Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-4489 State: PUBLISHED Published: 2023-12-14T23:00:29.693Z Last Updated: 2025-05-21T14:29:37.355Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: silabs.com Products: Z/IP Gateway SDK Problem Types: CWE-1279 Description: The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP Gateway SDK v7.18.3 and earlier. This makes the first S0 key generated at startup predictable, potentially allowing network key prediction and unauthorized S0 network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://siliconlabs.lightning.force.com/sfc/s
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000buWj0QAE?operationContext=S1 - https://github.com/SiliconLabs/gecko_sdk
CVE ID: CVE-2023-4490 State: PUBLISHED Published: 2023-09-25T15:56:52.472Z Last Updated: 2025-04-23T16:16:01.115Z Vendors: Unknown Products: WP Job Portal Problem Types: CWE-89 SQL Injection Description: The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/986024f0-3c8d-44d8-a9c9-1dd284d7db0d
CVE ID: CVE-2023-4491 State: PUBLISHED Published: 2023-10-04T12:17:20.208Z Last Updated: 2024-09-05T18:11:41.806Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: EFS Software Products: Easy Address Book Web Server Problem Types: CWE-119 Description: Buffer overflow vulnerability in Easy Address Book Web Server 1.6 version. The exploitation of this vulnerability could allow an attacker to send a very long username string to /searchbook.ghp, asking for the name via a POST request, resulting in arbitrary code execution on the remote machine. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/inci
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products
CVE ID: CVE-2023-4492 State: PUBLISHED Published: 2023-10-04T12:19:44.181Z Last Updated: 2024-09-05T18:10:37.307Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: EFS Software Products: Easy Address Book Web Server Problem Types: CWE-79 Description: Vulnerability in Easy Address Book Web Server 1.6 version, affecting the parameters (firstname, homephone, lastname, middlename, workaddress, workcity, workcountry, workphone, workstate and workzip) of the /addrbook.ghp file, allowing an attacker to inject a JavaScript payload specially designed to run when the application is loaded Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
to run when the application is loaded Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products
CVE ID: CVE-2023-4493 State: PUBLISHED Published: 2023-10-04T12:24:02.393Z Last Updated: 2024-09-05T18:10:09.264Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: EFS Software Products: Easy Address Book Web Server Problem Types: CWE-79 Description: Stored Cross-Site Scripting in Easy Address Book Web Server 1.6 version, through the users_admin.ghp file that affects multiple parameters such as (firstname, homephone, lastname, lastname, middlename, workaddress, workcity, workcountry, workphone, workstate, workzip). This vulnerability allows a remote attacker to store a malicious JavaScript payload in the application to be executed when the page is loaded, resu
remote attacker to store a malicious JavaScript payload in the application to be executed when the page is loaded, resulting in an integrity impact. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products
CVE ID: CVE-2023-4494 State: PUBLISHED Published: 2023-10-04T12:27:04.981Z Last Updated: 2024-09-05T18:09:39.518Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: EFS Software Products: Easy Chat Server Problem Types: CWE-119 Description: Stack-based buffer overflow vulnerability in Easy Chat Server 3.1 version. An attacker could send an excessively long username string to the register.ghp file asking for the name via a GET request resulting in arbitrary code execution on the remote machine. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ef
r: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products
CVE ID: CVE-2023-4495 State: PUBLISHED Published: 2023-10-04T12:29:05.391Z Last Updated: 2024-09-05T18:08:28.155Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: EFS Software Products: Easy Chat Server Problem Types: CWE-79 Description: Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /registresult.htm (POST method), in the Resume parameter. The XSS is loaded from /register.ghp. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabiliti
tainer: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products
CVE ID: CVE-2023-4496 State: PUBLISHED Published: 2023-10-04T12:32:02.370Z Last Updated: 2024-09-05T18:08:06.699Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: EFS Software Products: Easy Chat Server Problem Types: CWE-79 Description: Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /body2.ghp (POST method), in the mtowho parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products
