Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-27076 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-05-05T16:03:16.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command injection vulnerability found in Tenda G103 v.1.0.0.5 allows attacker to execute arbitrary code via a the language parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/B2eFly/Router/blob/main/Tenda/G103/1.md
CVE ID: CVE-2023-27077 State: PUBLISHED Published: 2023-03-23T00:00:00.000Z Last Updated: 2025-02-25T20:37:09.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack Overflow vulnerability found in 360 D901 allows a remote attacker to cause a Distributed Denial of Service (DDOS) via a crafted HTTP package. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/B2eFly/Router/blob/main/360/360D901.md
CVE ID: CVE-2023-27078 State: PUBLISHED Published: 2023-03-23T00:00:00.000Z Last Updated: 2025-02-25T20:35:03.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection issue was found in TP-Link MR3020 v.1_150921 that allows a remote attacker to execute arbitrary commands via a crafted request to the tftp endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/B2eFly/Router/blob/main/TPLINK/MR3020/1.md
CVE ID: CVE-2023-27079 State: PUBLISHED Published: 2023-03-23T00:00:00.000Z Last Updated: 2025-02-25T20:30:44.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command Injection vulnerability found in Tenda G103 v.1.0.05 allows an attacker to obtain sensitive information via a crafted package Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/B2eFly/Router/blob/main/Tenda/G103/2.md
CVE ID: CVE-2023-27082 State: PUBLISHED Published: 2023-06-26T00:00:00 Last Updated: 2024-12-04T17:08:13.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev4 allows remote attackers to run arbitrary code via upload of crafted html file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40syed.pentester/authenticated-stored-cross-site-scripting-xss-d39aab69e58f
CVE ID: CVE-2023-27083 State: PUBLISHED Published: 2023-06-22T00:00:00 Last Updated: 2024-12-06T21:21:15.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev5 allows remote attackers to run arbitrary code via manage file functionality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40syed.pentester/authenticated-remote-code-execution-rce-on-pluckcms-4-7-15-c309ac1bd145
CVE ID: CVE-2023-27084 State: PUBLISHED Published: 2023-03-16T00:00:00.000Z Last Updated: 2025-02-26T19:39:33.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: Permissions vulnerability found in isoftforce Dreamer CMS v.4.0.1 allows local attackers to obtain sensitive information via the AttachmentController parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/isoftforce/dreamer_cms/issues/I6GCUN - https://github.com/iteachyou-wjn/dreamer_cms/issues/9
CVE ID: CVE-2023-27087 State: PUBLISHED Published: 2023-03-21T00:00:00.000Z Last Updated: 2025-02-26T18:30:19.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageList parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xuxueli/xxl-job/issues/3096
CVE ID: CVE-2023-27088 State: PUBLISHED Published: 2023-03-08T00:00:00.000Z Last Updated: 2025-03-05T18:24:04.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: feiqu-opensource Background Vertical authorization vulnerability exists in IndexController.java. demo users with low permission can perform operations within the permission of the admin super administrator and can use this vulnerability to change the blacklist IP address in the system at will. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/chen87548081/feiqu-opensource/issues/2
CVE ID: CVE-2023-27089 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-14T16:23:04.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability found in Ehuacui BBS allows attackers to cause a denial of service via a crafted payload in the login parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/ehuacui/ehuacui-bbs/issues/I6GDCB - https://github.com/ehuacui/ehuacui-bbs/issues/3
CVE ID: CVE-2023-27090 State: PUBLISHED Published: 2023-04-20T00:00:00.000Z Last Updated: 2025-02-05T15:03:07.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability found in TeaCMS storage allows attacker to cause a leak of sensitive information via the article title parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/xiaobingby/TeaCMS/issues/I6GDDN - https://gitee.com/xiaobingby/TeaCMS/issues/I6L9Z2
