Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-26805 State: PUBLISHED Published: 2023-03-19T00:00:00.000Z Last Updated: 2025-02-27T16:19:08.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W20E v15.11.0.6 (US_W20EV4.0br_v15.11.0.6(1068_1546_841)_CN_TDC) is vulnerable to Buffer Overflow via function formIPMacBindModify. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Stevenbaga/fengsha/blob/main/W20E/formIPMacBindModify.md
CVE ID: CVE-2023-26806 State: PUBLISHED Published: 2023-03-19T00:00:00.000Z Last Updated: 2025-02-27T16:20:13.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W20E v15.11.0.6(US_W20EV4.0br_v15.11.0.6(1068_1546_841 is vulnerable to Buffer Overflow via function formSetSysTime, Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Stevenbaga/fengsha/blob/main/W20E/SetSysTime.md
CVE ID: CVE-2023-26812 State: REJECTED Published: N/A Last Updated: 2023-05-02T00:00:00 Description: No description available.
CVE ID: CVE-2023-26813 State: PUBLISHED Published: 2023-04-28T00:00:00.000Z Last Updated: 2025-01-31T16:38:16.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in com.xnx3.wangmarket.plugin.dataDictionary.controller.DataDictionaryPluginController.java in wangmarket CMS 4.10 allows remote attackers to run arbitrary SQL commands via the TableName parameter to /plugin/dataDictionary/tableView.do. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xnx3/wangmarket/issues/7
CVE ID: CVE-2023-26817 State: PUBLISHED Published: 2023-04-07T00:00:00.000Z Last Updated: 2025-02-12T20:15:39.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: codefever before 2023.2.7-commit-b1c2e7f was discovered to contain a remote code execution (RCE) vulnerability via the component /controllers/api/user.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PGYER/codefever/issues/140
CVE ID: CVE-2023-26818 State: PUBLISHED Published: 2023-05-19T00:00:00 Last Updated: 2025-01-21T19:56:06.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://telegram.com - https://danrevah.github.io/2023/05/15/CVE-2023-26818-Bypass-TCC-with-Telegram/
CVE ID: CVE-2023-26819 State: PUBLISHED Published: 2025-04-19T00:00:00.000Z Last Updated: 2025-11-03T19:28:10.065Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: cJSON Project Products: cJSON Problem Types: CWE-440 Description: cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/boofish/json_bugs/tree/main/cjson
CVE ID: CVE-2023-26820 State: PUBLISHED Published: 2023-04-07T00:00:00.000Z Last Updated: 2025-02-12T20:12:57.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: siteproxy v1.0 was discovered to contain a path traversal vulnerability via the component index.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/netptop/siteproxy/issues/67
CVE ID: CVE-2023-26822 State: PUBLISHED Published: 2023-04-01T00:00:00.000Z Last Updated: 2025-02-11T17:12:28.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at soapcgi.main. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/yzskyt/Vuln/blob/main/Go-RT-AC750/Go-RT-AC750.md
CVE ID: CVE-2023-26823 State: REJECTED Published: N/A Last Updated: 2023-03-20T00:00:00 Description: No description available.
