Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-43381 State: PUBLISHED Published: 2023-09-26T00:00:00 Last Updated: 2024-09-24T15:00:12.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Tianchoy Blog v.1.8.8 allows a remote attacker to obtain sensitive information via the id parameter in the login.php Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Chiaki2333/vulnerability/blob/main/tianchoy-blog-sql-login.php.md - https://gist.github.com/Chiaki2333/59ef607c3eb3a7b4db1537705d05e4d1
CVE ID: CVE-2023-43382 State: PUBLISHED Published: 2023-09-25T00:00:00 Last Updated: 2024-09-24T15:37:53.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in itechyou dreamer CMS v.4.1.3 allows a remote attacker to execute arbitrary code via the themePath in the uploaded template function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/iteachyou/dreamer_cms/issues/I821AI - https://aecous.github.io/2023/09/17/Text/?password=Aecous - https://gist.github.com/Aecous/7c6524859d624c00f4a975ecd5a743a7
CVE ID: CVE-2023-43449 State: PUBLISHED Published: 2024-01-16T00:00:00.000Z Last Updated: 2025-06-03T13:59:23.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in HummerRisk HummerRisk v.1.10 thru 1.4.1 allows an authenticated attacker to execute arbitrary code via a crafted request to the service/LicenseService component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/HummerRisk/HummerRisk/issues/446
CVE ID: CVE-2023-43453 State: PUBLISHED Published: 2023-12-01T00:00:00 Last Updated: 2024-08-02T19:37:23.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the IP parameter of the setDiagnosisCfg component. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tharsis1024/vuln/blob/main/TOTOLINK/X6000R/2.md
CVE ID: CVE-2023-43454 State: PUBLISHED Published: 2023-12-01T00:00:00 Last Updated: 2024-11-26T19:14:19.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the hostName parameter of the switchOpMode component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tharsis1024/vuln/blob/main/TOTOLINK/X6000R/1.md
CVE ID: CVE-2023-43455 State: PUBLISHED Published: 2023-12-01T00:00:00 Last Updated: 2024-08-02T19:44:42.018Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the command parameter of the setting/setTracerouteCfg component. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tharsis1024/vuln/blob/main/TOTOLINK/X6000R/3.md
CVE ID: CVE-2023-43456 State: PUBLISHED Published: 2023-09-25T00:00:00 Last Updated: 2024-09-24T15:30:32.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Service Provider Management System v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the firstname, middlename and lastname parameters in the /php-spms/admin/?page=user endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/users/tips23 - https://www.sourcecodester.com/php/16501/service-provider-management-system-using-php-and-mysql-source-code-free-download.html - https
urcecodester.com/php/16501/service-provider-management-system-using-php-and-mysql-source-code-free-download.html - https://samh4cks.github.io/posts/cve-2023-43456/
CVE ID: CVE-2023-43457 State: PUBLISHED Published: 2023-09-25T00:00:00 Last Updated: 2024-09-24T15:28:17.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Service Provider Management System v.1.0 allows a remote attacker to gain privileges via the ID parameter in the /php-spms/admin/?page=user/ endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/users/tips23 - https://www.sourcecodester.com/php/16501/service-provider-management-system-using-php-and-mysql-source-code-free-download.html - https://samh4cks.github.io/posts/cve-2023-43457/
CVE ID: CVE-2023-43458 State: PUBLISHED Published: 2023-09-25T00:00:00 Last Updated: 2024-09-24T18:35:39.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Resort Reservation System v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the room, name, and description parameters in the manage_room function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/16447/resort-reservation-system-php-and-sqlite3-source-code-free-download.html - https://samh4cks.github.io/posts/cve-2023-43458/
CVE ID: CVE-2023-43468 State: PUBLISHED Published: 2023-09-22T00:00:00 Last Updated: 2024-09-24T15:49:17.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via the login.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ae6e361b/Online-Job-Portal - https://gist.github.com/ae6e361b/30d56c116d9f727b91c418d044f42fd3 - https://www.sourcecodester.com/php/14518/online-job-portal-php-full-source-code-2020.html
CVE ID: CVE-2023-43469 State: PUBLISHED Published: 2023-09-22T00:00:00 Last Updated: 2024-09-24T15:47:11.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via the ForPass.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ae6e361b/Online-Job-Portal-Forget - https://www.sourcecodester.com/php/14518/online-job-portal-php-full-source-code-2020.html - https://gist.github.com/ae6e361b/28ffc44d39e406ce1bc627c0c5c3a7de
CVE ID: CVE-2023-43470 State: PUBLISHED Published: 2023-09-22T00:00:00 Last Updated: 2024-09-24T15:44:10.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to execute arbitrary code via the checklogin.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ae6e361b/Online-Voting-System - https://gist.github.com/ae6e361b/1ed56fbfbbfd368835b8a8089f8ee64a - https://www.sourcecodester.com/php/14690/online-voting-system-phpmysqli-full-source-code.html
