Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-5178 State: PUBLISHED Published: 2023-11-01T16:32:20.350Z Last Updated: 2025-11-06T21:01:35.551Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux
x 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-416 Description: A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may pe
the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:7370 - https://access.redhat.com/errata/RHSA-2023:7379 - https://access.redhat.com/errata/RHSA-2023:7418 - https://access.redhat.com/errata/RHSA-2023:7548 - https://access.redhat.com/errata/RHSA-2023:7549 - https://access.redhat.com/errata/RHSA-2023:7551 - https://access.redhat.com/errata/RHSA-2023:7554 - https://access.redhat.com/errata/RHSA-2023:7557 - https://access.redhat.com/errata/RHSA-2023:7559 -
ata/RHSA-2023:7554 - https://access.redhat.com/errata/RHSA-2023:7557 - https://access.redhat.com/errata/RHSA-2023:7559 - https://access.redhat.com/errata/RHSA-2024:0340 - https://access.redhat.com/errata/RHSA-2024:0378 - https://access.redhat.com/errata/RHSA-2024:0386 - https://access.redhat.com/errata/RHSA-2024:0412 - https://access.redhat.com/errata/RHSA-2024:0431 - https://access.redhat.com/errata/RHSA-2024:0432 - https://access.redhat.com/errata/RHSA-2024:0461 - https://access.redhat.com/errata/RHSA-2024:0554 - https://access.redhat.com/errata/RHSA-2024:0575 - https://access.redhat.com/errata/RHSA-2024:1268 - https://access.redhat.com/errata/RHSA-2024:1269 - https://access.redhat.com/err
ccess.redhat.com/errata/RHSA-2024:1268 - https://access.redhat.com/errata/RHSA-2024:1269 - https://access.redhat.com/errata/RHSA-2024:1278 - https://access.redhat.com/security/cve/CVE-2023-5178 - https://bugzilla.redhat.com/show_bug.cgi?id=2241924 - https://lore.kernel.org/linux-nvme/20231002105428.226515-1-sagi@grimberg.me/
CVE ID: CVE-2023-5179 State: PUBLISHED Published: 2023-11-07T15:16:22.607Z Last Updated: 2024-09-04T19:43:42.670Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Open Design Alliance Products: ODA Drawings SDK - All Versions < 2024.10 Problem Types: CWE-125 Description: An issue was discovered in Open Design Alliance Drawings SDK before 2024.10. A corrupted value for the start of MiniFat sector in a crafted DGN file leads to an out-of-bounds read. This can allow attackers to cause a crash, potentially enabling a denial-of-service attack (Crash, Exit, or Restart) or possible code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichm
h, Exit, or Restart) or possible code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.opendesign.com/security-advisories
CVE ID: CVE-2023-5180 State: PUBLISHED Published: 2023-12-26T08:35:37.619Z Last Updated: 2024-08-02T07:52:07.647Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Open Design Alliance Products: ODA Drawings SDK - All Versions < 2024.12 Problem Types: CWE-787 Description: An issue was discovered in Open Design Alliance Drawings SDK before 2024.12. A corrupted value of number of sectors used by the Fat structure in a crafted DGN file leads to an out-of-bounds write. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-
e current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories
CVE ID: CVE-2023-5181 State: PUBLISHED Published: 2023-11-06T20:41:32.307Z Last Updated: 2025-02-26T21:24:01.511Z Vendors: Unknown Products: WP Discord Invite Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Discord Invite WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/564ad2b0-6ba6-4415-98d7-8d41bc1c3d44
CVE ID: CVE-2023-5182 State: PUBLISHED Published: 2023-10-06T23:28:48.953Z Last Updated: 2024-09-19T16:41:29.487Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Canonical Ltd. Products: subiquity Problem Types: CWE-532 Description: Sensitive data could be exposed in logs of subiquity version 23.09.1 and earlier. An attacker in the adm group could use this information to find hashed passwords and possibly escalate their privilege. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5182 - https://github.com/canonical/subiquity/pull/1820/commits/62e126896fb063808767d
/cgi-bin/cvename.cgi?name=CVE-2023-5182 - https://github.com/canonical/subiquity/pull/1820/commits/62e126896fb063808767d74d00886001e38eaa1c
CVE ID: CVE-2023-5183 State: PUBLISHED Published: 2023-09-26T21:29:36.575Z Last Updated: 2024-09-24T13:43:17.802Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Illumio Products: Core PCE Problem Types: CWE-502 Description: Unsafe deserialization of untrusted JSON allows execution of arbitrary code on affected releases of the Illumio PCE. Authentication to the API is required to exploit this vulnerability. The flaw exists within the network_traffic API endpoint. An attacker can leverage this vulnerability to execute code in the context of the PCE’s operating system user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
f the PCE’s operating system user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.illumio.com/Guides/security-advisories/september-2023/cve-2023-5183.htm
