Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-35098 State: PUBLISHED Published: 2023-06-20T09:01:46.173Z Last Updated: 2024-08-02T16:23:59.543Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: John Brien Products: WordPress NextGen GalleryView Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in John Brien WordPress NextGen GalleryView plugin <= 0.5.5 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wordpress-nextgen-galleryview/wordpress-wordpress-nextgen-galleryview-plugin-0-5-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-35110 State: PUBLISHED Published: 2023-06-14T00:00:00 Last Updated: 2025-01-02T20:35:06.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered jjson thru 0.1.7 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/grobmeier/jjson/issues/2
CVE ID: CVE-2023-35116 State: PUBLISHED Published: 2023-06-14T00:00:00 Last Updated: 2024-08-02T16:23:58.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FasterXML/jackson-databind/issues/3972
CVE ID: CVE-2023-35120 State: PUBLISHED Published: 2023-07-06T23:09:42.511Z Last Updated: 2024-11-13T21:21:34.269Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: PiiGAB Products: M-Bus SoftwarePack Problem Types: CWE-352 Description: PiiGAB M-Bus is vulnerable to cross-site request forgery. An attacker who wants to execute a certain command could send a phishing mail to the owner of the device and hope that the owner clicks on the link. If the owner of the device has a cookie stored that allows the owner to be logged in, then the device could execute the GET or POST link request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
d execute the GET or POST link request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-187-01
CVE ID: CVE-2023-35121 State: PUBLISHED Published: 2024-02-14T13:38:13.220Z Last Updated: 2024-08-02T16:23:59.528Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) oneAPI DPC++/C++ Compiler software Problem Types: escalation of privilege, Improper access control Description: Improper access control in the Intel(R) oneAPI DPC++/C++ Compiler before version 2022.2.1 for some Intel(R) oneAPI Toolkits before version 2022.3.1 may allow authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en
l Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00988.html
CVE ID: CVE-2023-35123 State: PUBLISHED Published: 2024-08-14T13:45:32.163Z Last Updated: 2024-08-14T14:36:56.107Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: Intel(R) Server Platforms Problem Types: denial of service, CWE-600 Description: Uncaught exception in OpenBMC Firmware for some Intel(R) Server Platforms before versions egs-1.14-0, bhs-0.27 may allow an authenticated user to potentially enable denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01078.html
CVE ID: CVE-2023-35124 State: PUBLISHED Published: 2023-09-05T16:15:02.803Z Last Updated: 2025-02-13T16:55:47.198Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Open Automation Software Products: OAS Platform Problem Types: CWE-209 Description: An information disclosure vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to a disclosure of sensitive information. An attacker can send a sequence of requests to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1775 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1775
CVE ID: CVE-2023-35126 State: PUBLISHED Published: 2023-10-19T16:02:29.998Z Last Updated: 2025-02-13T16:55:47.722Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ichitaro 2023 Products: Ichitaro 2023 Problem Types: CWE-129 Description: An out-of-bounds write vulnerability exists within the parsers for both the "DocumentViewStyles" and "DocumentEditStyles" streams of Ichitaro 2023 1.0.1.59372 when processing types 0x0000-0x0009 of a style record with the type 0x2008. A specially crafted document can cause memory corruption, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Not
arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1825 - https://jvn.jp/en/jp/JVN28846531/index.html - https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1825
CVE ID: CVE-2023-35127 State: PUBLISHED Published: 2023-11-22T00:44:26.650Z Last Updated: 2024-08-29T19:16:01.866Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Tellus Lite V-Simulator Problem Types: CWE-121 Description: Stack-based buffer overflow may occur when Fuji Electric Tellus Lite V-Simulator parses a specially-crafted input file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02 - https://felib.fujielectric.co.jp/en/M10009/M20034/document_detail/c27d5b69-68ef-4af5-90ee-b5dab118f71a
CVE ID: CVE-2023-35128 State: PUBLISHED Published: 2024-01-08T14:47:56.209Z Last Updated: 2025-11-04T18:14:46.380Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-190 Description: An integer overflow vulnerability exists in the fstReaderIterBlocks2 time_table tsec_nitems functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1792 - https://lists.debian.o
Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1792 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-35131 State: PUBLISHED Published: 2023-06-22T00:00:00 Last Updated: 2024-08-02T16:23:59.010Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Problem Types: CWE-79 Description: Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to 3.11.14. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2214369 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/ - https://lists.fedoraproject.org/arch
kage-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/ - https://moodle.org/mod/forum/discuss.php?d=447829
CVE ID: CVE-2023-35132 State: PUBLISHED Published: 2023-06-22T00:00:00 Last Updated: 2024-08-02T16:23:59.341Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Problem Types: CWE-89 Description: A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2214371 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOE
://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/ - https://moodle.org/mod/forum/discuss.php?d=447830
CVE ID: CVE-2023-35133 State: PUBLISHED Published: 2023-06-22T00:00:00 Last Updated: 2024-08-02T16:23:59.213Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Problem Types: CWE-918 Description: An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2214373 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A7
ug.cgi?id=2214373 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/ - https://moodle.org/mod/forum/discuss.php?d=447831
CVE ID: CVE-2023-35134 State: PUBLISHED Published: 2023-07-19T21:43:20.562Z Last Updated: 2024-10-28T14:30:07.804Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Weintek Products: Weincloud Problem Types: CWE-640 Description: Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-04
CVE ID: CVE-2023-35136 State: PUBLISHED Published: 2023-11-28T01:16:16.723Z Last Updated: 2025-06-05T13:54:49.743Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) series firmware, USG20(W)-VPN series firmware, VPN series firmware Problem Types: CWE-20 Description: An improper input validation vulnerability in the “Quagga” package of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware ve
firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30 through 5.37, could allow an authenticated local attacker to access configuration files on an affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps
CVE ID: CVE-2023-35137 State: PUBLISHED Published: 2023-11-30T01:25:52.494Z Last Updated: 2024-08-02T16:23:59.353Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Zyxel Products: NAS326 firmware, NAS542 firmware Problem Types: CWE-287 Description: An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to obtain system information by sending a crafted URL to a vulnerable device. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-se
alyst Notes: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products
CVE ID: CVE-2023-35138 State: PUBLISHED Published: 2023-11-30T01:30:44.661Z Last Updated: 2024-08-02T16:23:59.034Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: NAS326 firmware, NAS542 firmware Problem Types: CWE-78 Description: A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/securi
request. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products
CVE ID: CVE-2023-35139 State: PUBLISHED Published: 2023-11-28T01:22:07.985Z Last Updated: 2024-08-02T16:23:59.589Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) series firmware, USG20(W)-VPN series firmware, VPN series firmware Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability in the CGI program of the Zyxel ATP series firmware versions 5.10 through 5.37, USG FLEX series firmware versions 5.00 through 5.37, USG FLEX 50(W) series firmware versions 5.10 through 5.37, USG20(W)-VPN series firmware versions 5.10 through 5.37, and VPN series firmware version
are versions 5.10 through 5.37, USG20(W)-VPN series firmware versions 5.10 through 5.37, and VPN series firmware versions 5.00 through 5.37, could allow an unauthenticated LAN-based attacker to store malicious scripts in a vulnerable device. A successful XSS attack could then result in the stored malicious scripts being executed to steal cookies when the user visits the specific CGI used for dumping ZTP logs. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps
CVE ID: CVE-2023-35140 State: PUBLISHED Published: 2023-11-07T01:44:18.953Z Last Updated: 2024-09-04T18:54:22.844Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Zyxel Products: GS1900-24EP firmware Problem Types: CWE-269 Description: The improper privilege management vulnerability in the Zyxel GS1900-24EP switch firmware version V2.70(ABTO.5) could allow an authenticated local user with read-only access to modify system settings on a vulnerable device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-improper-privilege-management
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-improper-privilege-management-vulnerability-in-gs1900-series-switches