CVE ID: CVE-2023-43472 State: PUBLISHED Published: 2023-12-05T00:00:00 Last Updated: 2024-08-02T19:44:42.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API. Additional Analyst Notes: - CVE Program Container: References: - https://www.contrastsecurity.com/security-influencers/discovering-mlflow-framework-zero-day-vulnerability-machine-language-model-security-contrast-security
CVE ID: CVE-2023-43477 State: PUBLISHED Published: 2023-09-20T12:41:03.578Z Last Updated: 2024-09-24T19:00:27.334Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Telstra Products: Smart Modem Gen 2 (Arcadyan LH1000) Problem Types: CWE-77 Description: The ping_from parameter of ping_tracerte.cgi in the web UI of Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, was not properly sanitized before being used in a system call, which could allow an authenticated attacker to achieve command injection as root on the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/secu
. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-19
CVE ID: CVE-2023-43478 State: PUBLISHED Published: 2023-09-20T13:03:10.299Z Last Updated: 2024-09-24T18:58:06.387Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Telstra Products: Smart Modem Gen 2 (Arcadyan LH1000) Description: fake_upload.cgi on the Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, allows unauthenticated attackers to upload firmware images and configuration backups, which could allow them to alter the firmware or the configuration on the device, ultimately leading to code execution as root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/rese
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-19
CVE ID: CVE-2023-43481 State: PUBLISHED Published: 2023-12-27T00:00:00 Last Updated: 2024-08-27T18:39:42.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Shenzhen TCL Browser TV Web BrowseHere (aka com.tcl.browser) 6.65.022_dab24cc6_231221_gp allows a remote attacker to execute arbitrary JavaScript code via the com.tcl.browser.portal.browse.activity.BrowsePageActivity component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/actuator/com.tcl.browser/blob/main/CWE-94.md
CVE ID: CVE-2023-43482 State: PUBLISHED Published: 2024-02-06T16:20:15.812Z Last Updated: 2025-11-04T18:17:24.956Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Tp-Link Products: ER7206 Omada Gigabit VPN Router Problem Types: CWE-78 Description: A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintellige
bility. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1850
CVE ID: CVE-2023-43484 State: PUBLISHED Published: 2023-09-26T08:17:31.412Z Last Updated: 2024-09-24T14:49:50.709Z Vendors: Collne Inc. Products: Welcart e-Commerce Problem Types: Cross-site scripting (XSS) Description: Cross-site scripting vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.welcart.com/archives/20106.html - https://jvn.jp/en/jp/JVN97197972/
CVE ID: CVE-2023-43485 State: PUBLISHED Published: 2023-10-10T12:34:15.669Z Last Updated: 2024-09-18T20:34:33.426Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: F5 Products: BIG-IP, BIG-IQ Problem Types: CWE-532 Description: When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K06110200
CVE ID: CVE-2023-43487 State: PUBLISHED Published: 2024-05-16T20:47:29.912Z Last Updated: 2024-08-02T19:44:42.249Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) CST Problem Types: denial of service, CWE-284 Description: Improper access control in some Intel(R) CST before version 2.1.10300 may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01021.html
CVE ID: CVE-2023-43488 State: PUBLISHED Published: 2023-10-25T13:27:09.366Z Last Updated: 2024-09-17T14:06:24.603Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L) Vendors: Rexroth Products: ctrlX HMI Web Panel - WR21 (WR2107), ctrlX HMI Web Panel - WR21 (WR2110), ctrlX HMI Web Panel - WR21 (WR2115) Problem Types: CWE-862 Description: The vulnerability allows a low privileged (untrusted) application to modify a critical system property that should be denied, in order to enable the ADB (Android Debug Bridge) protocol to be exposed on the network, exploiting it to gain a privileged shell on the device without requiring the physical access through USB. Additional Analyst N
ting it to gain a privileged shell on the device without requiring the physical access through USB. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html
CVE ID: CVE-2023-43489 State: PUBLISHED Published: 2024-08-14T13:45:24.379Z Last Updated: 2024-08-14T16:05:02.244Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) CIP software Problem Types: denial of service, CWE-284 Description: Improper access control for some Intel(R) CIP software before version 2.4.10717 may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01112.html