CVE ID: CVE-2023-26829 State: PUBLISHED Published: 2023-03-31T00:00:00.000Z Last Updated: 2025-02-18T16:16:37.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows remote attackers to set a new password for any valid user account, without needing the previous known password, resulting in a full authentication bypass. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.whiteoaksecurity.com/blog/centrestack-disclosure/
CVE ID: CVE-2023-26830 State: PUBLISHED Published: 2023-03-31T00:00:00.000Z Last Updated: 2025-02-18T16:57:33.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack before 13.5.9808 allows authenticated attackers to execute arbitrary code by uploading malicious files to the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.whiteoaksecurity.com/blog/centrestack-disclosure/
CVE ID: CVE-2023-26839 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-04T14:49:50.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to edit information for existing people on the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM - https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-26839
CVE ID: CVE-2023-26840 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-03T18:52:42.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and set that user to be an Administrator. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM - https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-26840
CVE ID: CVE-2023-26841 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-03T21:16:18.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password except for the user that is currently logged in. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM - https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-26841
CVE ID: CVE-2023-26842 State: PUBLISHED Published: 2023-05-31T00:00:00 Last Updated: 2025-01-09T19:14:41.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the OptionManager.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-26842
CVE ID: CVE-2023-26843 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-04T14:41:26.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM - https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-26843
CVE ID: CVE-2023-26845 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-10T15:54:27.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in OpenCATS 0.9.7 allows attackers to force users into submitting web requests via unspecified vectors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://opencats.org - https://github.com/cassis-sec/CVE/tree/main/2023/CVE-2023-26845
CVE ID: CVE-2023-26846 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-11T16:03:42.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the city parameter at opencats/index.php?m=candidates. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://opencats.org - https://github.com/cassis-sec/CVE/tree/main/2023/CVE-2023-26846
CVE ID: CVE-2023-26847 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-11T16:01:23.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the state parameter at opencats/index.php?m=candidates. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://opencats.org - https://github.com/cassis-sec/CVE/tree/main/2023/CVE-2023-26847
CVE ID: CVE-2023-26848 State: PUBLISHED Published: 2023-04-07T00:00:00.000Z Last Updated: 2025-02-12T20:07:41.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the org parameter at setting/delStaticDhcpRules. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Am1ngl/ttt/tree/main/23
CVE ID: CVE-2023-26852 State: PUBLISHED Published: 2023-04-12T00:00:00.000Z Last Updated: 2025-02-10T16:01:02.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the upload plugin of Textpattern v4.8.8 and below allows attackers to execute arbitrary code by uploading a crafted PHP file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/textpattern/textpattern - https://drive.google.com/drive/folders/1x55FGWZydBRxFyTVIAL1ynnk1X7gfIq9?usp=sharing - https://github.com/leekenghwa/CVE-2023-26852-Textpattern-v4.8.8-and-
CVE ID: CVE-2023-26855 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-13T15:34:31.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: The hashing algorithm of ChurchCRM v4.5.3 utilizes a non-random salt value which allows attackers to use precomputed hash tables or dictionary attacks to crack the hashed passwords. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM/issues/6449
CVE ID: CVE-2023-26856 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-13T16:11:45.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/ajax.php?action=login. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ctg503/bug_report/blob/main/vendors/oretnom23/dynamic-transaction-queuing-system/SQLi-1.md