CVE ID: CVE-2023-5184 State: PUBLISHED Published: 2023-09-27T17:26:51.660Z Last Updated: 2025-06-18T14:08:20.654Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-120, CWE-195 Description: Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8x3p-q3r5-xh9g - http://www.openwall.com/lists/oss-security/2023/11/07/1 - http://seclists.org/fulldisclosure/2023/Nov/1 - htt
3r5-xh9g - http://www.openwall.com/lists/oss-security/2023/11/07/1 - http://seclists.org/fulldisclosure/2023/Nov/1 - http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html
CVE ID: CVE-2023-5185 State: PUBLISHED Published: 2023-09-28T20:52:35.938Z Last Updated: 2024-09-23T18:57:19.596Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Gym Management System Project Products: Gym Management System Project Problem Types: CWE-434 Description: Gym Management System Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'file' parameter of profile/i.php page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/orion - https://projectworl
rogram Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/orion - https://projectworlds.in/
CVE ID: CVE-2023-5186 State: PUBLISHED Published: 2023-09-28T15:23:18.607Z Last Updated: 2025-02-13T17:19:56.138Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Passwords in Google Chrome prior to 117.0.5938.132 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via crafted UI interaction. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html - https://crbug.com/1478889 - https://www.debian.org/security/2023/dsa-5508 - https://lists.fedoraproj
r-desktop_27.html - https://crbug.com/1478889 - https://www.debian.org/security/2023/dsa-5508 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-5187 State: PUBLISHED Published: 2023-09-28T15:23:18.810Z Last Updated: 2025-02-13T17:19:56.694Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Extensions in Google Chrome prior to 117.0.5938.132 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html - https://crbug.com/1475798 - https://www.debian.org/security/2023/dsa-5508 - https://lists.fedoraproject.org/arch
.html - https://crbug.com/1475798 - https://www.debian.org/security/2023/dsa-5508 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-5188 State: PUBLISHED Published: 2023-12-05T07:19:08.528Z Last Updated: 2024-08-02T07:52:07.789Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: WAGO Products: Telecontrol Configurator, WagoAppRTU Problem Types: CWE-20 Description: The MMS Interpreter of WagoAppRTU in versions below 1.4.6.0 which is used by the WAGO Telecontrol Configurator is vulnerable to malformed packets. An remote unauthenticated attacker could send specifically crafted packets that lead to a denial-of-service condition until restart of the affected device. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2023-044/
CVE ID: CVE-2023-5189 State: PUBLISHED Published: 2023-11-14T22:57:00.584Z Last Updated: 2025-11-20T17:30:17.896Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: Red Hat Products: Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9, Red Hat Satellite 6.14 for RHEL 8, Red Hat Satellite 6.15 for RHEL 8 Problem Types: CWE-23 Description: A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten. Additional Anal
of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2023:7773 - https://access.redhat.com/errata/RHSA-2024:1536 - https://access.redhat.com/errata/RHSA-2024:2010 - https://access.redhat.com/security/cve/CVE-2023-5189 - https://bugzilla.redhat.com/show_bug.cgi?id=2234387
CVE ID: CVE-2023-5190 State: PUBLISHED Published: 2024-02-20T06:03:45.941Z Last Updated: 2024-08-02T07:52:07.791Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-601 Description: Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45 through 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_address_web_internal_portlet_CountriesManagementAdminPortlet_redirect parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: R
ManagementAdminPortlet_redirect parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-5190
CVE ID: CVE-2023-5192 State: PUBLISHED Published: 2023-09-26T07:34:27.103Z Last Updated: 2024-09-24T14:21:53.364Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H) Vendors: pimcore Products: pimcore/demo Problem Types: CWE-1049 Description: Excessive Data Query Operations in a Large Data Table in GitHub repository pimcore/demo prior to 10.3.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/65c954f2-79c3-4672-8846-a3035e7a1db7 - https://github.com/pimcore/demo/commit/a2a7ff3b565882aefb759804aac4a51afb458f1f
