Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, VPN series firmware versions 4.30 through 5.37, NWA50AX firmware version 6.29(ABYW.2), WAC500 firmware version 6.65(ABVS.1), WAX300H firmware version 6.60(ACHF.1), and WBE660S firmware version 6.65(ACGG.1), could allow an authenticated local attacker to access system files on an affected device. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps
CVE ID: CVE-2023-37926 State: PUBLISHED Published: 2023-11-28T01:37:19.483Z Last Updated: 2024-08-02T17:23:27.797Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) series firmware, USG20(W)-VPN series firmware, VPN series firmware Problem Types: CWE-120 Description: A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30 through 5.37, could al
7, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30 through 5.37, could allow an authenticated local attacker to cause denial-of-service (DoS) conditions by executing the CLI command to dump system logs on an affected device. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps
CVE ID: CVE-2023-37927 State: PUBLISHED Published: 2023-11-30T01:34:28.528Z Last Updated: 2025-02-13T17:01:40.072Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: NAS326 firmware, NAS542 firmware Problem Types: CWE-78 Description: The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/security-advisor
dditional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products - https://bugprove.com/knowledge-hub/cve-2023-37927-and-cve-2023-37928-multiple-post-auth-blind-os-command-and-python-code-injection-vulnerabilities-in-zyxel-s-nas-326-devices/
CVE ID: CVE-2023-37928 State: PUBLISHED Published: 2023-11-30T01:37:27.671Z Last Updated: 2025-02-13T17:01:40.648Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: NAS326 firmware, NAS542 firmware Problem Types: CWE-78 Description: A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/security-a
ice. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products - https://bugprove.com/knowledge-hub/cve-2023-37927-and-cve-2023-37928-multiple-post-auth-blind-os-command-and-python-code-injection-vulnerabilities-in-zyxel-s-nas-326-devices/
CVE ID: CVE-2023-37929 State: PUBLISHED Published: 2024-05-21T01:23:53.073Z Last Updated: 2024-08-02T17:23:27.734Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: V5.50(ABPM.8)C0 firmware Problem Types: CWE-120 Description: The buffer overflow vulnerability in the CGI program of the VMG3625-T50B firmware version V5.50(ABPM.8)C0 could allow an authenticated remote attacker to cause denial of service (DoS) conditions by sending a crafted HTTP request to a vulnerable device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory
CVE Program Container: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-vulnerabilities-in-some-5g-nr-4g-lte-cpe-dsl-ethernet-cpe-fiber-ont-wifi-extender-and-home-router-devices-05-21-2024
CVE ID: CVE-2023-37930 State: PUBLISHED Published: 2025-04-08T14:03:38.016Z Last Updated: 2025-04-09T04:00:40.351Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-908 Description: Multiple issues including the use of uninitialized ressources [CWE-908] and excessive iteration [CWE-834] vulnerabilities in Fortinet FortiOS SSL VPN webmode version 7.4.0, version 7.2.0 through 7.2.5, version 7.0.1 through 7.0.11 and version 6.4.7 through 6.4.14 and Fortinet FortiProxy SSL VPN webmode version 7.2.0 through 7.2.6 and version 7.0.0 through 7.0.12 allows a VPN user to corrupt memory potentially l
N webmode version 7.2.0 through 7.2.6 and version 7.0.0 through 7.0.12 allows a VPN user to corrupt memory potentially leading to code or commands execution via specifically crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-165
CVE ID: CVE-2023-37931 State: PUBLISHED Published: 2025-01-14T14:10:00.867Z Last Updated: 2025-02-18T21:35:20.264Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiVoice Problem Types: CWE-89 Description: An improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-88] in FortiVoice Entreprise version 7.0.0 through 7.0.1 and before 6.4.8 allows an authenticated attacker to perform a blind sql injection attack via sending crafted HTTP or HTTPS requests Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-220
CVE ID: CVE-2023-37932 State: PUBLISHED Published: 2024-01-10T17:48:00.502Z Last Updated: 2025-04-17T15:45:35.341Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiVoice Problem Types: CWE-22 Description: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in FortiVoiceEntreprise version 7.0.0 and before 6.4.7 allows an authenticated attacker to read arbitrary files from the system via sending crafted HTTP or HTTPS requests Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-219
CVE ID: CVE-2023-37933 State: PUBLISHED Published: 2025-03-11T14:54:35.895Z Last Updated: 2025-03-12T04:00:48.179Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiADC Problem Types: CWE-79 Description: An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiADC GUI version 7.4.0, 7.2.0 through 7.2.1 and before 7.1.3 allows an authenticated attacker to perform an XSS attack via crafted HTTP or HTTPs requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-216
