Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-34352 State: PUBLISHED Published: 2023-09-06T01:36:42.163Z Last Updated: 2025-02-13T16:55:29.647Z Vendors: Apple Products: macOS, watchOS, iOS and iPadOS, tvOS Problem Types: An attacker may be able to leak user account emails Description: A permissions issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Ventura 13.4, tvOS 16.5, iOS 16.5 and iPadOS 16.5, watchOS 9.5. An attacker may be able to leak user account emails. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213758 - https://support.apple.com/en-us/HT213764 - https://support.apple.com/en-us/HT213
ps://support.apple.com/en-us/HT213758 - https://support.apple.com/en-us/HT213764 - https://support.apple.com/en-us/HT213757 - https://support.apple.com/en-us/HT213761 - https://support.apple.com/kb/HT213757 - https://support.apple.com/kb/HT213761 - https://support.apple.com/kb/HT213764 - https://support.apple.com/kb/HT213758
CVE ID: CVE-2023-34353 State: PUBLISHED Published: 2023-09-05T16:15:02.295Z Last Updated: 2025-02-13T16:55:30.194Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Open Automation Software Products: OAS Platform Problem Types: CWE-330 Description: An authentication bypass vulnerability exists in the OAS Engine authentication functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted network sniffing can lead to decryption of sensitive information. An attacker can sniff network traffic to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1776 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1776
CVE ID: CVE-2023-34354 State: PUBLISHED Published: 2023-10-11T15:16:56.439Z Last Updated: 2025-11-04T19:16:44.234Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N) Vendors: Peplink Products: Surf SOHO HW1 Problem Types: CWE-80 Description: A stored cross-site scripting (XSS) vulnerability exists in the upload_brand.cgi functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to execution of arbitrary javascript in another user's browser. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligen
ility. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1781
CVE ID: CVE-2023-34355 State: PUBLISHED Published: 2023-08-11T02:37:22.465Z Last Updated: 2024-10-17T13:30:53.053Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Server Board M10JNP2SB integrated BMC video drivers Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path element for some Intel(R) Server Board M10JNP2SB integrated BMC video drivers before version 3.0 for Microsoft Windows and before version 1.13.4 for linux may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00899.html
CVE ID: CVE-2023-34356 State: PUBLISHED Published: 2023-10-11T15:16:57.837Z Last Updated: 2025-11-04T19:16:45.332Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Peplink Products: Surf SOHO HW1 Problem Types: CWE-78 Description: An OS command injection vulnerability exists in the data.cgi xfer_dns functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1778
CVE ID: CVE-2023-34357 State: PUBLISHED Published: 2023-09-07T02:00:15.946Z Last Updated: 2024-09-26T19:50:30.068Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Soar Cloud Ltd. Products: HR Portal Problem Types: CWE-640 Description: Soar Cloud Ltd. HR Portal has a weak Password Recovery Mechanism for Forgotten Password. The reset password link sent out through e-mail, and the link will remain valid after the password has been reset and after the expected expiration date. An attacker with access to the browser history or has the line can thus use the URL again to change the password in order to take over the account. Additional Analyst Notes: - CVE Program Co
s use the URL again to change the password in order to take over the account. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7347-2653e-1.html
CVE ID: CVE-2023-34358 State: PUBLISHED Published: 2023-07-31T04:09:05.030Z Last Updated: 2024-10-21T14:42:51.136Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ASUS Products: RT-AX88U Problem Types: CWE-125 Description: ASUS RT-AX88U's httpd is subject to an unauthenticated DoS condition. A remote attacker can send a specially crafted request to a device which contains a specific user agent, causing the httpd binary to crash during a string comparison performed within web.c, resulting in a DoS condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7279-05760-1.html
CVE ID: CVE-2023-34359 State: PUBLISHED Published: 2023-07-31T04:31:39.240Z Last Updated: 2024-10-21T14:37:30.329Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ASUS Products: RT-AX88U Problem Types: CWE-125 Description: ASUS RT-AX88U's httpd is subject to an unauthenticated DoS condition. A remote attacker can send a specially crafted request to the device which causes the httpd binary to crash within the "do_json_decode()" function of ej.c, resulting in a DoS condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7280-bea85-1.html
CVE ID: CVE-2023-34360 State: PUBLISHED Published: 2023-07-31T05:32:14.662Z Last Updated: 2024-09-27T21:58:28.665Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: ASUS Products: RT-AX88U Problem Types: CWE-79 Description: A stored cross-site scripting (XSS) issue was discovered within the Custom User Icons functionality of ASUS RT-AX88U running firmware versions 3.0.0.4.388.23110 and prior. After a remote attacker logging in device with regular user privilege, the remote attacker can perform a Stored Cross-site Scripting (XSS) attack by uploading image which containing JavaScript code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
ding image which containing JavaScript code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://https://www.twcert.org.tw/tw/cp-132-7281-dc87d-1.html
CVE ID: CVE-2023-34362 State: PUBLISHED Published: 2023-06-02T00:00:00.000Z Last Updated: 2025-10-21T23:05:46.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that a