CVE ID: CVE-2023-26857 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-13T16:08:06.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in /admin/ajax.php?action=save_uploads of Dynamic Transaction Queuing System v1.0 allows attackers to execute arbitrary code via a crafted PHP file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ctg503/bug_report/blob/main/vendors/oretnom23/dynamic-transaction-queuing-system/RCE-1.md
CVE ID: CVE-2023-26858 State: PUBLISHED Published: 2023-03-31T00:00:00.000Z Last Updated: 2025-02-18T16:58:10.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability found in PrestaSHp faqs v.3.1.6 allows a remote attacker to escalate privileges via the faqsBudgetModuleFrontController::displayAjaxGenerateBudget component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://addons.prestashop.com/en/faq-frequently-asked-questions/16036-frequently-asked-questions-faq-page.html - https://friends-of-presta.github.io/security-advisories/modules/2023/03/28/faqs.html
CVE ID: CVE-2023-26859 State: PUBLISHED Published: 2023-07-26T00:00:00 Last Updated: 2024-10-23T15:03:38.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability found in PrestaShop sendinblue v.4.0.15 and before allow a remote attacker to gain privileges via the ajaxOrderTracking.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://addons.prestashop.com/en/newsletter-sms/8300-sendinblue-all-in-one-marketing-tool.html - https://security.friendsofpresta.org/modules/2023/07/25/sendinblue.html
CVE ID: CVE-2023-26860 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-02-11T16:46:18.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability found in PrestaShop Igbudget v.1.0.3 and before allow a remote attacker to gain privileges via the LgBudgetBudgetModuleFrontController::displayAjaxGenerateBudget component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://addons.prestashop.com/en/order-management/45282-save-your-carts-and-buy-later-or-send-it.html - https://friends-of-presta.github.io/security-advisories/modules/2023/04/04/lgbudget.html
CVE ID: CVE-2023-26861 State: PUBLISHED Published: 2023-07-11T00:00:00 Last Updated: 2024-11-08T16:33:14.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability found in PrestaShop vivawallet v.1.7.10 and before allows a remote attacker to gain privileges via the vivawallet() module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/VivaPayments/API/commit/c1169680508c6e144d3e102ebdb257612e4cd84a - https://addons.prestashop.com/fr/paiement/89363-viva-wallet-smart-checkout.html - https://security.friendsofpresta.org/modules/2023/07/11/vivawallet.html
CVE ID: CVE-2023-26862 State: REJECTED Published: N/A Last Updated: 2025-02-13T15:46:40.258Z Description: No description available.
CVE ID: CVE-2023-26863 State: REJECTED Published: N/A Last Updated: 2025-02-13T15:46:40.793Z Description: No description available.
CVE ID: CVE-2023-26864 State: PUBLISHED Published: 2023-03-24T00:00:00.000Z Last Updated: 2025-02-21T19:22:18.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability found in PrestaShop smplredirectionsmanager v.1.1.19 and before allow a remote attacker to gain privileges via the SmplTools::getMatchingRedirectionsFromPartscomponent. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://friends-of-presta.github.io/security-advisories/modules/2023/01/17/smplredirectionsmanager.html
CVE ID: CVE-2023-26865 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-02-05T15:42:55.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability found in PrestaShop bdroppy v.2.2.12 and before allowing a remote attacker to gain privileges via the BdroppyCronModuleFrontController::importProducts component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bdroppy.com/dropshipping-apps-integrations-bdroppy/ - https://friends-of-presta.github.io/security-advisories/modules/2023/04/20/bdroppy.html
CVE ID: CVE-2023-26866 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-13T15:32:20.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: GreenPacket OH736's WR-1200 Indoor Unit, OT-235 with firmware versions M-IDU-1.6.0.3_V1.1 and MH-46360-2.0.3-R5-GP respectively are vulnerable to remote command injection. Commands are executed using pre-login execution and executed with root privileges allowing complete takeover. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lionelmusonza/CVE-2023-26866
CVE ID: CVE-2023-26876 State: PUBLISHED Published: 2023-04-21T00:00:00.000Z Last Updated: 2025-02-13T16:44:58.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tempest.com.br - https://piwigo.com - https://gist.github.com/rodnt/a190d14d1715890d8df19bad58b90693 - http://seclists.org/fulldisclosure/2023/Apr/13 - http://packetstormsecurity.com/files/172059/Piwigo-1
8df19bad58b90693 - http://seclists.org/fulldisclosure/2023/Apr/13 - http://packetstormsecurity.com/files/172059/Piwigo-13.5.0-SQL-Injection.html
