Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
n 3.8.0 and above and was fixed in version 3.8.12, 3.9.6, 3.10.3, and 3.11.0. Additional Analyst Notes: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 - https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.6 - https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.3 - https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.0
CVE ID: CVE-2023-46648 State: PUBLISHED Published: 2023-12-21T20:45:45.845Z Last Updated: 2024-08-02T20:53:20.919Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: GitHub Products: Enterprise Server Problem Types: CWE-331 Description: An insufficient entropy vulnerability was identified in GitHub Enterprise Server (GHES) that allowed an attacker to brute force a user invitation to the GHES Management Console. To exploit this vulnerability, an attacker would need knowledge that a user invitation was pending. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1. This vulnerabilit
ions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 - https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 - https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 - https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1
CVE ID: CVE-2023-46649 State: PUBLISHED Published: 2023-12-21T20:45:43.763Z Last Updated: 2024-08-02T20:53:20.936Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: GitHub Products: Enterprise Server Problem Types: CWE-367 Description: A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organization needs to be converted from a user. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1. Additional Analyst Notes: - CVE Program Container: References: - https://docs.github.com/en/enterprise-ser
, and 3.11.1. Additional Analyst Notes: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19 - https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 - https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 - https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 - https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1
CVE ID: CVE-2023-46650 State: PUBLISHED Published: 2023-10-25T13:45:53.053Z Last Updated: 2025-02-13T17:14:26.356Z Vendors: Jenkins Project Products: Jenkins GitHub Plugin Description: Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-10-25/#SECURITY-3246 - http://www.openwall.com/lists/oss-security/2023/10/25/2
CVE ID: CVE-2023-46651 State: PUBLISHED Published: 2023-10-25T13:45:53.679Z Last Updated: 2024-09-17T13:41:48.068Z Vendors: Jenkins Project Products: Jenkins Warnings Plugin Description: Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to. This fix has been backported to 10.4.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-10-25/#SECURITY-3265 - http://www.openwall.com/lists/oss-security/2023/10/25/2
CVE ID: CVE-2023-46652 State: PUBLISHED Published: 2023-10-25T13:45:54.338Z Last Updated: 2025-02-13T17:14:26.935Z Vendors: Jenkins Project Products: Jenkins lambdatest-automation Plugin Description: A missing permission check in Jenkins lambdatest-automation Plugin 1.20.9 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of LAMBDATEST credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-10-25/#SECURITY-3222 - http://www.openwall.com/lists/oss-security/2023/10/25/2
CVE ID: CVE-2023-46653 State: PUBLISHED Published: 2023-10-25T13:45:54.971Z Last Updated: 2025-02-13T17:14:27.436Z Vendors: Jenkins Project Products: Jenkins lambdatest-automation Plugin Description: Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting in its exposure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-10-25/#SECURITY-3202 - http://www.openwall.com/lists/oss-security/2023/10/25/2
CVE ID: CVE-2023-46654 State: PUBLISHED Published: 2023-10-25T13:45:55.611Z Last Updated: 2025-02-13T17:14:28.053Z Vendors: Jenkins Project Products: Jenkins CloudBees CD Plugin Description: Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup process of the 'CloudBees CD - Publish Artifact' post-build step, allowing attackers able to configure jobs to delete arbitrary files on the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-10-25/#SECURITY-3237 - http://www.openwall.com/lists/oss-securit
rences: - https://www.jenkins.io/security/advisory/2023-10-25/#SECURITY-3237 - http://www.openwall.com/lists/oss-security/2023/10/25/2
CVE ID: CVE-2023-46655 State: PUBLISHED Published: 2023-10-25T13:45:56.249Z Last Updated: 2025-02-13T17:14:28.562Z Vendors: Jenkins Project Products: Jenkins CloudBees CD Plugin Description: Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are published during the 'CloudBees CD - Publish Artifact' post-build step, allowing attackers able to configure jobs to publish arbitrary files from the Jenkins controller file system to the previously configured CloudBees CD server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-10-25/#SE
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-10-25/#SECURITY-3238 - http://www.openwall.com/lists/oss-security/2023/10/25/2
CVE ID: CVE-2023-46656 State: PUBLISHED Published: 2023-10-25T13:45:56.888Z Last Updated: 2025-02-13T17:14:29.123Z Vendors: Jenkins Project Products: Jenkins Multibranch Scan Webhook Trigger Plugin Description: Jenkins Multibranch Scan Webhook Trigger Plugin 1.0.9 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-10-25/#SECURITY-2875 - http://www.openwall.com/lists/oss-security/2023/10/25/2
CVE ID: CVE-2023-46657 State: PUBLISHED Published: 2023-10-25T13:45:57.548Z Last Updated: 2025-02-13T17:14:29.660Z Vendors: Jenkins Project Products: Jenkins Gogs Plugin Description: Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-10-25/#SECURITY-2896 - http://www.openwall.com/lists/oss-security/2023/10/25/2
CVE ID: CVE-2023-46658 State: PUBLISHED Published: 2023-10-25T13:45:58.198Z Last Updated: 2025-02-13T17:14:30.193Z Vendors: Jenkins Project Products: Jenkins MSTeams Webhook Trigger Plugin Description: Jenkins MSTeams Webhook Trigger Plugin 0.1.1 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-10-25/#SECURITY-2876 - http://www.openwall.com/lists/oss-security/2023/10/25/2