ker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023 - http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html - http
-31May2023 - http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html - http://packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html
CVE ID: CVE-2023-34363 State: PUBLISHED Published: 2023-06-09T00:00:00 Last Updated: 2025-01-06T17:35:37.902Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. When using Oracle Advanced Security (OAS) encryption, if an error is encountered initializing the encryption object used to encrypt data, the code falls back to a different encryption mechanism that uses an insecure random number generator to generate the private key. It is possible for a well-placed attacker to predict the output of this random number generator, which could lead to an attacker decrypting traffic between the driver a
dict the output of this random number generator, which could lead to an attacker decrypting traffic between the driver and the database server. The vulnerability does not exist if SSL / TLS encryption is used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://progress.com - https://community.progress.com/s/article/Security-vulnerabilities-in-DataDirect-ODBC-Oracle-Wire-Protocol-driver-June-2023
CVE ID: CVE-2023-34364 State: PUBLISHED Published: 2023-06-09T00:00:00 Last Updated: 2025-01-06T17:34:46.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. An overly large value for certain options of a connection string may overrun the buffer allocated to process the string value. This allows an attacker to execute code of their choice on an affected host by copying carefully selected data that will be executed as code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://progress.com - https://community.progress.com/s/article/Secur
Container: - CISA ADP Vulnrichment: References: - https://progress.com - https://community.progress.com/s/article/Security-vulnerabilities-in-DataDirect-ODBC-Oracle-Wire-Protocol-driver-June-2023
CVE ID: CVE-2023-34365 State: PUBLISHED Published: 2023-10-11T15:14:30.818Z Last Updated: 2025-11-04T19:16:46.409Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Yifan Products: YF325 Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the libutils.so nvram_restore functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to a buffer overflow. An attacker can send a network request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1763
CVE ID: CVE-2023-34366 State: PUBLISHED Published: 2023-10-19T17:00:43.773Z Last Updated: 2025-11-04T19:16:47.534Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ichitaro 2023 Products: Ichitaro 2023 Problem Types: CWE-416 Description: A use-after-free vulnerability exists in the Figure stream parsing functionality of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause memory corruption, resulting in arbitrary code execution. Victim would need to open a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2
VE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1758 - https://jvn.jp/en/jp/JVN28846531/index.html
CVE ID: CVE-2023-34367 State: PUBLISHED Published: 2023-06-14T00:00:00 Last Updated: 2025-01-06T18:10:54.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: Windows 7 is vulnerable to a full blind TCP/IP hijacking attack. The vulnerability exists in Windows 7 (any Windows until Windows 8) and in any implementation of TCP/IP, which is vulnerable to the Idle scan attack (including many IoT devices). NOTE: The vendor considers this a low severity issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://blog.pi3.com.pl/?p=850 - https://portswigger.net/daily-swig/blind-tcp-ip-hijacking-is-resurrected-for-windows-7 - https://pwnies.com/win
?p=850 - https://portswigger.net/daily-swig/blind-tcp-ip-hijacking-is-resurrected-for-windows-7 - https://pwnies.com/windows-7-blind-tcp-ip-hijacking/
CVE ID: CVE-2023-34368 State: PUBLISHED Published: 2023-06-22T12:12:37.605Z Last Updated: 2024-08-02T16:10:06.826Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Kanban for WordPress Products: Kanban Boards for WordPress Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kanban for WordPress Kanban Boards for WordPress plugin <= 2.5.20 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/kanban/wordpress-kanban-boards-for-wordpress-plugin-2-5-20-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE ID: CVE-2023-34369 State: PUBLISHED Published: 2023-07-25T13:02:01.458Z Last Updated: 2024-09-26T15:11:24.784Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: GrandSlambert Products: Login Configurator Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GrandSlambert Login Configurator plugin <= 2.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/login-configurator/wordpress-login-configurator-plugin-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34370 State: PUBLISHED Published: 2024-03-28T06:07:31.872Z Last Updated: 2024-08-02T16:10:06.781Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: Brainstorm Force Products: Starter Templates — Elementor, WordPress & Beaver Builder Templates, Premium Starter Templates Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates, Brainstorm Force Premium Starter Templates.This issue affects Starter Templates — Elementor, WordPress & Beaver Builder Templates: from n/a through 3.2.4; Premium Starter Templates: from n/a through 3.2.4. Add