CVE ID: CVE-2023-26877 State: PUBLISHED Published: 2024-06-26T00:00:00 Last Updated: 2024-08-02T12:01:31.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: File upload vulnerability found in Softexpert Excellence Suite v.2.1 allows attackers to execute arbitrary code via a .php file upload to the form/efms_exec_html/file_upload_parser.php endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/rodnt/90ac26fdf891e602f6f090d6aebce32d
CVE ID: CVE-2023-26905 State: PUBLISHED Published: 2023-03-19T00:00:00.000Z Last Updated: 2025-02-27T16:21:42.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Alphaware - Simple E-Commerce System v1.0. There is a SQL injection that can directly issue instructions to the background database system via /alphaware/details.php?id. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/1MurasaKi/bug_report/blob/main/vendors/razormist/Alphaware%20-%20Simple%20E-Commerce%20System/SQLi-1.md
CVE ID: CVE-2023-26911 State: PUBLISHED Published: 2023-07-26T00:00:00 Last Updated: 2024-10-23T19:18:08.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://asus.com - http://setupasusservices.com - https://irradiate.com.au/blog/CVE-2023-26911
CVE ID: CVE-2023-26912 State: PUBLISHED Published: 2023-03-15T00:00:00.000Z Last Updated: 2025-02-27T19:22:07.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross site scripting (XSS) vulnerability in xenv S-mall-ssm thru commit 3d9e77f7d80289a30f67aaba1ae73e375d33ef71 on Feb 17, 2020, allows local attackers to execute arbitrary code via the evaluate button. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xenv/S-mall-ssm/issues/37
CVE ID: CVE-2023-26913 State: PUBLISHED Published: 2023-03-22T00:00:00 Last Updated: 2024-08-02T12:01:31.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: EVOLUCARE ECSIMAGING (aka ECS Imaging) < 6.21.5 is vulnerable to Cross Site Scripting (XSS) via new_movie. php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wanheiqiyihu.top/2023/02/13/Evolucare-Ecsimaging-new-movie-php%E5%8F%8D%E5%B0%84%E6%80%A7xss/
CVE ID: CVE-2023-26916 State: PUBLISHED Published: 2023-04-03T00:00:00.000Z Last Updated: 2025-02-18T16:59:13.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lys_parse_mem at lys_parse_mem.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CESNET/libyang/issues/1979 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6NQZHCJG3SBMFOQNIPRZGKDK3ARHLTTB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2VWGCMYKQH4BTFEHX5VY
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2VWGCMYKQH4BTFEHX5VYEXXOPIKKFHS/
CVE ID: CVE-2023-26917 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-11T15:52:49.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lysp_stmt_validate_value at lys_parse_mem.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CESNET/libyang/issues/1987
CVE ID: CVE-2023-26918 State: PUBLISHED Published: 2023-04-13T00:00:00.000Z Last Updated: 2025-02-07T16:01:14.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan horse that will be executed as LocalSystem. This occurs because %ProgramFiles%\FileReplicationPro allows Everyone:(F) access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.filereplicationpro.com - http://packetstormsecurity.com/files/171879/File-Replication-Pro-7.5.0-Insecure-Permissions-Privilege-Escalation.html
CVE ID: CVE-2023-26919 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-02-11T17:14:47.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: delight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape. When allowExitFunctions is set to false, the loadWithNewGlobal function can be used to invoke the exit and quit methods to exit the Java process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/javadelight/delight-nashorn-sandbox/issues/135
CVE ID: CVE-2023-26920 State: PUBLISHED Published: 2023-12-12T00:00:00 Last Updated: 2024-08-02T12:01:31.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7 - https://github.com/advisories/GHSA-793h-6f7r-6qvm - https://github.com/NaturalIntelligence/fast-xml-parser/commit/2b032a4f799c63d83991e4f992f1c68e4dd05804
CVE ID: CVE-2023-26921 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-13T15:30:29.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS Command Injection vulnerability in quectel AG550QCN allows attackers to execute arbitrary commands via ql_atfwd. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/closethe/AG550QCN_CommandInjection_ql_atfwd/blob/main/README.md
CVE ID: CVE-2023-26922 State: PUBLISHED Published: 2023-03-08T00:00:00.000Z Last Updated: 2025-03-04T14:41:25.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability found in Varisicte matrix-gui v.2 allows a remote attacker to execute arbitrary code via the shell_exect parameter to the \www\pages\matrix-gui-2.0 endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/varigit/matrix-gui-v2/issues/1