CVE ID: CVE-2023-43490 State: PUBLISHED Published: 2024-03-14T16:45:44.079Z Last Updated: 2025-02-13T17:13:15.943Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: n/a Products: Intel(R) Xeon(R) D Processors with Intel(R) SGX Problem Types: information disclosure, CWE-682 Description: Incorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R) SGX may allow a privileged user to potentially enable information disclosure via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01045.html - http
ram Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01045.html - https://security.netapp.com/advisory/ntap-20240405-0009/ - https://lists.debian.org/debian-lts-announce/2024/05/msg00003.html
CVE ID: CVE-2023-43491 State: PUBLISHED Published: 2024-04-17T12:55:49.894Z Last Updated: 2025-11-04T18:17:26.146Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Peplink Products: Smart Reader Problem Types: CWE-284 Description: An information disclosure vulnerability exists in the web interface /cgi-bin/debug_dump.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/
Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1863 - https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256
CVE ID: CVE-2023-43492 State: PUBLISHED Published: 2023-10-19T19:28:59.236Z Last Updated: 2025-01-16T21:28:29.900Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Weintek Products: cMT-FHD, cMT-HDM, cMT3071, cMT3072, cMT3103, cMT3090, cMT3151 Problem Types: CWE-121 Description: In Weintek's cMT3000 HMI Web CGI device, the cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-12 - https://dl.weintek.com/public
lnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-12 - https://dl.weintek.com/public/Document/TEC/TEC23005E_cMT_Web_Security_Update.pdf
CVE ID: CVE-2023-43493 State: PUBLISHED Published: 2023-09-26T08:18:24.886Z Last Updated: 2024-09-24T14:49:43.414Z Vendors: Collne Inc. Products: Welcart e-Commerce Problem Types: SQL Injection Description: SQL injection vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.welcart.com/archives/20106.html - https://jvn.jp/en/jp/JVN97197972/
CVE ID: CVE-2023-43494 State: PUBLISHED Published: 2023-09-20T16:06:08.742Z Last Updated: 2024-09-24T18:52:34.098Z Vendors: Jenkins Project Products: Jenkins Description: Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3261 - http://www.openwall.com/lists/oss-security/2023/09/20/5
CVE ID: CVE-2023-43495 State: PUBLISHED Published: 2023-09-20T16:06:09.394Z Last Updated: 2024-09-24T18:51:56.560Z Vendors: Jenkins Project Products: Jenkins Description: Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control this parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3245 - http://www.openwall.com/lists/oss-security/2023/09/20/5
CVE ID: CVE-2023-43496 State: PUBLISHED Published: 2023-09-20T16:06:10.098Z Last Updated: 2025-05-02T15:32:45.011Z Vendors: Jenkins Project Products: Jenkins Description: Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created files when installing a plugin from a URL, potentially allowing attackers with access to the system temporary directory to replace the file before it is installed in Jenkins, potentially resulting in arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-20/#SEC
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3072 - http://www.openwall.com/lists/oss-security/2023/09/20/5
CVE ID: CVE-2023-43497 State: PUBLISHED Published: 2023-09-20T16:06:10.771Z Last Updated: 2024-09-24T17:04:55.380Z Vendors: Jenkins Project Products: Jenkins Description: In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073 - http://w
er: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073 - http://www.openwall.com/lists/oss-security/2023/09/20/5
CVE ID: CVE-2023-43498 State: PUBLISHED Published: 2023-09-20T16:06:40.956Z Last Updated: 2024-09-24T18:52:38.402Z Vendors: Jenkins Project Products: Jenkins Description: In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073 - http://www
: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073 - http://www.openwall.com/lists/oss-security/2023/09/20/5
CVE ID: CVE-2023-43499 State: PUBLISHED Published: 2023-09-20T16:06:11.550Z Last Updated: 2024-09-24T18:51:28.365Z Vendors: Jenkins Project Products: Jenkins Build Failure Analyzer Plugin Description: Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or update Failure Causes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3244 - http://www.openwall.com/lists/oss-security/2023/09/20/5
CVE ID: CVE-2023-43500 State: PUBLISHED Published: 2023-09-20T16:06:12.234Z Last Updated: 2024-09-24T18:32:02.003Z Vendors: Jenkins Project Products: Jenkins Build Failure Analyzer Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3226 - http://www.openwall.com/lists/oss-security/2023/09/20/5
CVE ID: CVE-2023-43501 State: PUBLISHED Published: 2023-09-20T16:06:12.873Z Last Updated: 2024-09-24T18:27:16.610Z Vendors: Jenkins Project Products: Jenkins Build Failure Analyzer Plugin Description: A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3226 - http://www.openwall.com/lists/oss-security/2023/09/20/5
CVE ID: CVE-2023-43502 State: PUBLISHED Published: 2023-09-20T16:06:13.513Z Last Updated: 2024-09-24T18:25:43.344Z Vendors: Jenkins Project Products: Jenkins Build Failure Analyzer Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to delete Failure Causes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3239 - http://www.openwall.com/lists/oss-security/2023/09/20/5