CVE ID: CVE-2023-27091 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-18T17:13:07.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unauthorized access issue found in XiaoBingby TeaCMS 2.3.3 allows attackers to escalate privileges via the id and keywords parameter(s). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/xiaobingby/TeaCMS/issues/I6GDRU - https://gitee.com/xiaobingby/TeaCMS/issues/I6SXAF
CVE ID: CVE-2023-27092 State: PUBLISHED Published: 2023-04-18T00:00:00.000Z Last Updated: 2025-02-06T15:10:56.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability found in Jbootfly allows attackers to obtain sensitive information via the username parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/fuhai/jbootfly/issues/I6GDW8 - https://github.com/yangfuhai/jbootfly/issues/1
CVE ID: CVE-2023-27093 State: PUBLISHED Published: 2023-03-13T00:00:00.000Z Last Updated: 2025-02-27T21:23:32.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability found in My-Blog allows attackers to cause a denial of service via the Post function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/zhenfeng13/My-Blog/issues/I6GDTU
CVE ID: CVE-2023-27094 State: PUBLISHED Published: 2023-03-23T00:00:00.000Z Last Updated: 2025-02-26T15:18:00.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue found in OpenGoofy Hippo4j v.1.4.3 allows attackers to escalate privileges via the ThreadPoolController of the tenant Management module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/opengoofy/hippo4j/issues/1059
CVE ID: CVE-2023-27095 State: PUBLISHED Published: 2023-03-16T00:00:00.000Z Last Updated: 2025-02-26T19:03:11.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker toescalate privileges via the AddUser method of the UserController function in Tenant Management module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/opengoofy/hippo4j/issues/1061
CVE ID: CVE-2023-27096 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T15:36:41.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker to obtain sensitive information via the ConfigVerifyController function of the Tenant Management module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/opengoofy/hippo4j/issues/1060
CVE ID: CVE-2023-27098 State: PUBLISHED Published: 2024-01-09T00:00:00.000Z Last Updated: 2025-06-18T16:57:42.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link Tapo APK up to v2.12.703 uses hardcoded credentials for access to the login panel. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://tp-link.com - http://tp-lin.com - https://www.tp-link.com/support/contact-technical-support/#LiveChat-Support - https://github.com/c0d3x27/CVEs/tree/main/CVE-2023-27098
CVE ID: CVE-2023-27100 State: PUBLISHED Published: 2023-03-22T00:00:00.000Z Last Updated: 2025-02-25T21:10:13.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.netgate.com/downloads/pfSense-SA-23_05.sshguard.asc - https://redmine.pfsense.org/issues/13574 - http://packetstormsecurity.com/files/171791/pfsenseCE-2.6.0-Protection-Bypass.html
CVE ID: CVE-2023-27102 State: PUBLISHED Published: 2023-03-15T00:00:00 Last Updated: 2024-08-02T12:01:32.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: Libde265 v1.0.11 was discovered to contain a segmentation violation via the function decoder_context::process_slice_segment_header at decctx.cc. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/strukturag/libde265/issues/393 - https://lists.debian.org/debian-lts-announce/2023/11/msg00032.html
CVE ID: CVE-2023-27103 State: PUBLISHED Published: 2023-03-15T00:00:00 Last Updated: 2024-08-02T12:01:32.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: Libde265 v1.0.11 was discovered to contain a heap buffer overflow via the function derive_collocated_motion_vectors at motion.cc. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/strukturag/libde265/issues/394 - https://lists.debian.org/debian-lts-announce/2023/11/msg00032.html
CVE ID: CVE-2023-27105 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-03T18:51:56.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the Wi-Fi file transfer module of Shanling M5S Portable Music Player with Shanling MTouch OS v4.3 and Shanling M2X Portable Music Player with Shanling MTouch OS v3.3 allows attackers to arbitrarily read, delete, or modify any critical system files via directory traversal. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://en.shanling.com/ - https://hexavector.github.io/4bf46f12/
CVE ID: CVE-2023-27107 State: PUBLISHED Published: 2023-04-26T00:00:00.000Z Last Updated: 2025-02-03T17:39:46.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the runReport function of MyQ Solution Print Server before 8.2 Patch 32 and Central Server before 8.2 Patch 22 allows users who do not have appropriate access rights to generate internal reports using a direct URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/smidtbx10/f8ff1c4977b7f54886c6a52e9ef4e816