CVE ID: CVE-2023-37934 State: PUBLISHED Published: 2024-01-10T17:51:36.939Z Last Updated: 2025-06-17T20:59:11.662Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiPAM Problem Types: CWE-770 Description: An allocation of resources without limits or throttling vulnerability [CWE-770] in FortiPAM 1.0 all versions allows an authenticated attacker to perform a denial of service attack via sending crafted HTTP or HTTPS requests in a high frequency. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-226
CVE ID: CVE-2023-37935 State: PUBLISHED Published: 2023-10-10T16:51:21.801Z Last Updated: 2024-09-19T20:22:22.682Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:X/RC:X) Vendors: Fortinet Products: FortiOS Problem Types: CWE-598 Description: A use of GET request method with sensitive query strings vulnerability in Fortinet FortiOS 7.0.0 - 7.0.12, 7.2.0 - 7.2.5 and 7.4.0 allows an attacker to view plaintext passwords of remote services such as RDP or VNC, if the attacker is able to read the GET requests to those services. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-120
CVE ID: CVE-2023-37936 State: PUBLISHED Published: 2025-01-14T14:09:30.417Z Last Updated: 2025-01-14T20:55:06.579Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiSwitch Problem Types: CWE-321 Description: A use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through 6.4.13 and 6.2.0 through 6.2.7 and 6.0.0 through 6.0.7 allows attacker to execute unauthorized code or commands via crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-260
CVE ID: CVE-2023-37937 State: PUBLISHED Published: 2025-01-14T14:09:30.314Z Last Updated: 2025-01-14T20:55:14.029Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiSwitch Problem Types: CWE-78 Description: An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through 6.4.13 and 6.2.0 through 6.2.7 and 6.0.0 through 6.0.7 allows attacker to execute unauthorized code or commands via the FortiSwitch CLI. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/ps
ands via the FortiSwitch CLI. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-258
CVE ID: CVE-2023-37939 State: PUBLISHED Published: 2023-10-10T16:50:04.463Z Last Updated: 2024-09-18T20:26:45.399Z Severity: LOW (CVSS 3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:R) Vendors: Fortinet Products: FortiClientMac, FortiClientWindows, FortiClientLinux Problem Types: CWE-200 Description: An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Windows 7.2.0, 7.0 all versions, 6.4 all versions, 6.2 all versions, Linux 7.2.0, 7.0 all versions, 6.4 all versions, 6.2 all versions and Mac 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions, 6.2 all versions, may allow a local authenticated attacker with no Administrative
1, 7.0 all versions, 6.4 all versions, 6.2 all versions, may allow a local authenticated attacker with no Administrative privileges to retrieve the list of files or folders excluded from malware scanning. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-235
CVE ID: CVE-2023-37940 State: PUBLISHED Published: 2024-12-17T21:30:39.730Z Last Updated: 2024-12-17T21:41:38.543Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's `Service Class` text field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
o a service access policy's `Service Class` text field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2023-37940
CVE ID: CVE-2023-37941 State: PUBLISHED Published: 2023-09-06T13:06:20.879Z Last Updated: 2025-02-13T17:01:41.199Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-502 Description: If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by the system administrator and the superset process itself. Gaining access to that database should be difficult and requ
y the system administrator and the superset process itself. Gaining access to that database should be difficult and require significant privileges. This vulnerability impacts Apache Superset versions 1.5.0 up to and including 2.1.0. Users are recommended to upgrade to version 2.1.1 or later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/6qk1zscc06yogxxfgz2bh2bvz6vh9g7h - http://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html
CVE ID: CVE-2023-37942 State: PUBLISHED Published: 2023-07-12T15:52:46.177Z Last Updated: 2024-11-07T15:03:28.595Z Vendors: Jenkins Project Products: Jenkins External Monitor Job Type Plugin Description: Jenkins External Monitor Job Type Plugin 206.v9a_94ff0b_4a_10 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3133 - http://www.openwall.com/lists/oss-security/2023/07/12/2
CVE ID: CVE-2023-37943 State: PUBLISHED Published: 2023-07-12T15:52:46.885Z Last Updated: 2024-11-07T15:02:58.066Z Vendors: Jenkins Project Products: Jenkins Active Directory Plugin Description: Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted, allowing attackers able to capture network traffic between the Jenkins controller and Active Directory servers to obtain Active Directory credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3059 - http://www.openwall.com/
ulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3059 - http://www.openwall.com/lists/oss-security/2023/07/12/2