CVE ID: CVE-2023-5193 State: PUBLISHED Published: 2023-09-29T09:23:47.082Z Last Updated: 2024-09-20T16:01:39.785Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a DM conversation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-5194 State: PUBLISHED Published: 2023-09-29T09:28:50.676Z Last Updated: 2024-09-05T19:59:54.546Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-5195 State: PUBLISHED Published: 2023-09-29T09:25:58.963Z Last Updated: 2024-09-05T20:00:33.078Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost fails to properly validate the permissions when soft deleting a team allowing a team member to soft delete other teams that they are not part of Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-5196 State: PUBLISHED Published: 2023-09-29T09:22:36.286Z Last Updated: 2024-09-20T16:02:00.219Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Mattermost Products: Mattermost Problem Types: CWE-400 Description: Mattermost fails to enforce character limits in all possible notification props allowing an attacker to send a really long value for a notification_prop resulting in the server consuming an abnormal quantity of computing resources and possibly becoming temporarily unavailable for its users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-5197 State: PUBLISHED Published: 2023-09-26T10:04:37.147Z Last Updated: 2025-02-13T17:19:57.224Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Kernel Problem Types: CWE-416 Description: A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free. We recommend upgrading past commit f15f29fd4779be8a418b66e9d52979bb6d6c2325. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvald
Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f15f29fd4779be8a418b66e9d52979bb6d6c2325 - https://kernel.dance/f15f29fd4779be8a418b66e9d52979bb6d6c2325 - http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html - https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html
CVE ID: CVE-2023-5198 State: PUBLISHED Published: 2023-09-29T07:01:42.219Z Last Updated: 2025-11-20T04:10:23.938Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in GitLab affecting all versions prior to 16.2.7, all versions starting from 16.3 before 16.3.5, and all versions starting from 16.4 before 16.4.1. It was possible for a removed project member to write to protected branches using deploy keys. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/416957 - https://hackerone.com/repor
CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/416957 - https://hackerone.com/reports/2041789
CVE ID: CVE-2023-5199 State: PUBLISHED Published: 2023-10-30T13:48:58.665Z Last Updated: 2025-02-05T18:55:34.325Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: bloafer Products: PHP to Page Problem Types: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Description: The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the 'php-to-page' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to include local file and potentially execute code on the server. While subscribers m
criber-level permissions or above, to include local file and potentially execute code on the server. While subscribers may need to poison log files or otherwise get a file installed in order to achieve remote code execution, author and above users can upload files by default and achieve remote code execution easily. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/83e5a0dc-fc51-4565-945f-190cf9175874?source=cve - https://plugins.trac.wordpress.org/browser/php-to-page/trunk/php-to-page.php?rev=441028#L22
CVE ID: CVE-2023-5200 State: PUBLISHED Published: 2023-10-20T06:35:16.096Z Last Updated: 2025-02-05T19:10:10.015Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: getflowpaper Products: flowpaper Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The flowpaper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'flipbook' shortcode in versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary we
. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/31d6288d-87f0-4822-b3f4-541f70cf99fd?source=cve - https://plugins.trac.wordpress.org/browser/flowpaper-lite-pdf-flipbook/trunk/flowpaper.php?rev=2959754#L395 - https://plugins.trac.wordpress.org/changeset/2966821/flowpaper-lite-pdf-flipbook
CVE ID: CVE-2023-5201 State: PUBLISHED Published: 2023-09-30T02:33:28.344Z Last Updated: 2025-02-05T19:17:46.311Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: brazenlygeek Products: OpenHook Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The OpenHook plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.3.0 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server. This requires the [php] shortcode setting to be enabled on the vulnerable site. Additional Analyst Notes: - CVE Program Containe
uires the [php] shortcode setting to be enabled on the vulnerable site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/37b9ed0e-5af2-47c1-b2da-8d103e4c31bf?source=cve - https://plugins.trac.wordpress.org/browser/thesis-openhook/tags/4.3.0/inc/shortcodes.php#L28 - https://plugins.trac.wordpress.org/browser/thesis-openhook/tags/4.3.1/inc/shortcodes.php?rev=2972840#L24
CVE ID: CVE-2023-5203 State: PUBLISHED Published: 2023-12-26T18:33:07.808Z Last Updated: 2024-09-12T12:35:45.983Z Vendors: Unknown Products: WP Sessions Time Monitoring Full Automatic Problem Types: CWE-89 SQL Injection Description: The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7f4
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7f4f505b-2667-4e0f-9841-9c1cd0831932