CVE ID: CVE-2023-27108 State: PUBLISHED Published: 2023-05-01T00:00:00.000Z Last Updated: 2025-01-30T16:38:43.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in KaiOS 3.0. The pre-installed Communications application exposes a Web Activity that returns the user's call log without origin or permission checks. An attacker can inject a JavaScript payload that runs in a browser or app without user interaction or consent. This allows an attacker to send the user's call logs to a remote server via XMLHttpRequest or Fetch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/Tombarr/5ed6675f33e0eca1
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/Tombarr/5ed6675f33e0eca149a8b4d38ce76dda - https://kaios.dev/cve/1409490
CVE ID: CVE-2023-27112 State: PUBLISHED Published: 2025-01-21T00:00:00.000Z Last Updated: 2025-03-13T20:33:00.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the projectCode parameter at project.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/a54552239/pearProjectApi/issues/32
CVE ID: CVE-2023-27113 State: PUBLISHED Published: 2025-01-21T00:00:00.000Z Last Updated: 2025-03-18T18:09:11.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the organizationCode parameter at project.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/a54552239/pearProjectApi/issues/31
CVE ID: CVE-2023-27114 State: PUBLISHED Published: 2023-03-10T00:00:00.000Z Last Updated: 2025-02-28T16:17:08.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: radare2 v5.8.3 was discovered to contain a segmentation fault via the component wasm_dis at p/wasm/wasm.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/radareorg/radare2/issues/21363 - https://github.com/radareorg/radare2/commit/a15067a8eaa836bcc24b0882712c14d1baa66509
CVE ID: CVE-2023-27115 State: PUBLISHED Published: 2023-03-10T00:00:00.000Z Last Updated: 2025-02-28T17:03:06.069Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::cat_compute_size. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/WebAssembly/wabt/issues/1938 - https://github.com/WebAssembly/wabt/issues/1992
CVE ID: CVE-2023-27116 State: PUBLISHED Published: 2023-03-10T00:00:00.000Z Last Updated: 2025-02-28T17:00:37.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebAssembly v1.0.29 discovered to contain an abort in CWriter::MangleType. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/WebAssembly/wabt/issues/1984 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OSFFCKXUQ5PAC5UVXY7N6HEHVQ3AC2RG/
CVE ID: CVE-2023-27117 State: PUBLISHED Published: 2023-03-10T00:00:00.000Z Last Updated: 2025-02-28T16:50:29.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebAssembly v1.0.29 was discovered to contain a heap overflow via the component component wabt::Node::operator. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/WebAssembly/wabt/issues/1989
CVE ID: CVE-2023-27119 State: PUBLISHED Published: 2023-03-10T00:00:00.000Z Last Updated: 2025-02-28T21:38:19.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/WebAssembly/wabt/issues/1990
CVE ID: CVE-2023-27121 State: PUBLISHED Published: 2023-10-04T00:00:00 Last Updated: 2024-09-20T15:03:35.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the component /framework/cron/action/humanize of Pleasant Solutions Pleasant Password Server v7.11.41.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cronString parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pleasantpasswords.com/download - https://www.nuget.org/packages/CronExpressionDescriptor/2.9.0 - https://www.mdsec.co.uk/2023/09/the-not-so-pleasant-password-manag
w.nuget.org/packages/CronExpressionDescriptor/2.9.0 - https://www.mdsec.co.uk/2023/09/the-not-so-pleasant-password-manager/
CVE ID: CVE-2023-27126 State: PUBLISHED Published: 2023-06-06T00:00:00 Last Updated: 2025-01-08T15:47:38.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused across all cameras. An attacker with physical access to a camera is able to extract and decrypt sensitive data containing the Wifi password and the TP-LINK account credential of the victim. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://tp-link.com - http://tapo.com - https://www.claranet.fr/blog/dans-les-entrailles-dune-camera-connectee-tp-link-14