or, WordPress & Beaver Builder Templates: from n/a through 3.2.4; Premium Starter Templates: from n/a through 3.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/astra-pro-sites/wordpress-premium-starter-templates-plugin-3-2-4-server-side-request-forgery-ssrf-vulnerability?_s_id=cve - https://patchstack.com/database/vulnerability/astra-sites/wordpress-starter-templates-plugin-3-2-4-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-34371 State: PUBLISHED Published: 2023-11-09T18:56:41.106Z Last Updated: 2024-09-03T18:40:09.065Z Vendors: Didier Sampaolo Products: SpamReferrerBlock Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Didier Sampaolo SpamReferrerBlock plugin <= 2.22 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/spamreferrerblock/wordpress-spamreferrerblock-plugin-2-22-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-34372 State: PUBLISHED Published: 2023-08-30T15:04:19.949Z Last Updated: 2024-09-24T19:09:01.114Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Didier Sampaolo Products: SpamReferrerBlock Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Didier Sampaolo SpamReferrerBlock plugin <= 2.22 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/spamreferrerblock/wordpress-spamreferrerblock-plugin-2-22-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34373 State: PUBLISHED Published: 2023-06-19T12:33:32.083Z Last Updated: 2024-10-18T14:31:05.394Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Dylan James Products: Zephyr Project Manager Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Project Manager plugin <= 3.3.93 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/zephyr-project-manager/wordpress-zephyr-project-manager-plugin-3-3-93-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-34374 State: PUBLISHED Published: 2023-08-10T11:24:41.484Z Last Updated: 2024-09-25T15:09:48.546Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Rahul Aryan Products: AnsPress Problem Types: CWE-79 Description: Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Rahul Aryan AnsPress plugin <= 4.3.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/anspress-question-answer/wordpress-anspress-question-and-answer-plugin-4-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34375 State: PUBLISHED Published: 2023-11-16T19:31:20.329Z Last Updated: 2024-08-02T16:10:06.975Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: 10Web Products: SEO by 10Web Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in 10Web SEO by 10Web plugin <= 1.2.9 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/seo-by-10web/wordpress-seo-by-10web-plugin-1-2-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34376 State: PUBLISHED Published: 2024-12-13T14:23:36.708Z Last Updated: 2024-12-13T18:42:10.464Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Rextheme Products: Change WooCommerce Add To Cart Button Text Problem Types: CWE-862 Description: Missing Authorization vulnerability in Rextheme Change WooCommerce Add To Cart Button Text allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Change WooCommerce Add To Cart Button Text: from n/a through 1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/change-woocommerce-add-to-cart-button-text/
Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/change-woocommerce-add-to-cart-button-text/vulnerability/wordpress-change-woocommerce-add-to-cart-button-text-plugin-1-3-broken-access-control?_s_id=cve
CVE ID: CVE-2023-34377 State: PUBLISHED Published: 2023-08-05T22:51:09.632Z Last Updated: 2024-09-25T16:52:35.098Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Joseph C Dolson Products: My Content Management Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joseph C Dolson My Content Management plugin <= 1.7.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/my-content-management/wordpress-my-content-management-plugin-1-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34378 State: PUBLISHED Published: 2023-11-13T01:02:32.440Z Last Updated: 2024-08-29T13:35:11.781Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: scriptburn.com Products: WP Hide Post Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in scriptburn.Com WP Hide Post plugin <= 2.0.10 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-hide-post/wordpress-wp-hide-post-plugin-2-0-10-cross-site-request-forgery-csrf-leading-to-post-status-change-vulnerability?_s_id=cve
CVE ID: CVE-2023-34379 State: PUBLISHED Published: 2024-01-17T16:12:05.388Z Last Updated: 2025-05-23T16:02:01.360Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: MagneticOne Products: Cart2Cart: Magento to WooCommerce Migration Problem Types: CWE-862 Description: Missing Authorization vulnerability in MagneticOne Cart2Cart: Magento to WooCommerce Migration.This issue affects Cart2Cart: Magento to WooCommerce Migration: from n/a through 2.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/cart2cart-magento-to-woocommerce-migration/wordpress-cart2cart-magento-to-woocomme
patchstack.com/database/vulnerability/cart2cart-magento-to-woocommerce-migration/wordpress-cart2cart-magento-to-woocommerce-migration-plugin-2-0-0-broken-access-control?_s_id=cve
CVE ID: CVE-2023-34381 State: PUBLISHED Published: 2024-12-13T14:23:37.245Z Last Updated: 2024-12-13T20:46:26.698Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Gesundheit Bewegt GmbH Products: Zippy Problem Types: CWE-862 Description: Missing Authorization vulnerability in Gesundheit Bewegt GmbH Zippy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zippy: from n/a through 1.6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/zippy/vulnerability/wordpress-zippy-plugin-1-6-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-34382 State: PUBLISHED Published: 2023-12-19T19:40:58.498Z Last Updated: 2024-08-02T16:10:06.759Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: weDevs Products: Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.19. Additional Analyst Notes: - CVE Program Container: References: -
Your Own Amazon, eBay, Etsy: from n/a through 3.7.19. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/dokan-lite/wordpress-dokan-plugin-3-7-19-php-object-injection-vulnerability?_s_id=cve