CVE ID: CVE-2023-46659 State: PUBLISHED Published: 2023-10-25T13:45:58.826Z Last Updated: 2025-02-13T17:14:30.704Z Vendors: Jenkins Project Products: Jenkins Edgewall Trac Plugin Description: Jenkins Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL on the build page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-10-25/#SECURITY-3247 - http://www.openwall.com/lists/oss-security/2023/10/25/2
CVE ID: CVE-2023-46660 State: PUBLISHED Published: 2023-10-25T13:45:59.448Z Last Updated: 2025-02-13T17:14:31.267Z Vendors: Jenkins Project Products: Jenkins Zanata Plugin Description: Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-10-25/#SECURITY-2879 - http://www.openwall.com/lists/oss-security/2023/10/25/2
CVE ID: CVE-2023-46661 State: PUBLISHED Published: 2023-10-26T19:57:12.046Z Last Updated: 2025-01-16T21:27:31.395Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sielco Products: PolyEco1000 Problem Types: CWE-284 Description: Sielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07
CVE ID: CVE-2023-46662 State: PUBLISHED Published: 2023-10-26T20:00:05.085Z Last Updated: 2025-01-16T21:27:22.856Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Sielco Products: PolyEco1000 Problem Types: CWE-284 Description: Sielco PolyEco1000 is vulnerable to an information disclosure vulnerability due to improper access control enforcement. An unauthenticated remote attacker can exploit this via a specially crafted request to gain access to sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07
CVE ID: CVE-2023-46663 State: PUBLISHED Published: 2023-10-26T20:02:24.004Z Last Updated: 2025-01-16T21:27:13.130Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Sielco Products: PolyEco1000 Problem Types: CWE-284 Description: Sielco PolyEco1000 is vulnerable to an attacker bypassing authorization and accessing resources behind protected pages. The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07
CVE ID: CVE-2023-46664 State: PUBLISHED Published: 2023-10-26T20:04:33.638Z Last Updated: 2025-01-16T21:27:05.860Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Sielco Products: PolyEco1000 Problem Types: CWE-284 Description: Sielco PolyEco1000 is vulnerable to an improper access control vulnerability when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources behind protected pages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07
CVE ID: CVE-2023-46665 State: PUBLISHED Published: 2023-10-26T20:08:22.908Z Last Updated: 2025-01-16T21:26:57.648Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sielco Products: PolyEco1000 Problem Types: CWE-284 Description: Sielco PolyEco1000 is vulnerable to an authentication bypass vulnerability due to an attacker modifying passwords in a POST request and gain unauthorized access to the affected device with administrative privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07
CVE ID: CVE-2023-46666 State: PUBLISHED Published: 2023-10-26T16:16:10.888Z Last Updated: 2024-09-09T15:51:59.819Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Elastic Products: Elastic Sharepoint Online Python Connector Problem Types: CWE-284 Description: An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector. If a user is assigned limited access permissions to an item on a Sharepoint site then that user would have read permissions to all content on the Sharepoint site through Elasticsearch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
t on the Sharepoint site through Elasticsearch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/elastic-sharepoint-online-python-connector-v8-10-3-0-security-update/344732 - https://www.elastic.co/community/security
CVE ID: CVE-2023-46667 State: PUBLISHED Published: 2023-10-26T00:59:36.713Z Last Updated: 2024-09-09T15:53:29.701Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Elastic Products: Fleet Server Problem Types: CWE-532 Description: An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially use that to retrieve other secrets in the policy including for Elasticsearch and third-party services. Alternatively a threat actor could potentially enrol agents to the clusters
for Elasticsearch and third-party services. Alternatively a threat actor could potentially enrol agents to the clusters and send arbitrary events to Elasticsearch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/fleet-server-v8-10-3-security-update/344737 - https://www.elastic.co/community/security
CVE ID: CVE-2023-46668 State: PUBLISHED Published: 2023-10-25T23:59:13.485Z Last Updated: 2024-09-09T19:34:43.300Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Elastic Products: Endpoint Problem Types: CWE-532 Description: If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set to debug, and when Elastic Agent is simultaneously configured to collect and send those logs to Elasticsearch, then Elastic Agent API keys can be viewed in Elasticsearch in plaintext. These API keys could be used to write arbitrary data and read Elastic Endpoint user artifacts. Additional Analyst Notes: - CVE Pro
keys could be used to write arbitrary data and read Elastic Endpoint user artifacts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/endpoint-v8-10-4-security-update/345203 - https://www.elastic.co/community/security
CVE ID: CVE-2023-46669 State: PUBLISHED Published: 2025-05-01T12:59:49.101Z Last Updated: 2025-05-01T15:33:08.751Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Elastic Products: Elastic Agent and Elastic Defend Problem Types: CWE-200 Description: Exposure of sensitive information to local unauthorized actors in Elastic Agent and Elastic Security Endpoint can lead to loss of confidentiality and impersonation of Endpoint to the Elastic Stack. This issue was identified by Elastic engineers and Elastic has no indication that it is known or has been exploited by malicious actors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.