CVE ID: CVE-2023-27130 State: PUBLISHED Published: 2023-03-16T00:00:00.000Z Last Updated: 2025-03-03T19:08:28.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via an arbitrarily supplied URL parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/typecho/typecho/issues/1535 - https://github.com/typecho/typecho/commit/f9ede542c9052ba22a6096d8412e2f02d9de872b
CVE ID: CVE-2023-27131 State: PUBLISHED Published: 2023-03-16T00:00:00.000Z Last Updated: 2025-02-26T15:37:37.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code viathe Post Editorparameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/typecho/typecho/issues/1536
CVE ID: CVE-2023-27132 State: PUBLISHED Published: 2023-10-17T00:00:00 Last Updated: 2024-09-16T15:31:39.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: TSplus Remote Work 16.0.0.0 places a cleartext password on the "var pass" line of the HTML source code for the secure single sign-on web portal. NOTE: CVE-2023-31069 is only about the TSplus Remote Access product, not the TSplus Remote Work product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://packetstormsecurity.com/files/174271
CVE ID: CVE-2023-27133 State: PUBLISHED Published: 2023-10-17T00:00:00 Last Updated: 2024-09-16T15:24:11.002Z Vendors: n/a Products: n/a Problem Types: n/a Description: TSplus Remote Work 16.0.0.0 has weak permissions for .exe, .js, and .html files under the %PROGRAMFILES(X86)%\TSplus-RemoteWork\Clients\www folder. This may enable privilege escalation if a different local user modifies a file. NOTE: CVE-2023-31067 and CVE-2023-31068 are only about the TSplus Remote Access product, not the TSplus Remote Work product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://packetstormsecurity.com/files/174272
CVE ID: CVE-2023-27135 State: PUBLISHED Published: 2023-03-23T00:00:00.000Z Last Updated: 2025-02-25T18:36:26.711Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the enabled parameter at /setting/setWanIeCfg. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Am1ngl/ttt/tree/main/29
CVE ID: CVE-2023-27148 State: PUBLISHED Published: 2023-10-23T00:00:00 Last Updated: 2024-09-11T20:04:38.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Admin panel in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Role Name parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esecforte.com/cve-2023-27148-osticket_xss/
CVE ID: CVE-2023-27149 State: PUBLISHED Published: 2023-10-23T00:00:00 Last Updated: 2024-09-11T20:03:23.912Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Label input parameter when updating a custom list. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esecforte.com/cve-2023-27149-osticket_xss/
CVE ID: CVE-2023-27150 State: PUBLISHED Published: 2023-12-26T00:00:00 Last Updated: 2024-08-27T20:01:19.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.opencrx.org/ - https://www.esecforte.com/cve-2023-27150-cross-site-scripting-xss/
CVE ID: CVE-2023-27151 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-23T18:25:21.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number (in the Saved Search Activity) via the Name, Description, or Activity Number field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.opencrx.org/ - https://www.esecforte.com/cve-2023-27151-html-injection-activity-tracker/
CVE ID: CVE-2023-27152 State: PUBLISHED Published: 2023-10-23T00:00:00 Last Updated: 2024-09-11T20:01:03.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack to bypass authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esecforte.com/cve-2023-27152-opnsense-brute-force/
CVE ID: CVE-2023-27159 State: PUBLISHED Published: 2023-03-31T00:00:00.000Z Last Updated: 2025-02-18T15:09:58.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://appwrite.com - https://github.com/appwrite/appwrite - https://notes.sjtu.edu.cn/gMNlpByZSDiwrl9uZyHTKA - https://gist.github.com/b33t1e/e9e8192317c111e7897e04d2f9bf5fdb - https://gist.gith
sjtu.edu.cn/gMNlpByZSDiwrl9uZyHTKA - https://gist.github.com/b33t1e/e9e8192317c111e7897e04d2f9bf5fdb - https://gist.github.com/b33t1e/43b26c31e895baf7e7aea2dbf9743a9a
CVE ID: CVE-2023-27160 State: PUBLISHED Published: 2023-03-31T00:00:00.000Z Last Updated: 2025-02-18T16:10:41.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: forem up to v2022.11.11 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /articles/{id}. This vulnerability allows attackers to access network resources and sensitive information via a crafted POST request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://forem.com - https://github.com/forem/forem - https://notes.sjtu.edu.cn/s/MUUhEymt7 - https://gist.github.com/b33t1e/6172286862a4486b5888f3cbbdc6316d