CVE ID: CVE-2023-37944 State: PUBLISHED Published: 2023-07-12T15:52:47.615Z Last Updated: 2024-11-07T15:02:21.938Z Vendors: Jenkins Project Products: Jenkins Datadog Plugin Description: A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3130 - http://www.openwall.com/lists/oss-security/2023/07/12/2
CVE ID: CVE-2023-37945 State: PUBLISHED Published: 2023-07-12T15:52:48.355Z Last Updated: 2024-11-07T14:59:28.899Z Vendors: Jenkins Project Products: Jenkins SAML Single Sign On(SSO) Plugin Description: A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 through 2.3.0 (both inclusive) allows attackers with Overall/Read permission to download a string representation of the current security realm. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3164 - http://www.openwall.com/lists/oss-security/2023/07/12/2
CVE ID: CVE-2023-37946 State: PUBLISHED Published: 2023-07-12T15:52:49.082Z Last Updated: 2024-11-07T14:58:35.022Z Vendors: Jenkins Project Products: Jenkins OpenShift Login Plugin Description: Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2998 - http://www.openwall.com/lists/oss-security/2023/07/12/2
CVE ID: CVE-2023-37947 State: PUBLISHED Published: 2023-07-12T15:52:49.789Z Last Updated: 2024-11-07T14:56:33.403Z Vendors: Jenkins Project Products: Jenkins OpenShift Login Plugin Description: Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2999 - http://www.openwall.com/lists/oss-security/2023/07/12/2
CVE ID: CVE-2023-37948 State: PUBLISHED Published: 2023-07-12T15:52:50.520Z Last Updated: 2024-11-06T19:48:37.433Z Vendors: Jenkins Project Products: Jenkins Oracle Cloud Infrastructure Compute Plugin Description: Jenkins Oracle Cloud Infrastructure Compute Plugin 1.0.16 and earlier does not validate SSH host keys when connecting OCI clouds, enabling man-in-the-middle attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3044 - http://www.openwall.com/lists/oss-security/2023/07/12/2
CVE ID: CVE-2023-37949 State: PUBLISHED Published: 2023-07-12T15:52:51.254Z Last Updated: 2024-11-06T19:46:49.605Z Vendors: Jenkins Project Products: Jenkins Orka by MacStadium Plugin Description: A missing permission check in Jenkins Orka by MacStadium Plugin 1.33 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3128 - http://www.openwall.com/lists/oss-security/2023/07/12/2
CVE ID: CVE-2023-37950 State: PUBLISHED Published: 2023-07-12T15:52:51.990Z Last Updated: 2024-11-06T19:44:35.437Z Vendors: Jenkins Project Products: Jenkins mabl Plugin Description: A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3137%20(1) - http://www.openwall.com/lists/oss-security/2023/07/12/2
CVE ID: CVE-2023-37951 State: PUBLISHED Published: 2023-07-12T15:52:52.705Z Last Updated: 2024-11-07T15:00:51.711Z Vendors: Jenkins Project Products: Jenkins mabl Plugin Description: Jenkins mabl Plugin 0.0.46 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3137%20(2) - http://www.openwall.com/lists/oss-security/2023/07/12/2
CVE ID: CVE-2023-37952 State: PUBLISHED Published: 2023-07-12T15:52:53.441Z Last Updated: 2024-11-07T15:00:08.180Z Vendors: Jenkins Project Products: Jenkins mabl Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins mabl Plugin 0.0.46 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3127 - http://www.openwall.com/lists/oss-security/2023/07/12/2
CVE ID: CVE-2023-37953 State: PUBLISHED Published: 2023-07-12T15:52:54.198Z Last Updated: 2024-11-07T14:59:22.720Z Vendors: Jenkins Project Products: Jenkins mabl Plugin Description: A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3127 - http://www.openwall.com/lists/oss-security/2023/07/12/2
CVE ID: CVE-2023-37954 State: PUBLISHED Published: 2023-07-12T15:52:54.913Z Last Updated: 2024-11-06T19:44:08.902Z Vendors: Jenkins Project Products: Jenkins Rebuilder Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Rebuilder Plugin 320.v5a_0933a_e7d61 and earlier allows attackers to rebuild a previous build. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3033 - http://www.openwall.com/lists/oss-security/2023/07/12/2
CVE ID: CVE-2023-37955 State: PUBLISHED Published: 2023-07-12T15:52:55.621Z Last Updated: 2024-11-06T19:43:13.143Z Vendors: Jenkins Project Products: Jenkins Test Results Aggregator Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3122 - http://www.openwall.com/lists/oss-security/2023/07/12/2
CVE ID: CVE-2023-37956 State: PUBLISHED Published: 2023-07-12T15:52:56.356Z Last Updated: 2024-11-06T19:42:46.129Z Vendors: Jenkins Project Products: Jenkins Test Results Aggregator Plugin Description: A missing permission check in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3122 - http://www.openwall.com/lists/oss-security/2023/07/12/2
CVE ID: CVE-2023-37957 State: PUBLISHED Published: 2023-07-12T15:52:57.101Z Last Updated: 2024-11-06T19:42:15.477Z Vendors: Jenkins Project Products: Jenkins Pipeline restFul API Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline restFul API Plugin 0.11 and earlier allows attackers to connect to an attacker-specified URL, capturing a newly generated JCLI token. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3126 - http://www.openwall.com/lists/oss-security/2023/07/12/2