en.pdf - https://jvn.jp/vu/JVNVU96063959 - https://www.cisa.gov/news-events/ics-advisories/icsa-23-138-02
CVE ID: CVE-2023-1619 State: PUBLISHED Published: 2023-06-26T06:18:33.981Z Last Updated: 2024-10-02T05:28:23.250Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Wago Products: 750-8202/xxx-xxx, 750-8203/xxx-xxx, 750-8204/xxx-xxx, 750-8206/xxx-xxx, 750-8207/xxx-xxx, 750-8208/xxx-xxx, 750-8210/xxx-xxx, 750-8211/xxx-xxx, 750-8212/xxx-xxx, 750-8213/xxx-xxx, 750-8214/xxx-xxx, 750-8216/xxx-xxx, 750-8217/xxx-xxx, 750-823, 750-332, 750-832/xxx-xxx, 750-862, 750-890/xxx-xxx, 750-891, 750-893, 750-331, 750-829, 750-831/xxx-xxx, 750-852, 750-880/xxx-xxx, 750-881, 750-882, 750-885/xxx-xxx, 750-889 Problem Types: CWE-1288 Description: Multiple WAGO devices in multiple v
xxx, 750-881, 750-882, 750-885/xxx-xxx, 750-889 Problem Types: CWE-1288 Description: Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a malformed packet. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2023-006/
CVE ID: CVE-2023-1620 State: PUBLISHED Published: 2023-06-26T06:19:30.928Z Last Updated: 2024-11-12T14:11:36.673Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Wago Products: 750-8202/xxx-xxx, 750-8203/xxx-xxx, 750-8204/xxx-xxx, 750-8206/xxx-xxx, 750-8207/xxx-xxx, 750-8208/xxx-xxx, 750-8210/xxx-xxx, 750-8211/xxx-xxx, 750-8212/xxx-xxx, 750-8213/xxx-xxx, 750-8214/xxx-xxx, 750-8216/xxx-xxx, 750-8217/xxx-xxx, 750-823, 750-332, 750-832/xxx-xxx, 750-862, 750-890/xxx-xxx, 750-891, 750-893, 750-331, 750-829, 750-831/xxx-xxx, 750-852, 750-880/xxx-xxx, 750-881, 750-882, 750-885/xxx-xxx, 750-889 Problem Types: CWE-1288 Description: Multiple WAGO devices in multiple v
xxx, 750-881, 750-882, 750-885/xxx-xxx, 750-889 Problem Types: CWE-1288 Description: Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2023-006/
CVE ID: CVE-2023-1621 State: PUBLISHED Published: 2023-06-06T00:00:00 Last Updated: 2025-01-07T21:38:25.067Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Missing authorization in GitLab Description: An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to commit to projects even from a restricted IP address. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/399774 - https://hackerone.com/reports/191404
Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/399774 - https://hackerone.com/reports/1914049 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1621.json
CVE ID: CVE-2023-1622 State: REJECTED Published: N/A Last Updated: 2023-03-28T00:00:00 Description: No description available.
CVE ID: CVE-2023-1623 State: PUBLISHED Published: 2023-04-24T18:31:01.462Z Last Updated: 2025-02-04T16:11:33.292Z Vendors: Unknown Products: Custom Post Type UI Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Custom Post Type UI WordPress plugin before 1.13.5 does not properly check for CSRF when sending the debug information to a user supplied email, which could allow attackers to make a logged in admin send such information to an arbitrary email address via a CSRF attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a04d3808-f4fc-4d77-a1bd-be623cd7053e
CVE ID: CVE-2023-1624 State: PUBLISHED Published: 2023-04-24T18:30:56.651Z Last Updated: 2025-02-04T17:20:37.952Z Vendors: Unknown Products: WPCode Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the expected folder. This could allow attackers to make users with the wpcode_activate_snippets capability delete arbitrary log files on the server, including outside of the blog folders Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/132b70e5-4368-43b4-81f6-2d01bc09dc8f
CVE ID: CVE-2023-1625 State: PUBLISHED Published: 2023-09-24T00:08:12.738Z Last Updated: 2024-09-24T14:59:25.505Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: n/a, Red Hat, RDO Products: openstack-heat, Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.1, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.0, OpenStack RDO Problem Types: CWE-202 Description: An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability
arameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-1625 - https://bugzilla.redhat.com/show_bug.cgi?id=2181621 - https://github.com/openstack/heat/commit/a49526c278e52823080c7f3fcb72785b93fd4dcb - https://launchpad.net/bugs/1999665