as been exploited by malicious actors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/elastic-agent-elastic-endpoint-security-security-update-esa-2025-03/377706
CVE ID: CVE-2023-46671 State: PUBLISHED Published: 2023-12-13T06:57:59.826Z Last Updated: 2024-08-02T20:53:21.023Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Elastic Products: Kibana Problem Types: CWE-532 Description: An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 which resolves this issue. The error message recorded in the log may contain account credentials for the kibana_system user, API Keys, and credentials of Kibana end-users. The issue occurs infrequently, only if an error is returned from an Elasticsearch cluster, in cases where there is us
s. The issue occurs infrequently, only if an error is returned from an Elasticsearch cluster, in cases where there is user interaction and an unhealthy cluster (for example, when returning circuit breaker or no shard exceptions). Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/8-11-1-7-17-15-security-update-esa-2023-25/347149
CVE ID: CVE-2023-46672 State: PUBLISHED Published: 2023-11-15T08:05:26.561Z Last Updated: 2025-02-13T17:14:31.789Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: Elastic Products: Logstash Problem Types: CWE-532 Description: An issue was identified by Elastic whereby sensitive information is recorded in Logstash logs under specific circumstances. The prerequisites for the manifestation of this issue are: * Logstash is configured to log in JSON format https://www.elastic.co/guide/en/logstash/current/running-logstash-command-line.html , which is not the default logging format. * Sensitive data is stored in the Logstash keystore and referenced as a variable in L
is not the default logging format. * Sensitive data is stored in the Logstash keystore and referenced as a variable in Logstash configuration. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/logstash-8-11-1-security-update-esa-2023-26/347191 - https://www.elastic.co/community/security - https://security.netapp.com/advisory/ntap-20240125-0002/ - https://security.netapp.com/advisory/ntap-20240229-0001/
CVE ID: CVE-2023-46673 State: PUBLISHED Published: 2023-11-22T09:27:10.454Z Last Updated: 2024-08-02T20:53:21.554Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Elastic Products: Elasticsearch Problem Types: CWE-755 Description: It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elasticsearch-7-17-14-8-10-3-security-update-esa-2023-24/347708 - https://www.elastic.co/community/security
CVE ID: CVE-2023-46674 State: PUBLISHED Published: 2023-12-05T17:21:59.184Z Last Updated: 2024-08-28T14:26:21.336Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H) Vendors: Elastic Products: Elasticsearch-Hadoop Problem Types: CWE-502 Description: An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/elasticsearch-hadoop-7-17-11-8-9
Program Container: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/elasticsearch-hadoop-7-17-11-8-9-0-security-update-esa-2023-28/348663
CVE ID: CVE-2023-46675 State: PUBLISHED Published: 2023-12-13T07:02:07.706Z Last Updated: 2025-05-22T18:20:29.348Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Elastic Products: Kibana Problem Types: CWE-532 Description: An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has released Kibana 8.11.2 which resolves this issue. The messages recorded in the log may contain Account credentials for the kibana_system user, API Keys, and credentials of Kibana end-users, Elastic Security package policy objects which can contain p
_system user, API Keys, and credentials of Kibana end-users, Elastic Security package policy objects which can contain private keys, bearer token, and sessions of 3rd-party integrations and finally Authorization headers, client secrets, local file paths, and stack traces. The issue may occur in any Kibana instance running an affected version that could potentially receive an unexpected error when communicating to Elasticsearch causing it to include sensitive data into Kibana error logs. It could also occur under specific circumstances when debug level logging is enabled in Kibana. Note: It was found that the fix for ESA-2023-25 in Kibana 8.11.1 for a similar issue was incomplete. Additional
Kibana. Note: It was found that the fix for ESA-2023-25 in Kibana 8.11.1 for a similar issue was incomplete. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/kibana-8-11-2-7-17-16-security-update-esa-2023-27/349182/2
CVE ID: CVE-2023-46676 State: REJECTED Published: 2023-11-07T20:34:12.257Z Last Updated: 2024-01-02T18:41:17.301Z Description: No description available.
CVE ID: CVE-2023-46677 State: PUBLISHED Published: 2023-11-07T20:35:03.334Z Last Updated: 2024-09-12T19:12:00.786Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Job Portal Problem Types: CWE-89 Description: Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txt_uname' parameter of the sign-up.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/netrebko - https://projectworlds.in
CVE ID: CVE-2023-46678 State: REJECTED Published: 2023-11-07T20:36:32.975Z Last Updated: 2024-01-02T18:43:48.175Z Description: No description available.