CVE ID: CVE-2023-35141 State: PUBLISHED Published: 2023-06-14T12:53:05.244Z Last Updated: 2025-01-02T19:20:10.200Z Vendors: Jenkins Project Products: Jenkins Description: In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint by opening a context menu. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3135 - http://www.openwall.com/lists/oss-security/2023/06/14/5
CVE ID: CVE-2023-35142 State: PUBLISHED Published: 2023-06-14T12:53:05.967Z Last Updated: 2025-01-02T20:33:56.845Z Vendors: Jenkins Project Products: Jenkins Checkmarx Plugin Description: Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-2870 - http://www.openwall.com/lists/oss-security/2023/06/14/5
CVE ID: CVE-2023-35143 State: PUBLISHED Published: 2023-06-14T12:53:06.654Z Last Updated: 2025-01-02T19:34:53.259Z Vendors: Jenkins Project Products: Jenkins Maven Repository Server Plugin Description: Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape the versions of build artifacts on the Build Artifacts As Maven Repository page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control maven project versions in `pom.xml`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3156 - http://www.openwall.com/lists/oss-security/20
es: - https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3156 - http://www.openwall.com/lists/oss-security/2023/06/14/5
CVE ID: CVE-2023-35144 State: PUBLISHED Published: 2023-06-14T12:53:07.352Z Last Updated: 2025-01-02T19:19:11.086Z Vendors: Jenkins Project Products: Jenkins Maven Repository Server Plugin Description: Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape project and build display names on the Build Artifacts As Maven Repository page, resulting in a stored cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-2951 - http://www.openwall.com/lists/oss-security/2023/06/14/5
CVE ID: CVE-2023-35145 State: PUBLISHED Published: 2023-06-14T12:53:08.081Z Last Updated: 2025-01-02T19:05:01.388Z Vendors: Jenkins Project Products: Jenkins Sonargraph Integration Plugin Description: Jenkins Sonargraph Integration Plugin 5.0.1 and earlier does not escape the file path and the project name for the Log file field form validation, resulting in a stored cross-site scripting vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3155 - http://www.openwall.com/lists/oss-security/2023/06/14/5
CVE ID: CVE-2023-35146 State: PUBLISHED Published: 2023-06-14T12:53:08.824Z Last Updated: 2024-12-31T19:17:17.092Z Vendors: Jenkins Project Products: Jenkins Template Workflows Plugin Description: Jenkins Template Workflows Plugin 41.v32d86a_313b_4a and earlier does not escape names of jobs used as buildings blocks for Template Workflow Job, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create jobs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3166 - http://www.openwall.com/lists/oss-security/2023/06/14/5
CVE ID: CVE-2023-35147 State: PUBLISHED Published: 2023-06-14T12:53:09.530Z Last Updated: 2024-12-31T17:20:31.945Z Vendors: Jenkins Project Products: Jenkins AWS CodeCommit Trigger Plugin Description: Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowing attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3099 - http://www.openwall.com/lists/oss-security/2023/06/14/5
CVE ID: CVE-2023-35148 State: PUBLISHED Published: 2023-06-14T12:53:10.250Z Last Updated: 2024-12-31T17:19:06.782Z Vendors: Jenkins Project Products: Jenkins Digital.ai App Management Publisher Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-2911 - http://www.openwall.com/lists/oss-security/2023/06/14/5
CVE ID: CVE-2023-35149 State: PUBLISHED Published: 2023-06-14T12:53:11.041Z Last Updated: 2024-12-30T15:42:15.943Z Vendors: Jenkins Project Products: Jenkins Digital.ai App Management Publisher Plugin Description: A missing permission check in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-2911 - http://www.openwall.com/lists/oss-security/2023/06/14/5
CVE ID: CVE-2023-35150 State: PUBLISHED Published: 2023-06-23T16:26:55.213Z Last Updated: 2024-11-29T14:35:16.356Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-95 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.40m-2 and prior to versions 14.4.8, 14.10.4, and 15.0, any user with view rights on any document can execute code with programming rights, leading to remote code execution by crafting an url with a dangerous payload. The problem has been patched in XWiki 15.0, 14.10.4 and 14.4.8. Additional Analyst Notes: -
rl with a dangerous payload. The problem has been patched in XWiki 15.0, 14.10.4 and 14.4.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6mf5-36v9-3h2w - https://github.com/xwiki/xwiki-platform/commit/b65220a4d86b8888791c3b643074ebca5c089a3a - https://jira.xwiki.org/browse/XWIKI-20285
CVE ID: CVE-2023-35151 State: PUBLISHED Published: 2023-06-23T16:33:01.388Z Last Updated: 2024-11-27T20:47:29.305Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-359 Description: XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST endpoint and obtain the obfuscated passwords, even when the mail obfuscation is activated. The issue has been patched in XWiki 14.4.8, 14.10.6, and 15.1. There is no known workaround. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gith