CVE ID: CVE-2023-4497 State: PUBLISHED Published: 2023-10-04T12:32:29.597Z Last Updated: 2024-09-05T18:07:41.348Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: EFS Software Products: Easy Chat Server Problem Types: CWE-79 Description: Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /registresult.htm (POST method), in the Icon parameter. The XSS is loaded from /users.ghp. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ef
CVE ID: CVE-2023-4498 State: PUBLISHED Published: 2023-09-06T16:13:06.168Z Last Updated: 2025-11-04T19:25:24.928Z Vendors: Tenda Products: N300 Wireless N VDSL2 Modem Router Problem Types: CWE-305: Authentication Bypass by Primary Weakness Description: Tenda N300 Wireless N VDSL2 Modem Router allows unauthenticated access to pages that in turn should be accessible to authenticated users only Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.cert.org/vuls/id/304455
CVE ID: CVE-2023-4499 State: PUBLISHED Published: 2023-10-13T16:24:29.582Z Last Updated: 2024-09-17T20:08:58.168Z Vendors: HP Inc. Products: HP ThinUpdate Description: A potential security vulnerability has been identified in the HP ThinUpdate utility (also known as HP Recovery Image and Software Download Tool) which may lead to information disclosure. HP is releasing mitigation for the potential vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_9440593-9440618-16
CVE ID: CVE-2023-4500 State: PUBLISHED Published: 2023-08-31T05:33:12.214Z Last Updated: 2025-02-05T19:32:25.986Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: rustaurius Products: Order Tracking – WordPress Status Tracking Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the order status parameter in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers (admin or higher) to inject arbitrary web
ation and output escaping. This makes it possible for authenticated attackers (admin or higher) to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/81f9a4c6-971f-4f6d-8bb1-e97bf75cf8d3?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2959453%40order-tracking%2Ftrunk&old=2949611%40order-tracking%2Ftrunk&sfp_ema
ngeset?sfp_email=&sfph_mail=&reponame=&new=2959453%40order-tracking%2Ftrunk&old=2949611%40order-tracking%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-4501 State: PUBLISHED Published: 2023-09-12T18:05:56.684Z Last Updated: 2024-09-26T14:08:41.901Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenText Products: Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server Problem Types: CWE-287, CWE-305, CWE-358, CWE-253 Description: User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates 19 and 20, 8.0 patch updates 8 and 9, and 9.0 patch update 1, when LDAP-based authentication
versions 7.0 patch updates 19 and 20, 8.0 patch updates 8 and 9, and 9.0 patch update 1, when LDAP-based authentication is used with certain configurations. When the vulnerability is active, authentication succeeds with any valid username, regardless of whether the password is correct; it may also succeed with an invalid username (and any password). This allows an attacker with access to the product to impersonate any user. Mitigations: The issue is corrected in the upcoming patch update for each affected product. Product overlays and workaround instructions are available through OpenText Support. The vulnerable configurations are believed to be uncommon. Administrators can test for the vul
through OpenText Support. The vulnerable configurations are believed to be uncommon. Administrators can test for the vulnerability in their installations by attempting to sign on to a Visual COBOL or Enterprise Server component such as ESCWA using a valid username and incorrect password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000021287
CVE ID: CVE-2023-4502 State: PUBLISHED Published: 2023-09-25T15:56:55.147Z Last Updated: 2025-05-02T16:52:03.433Z Vendors: Unknown Products: Translate WordPress with GTranslate Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). This vulnerability affects multiple parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpsca
iple parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e4804850-2ac2-4cec-bc27-07ed191d96da
CVE ID: CVE-2023-4503 State: PUBLISHED Published: 2024-02-06T08:39:01.685Z Last Updated: 2024-08-02T07:31:06.073Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: EAP 7.4.14, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9, Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7, Red Hat JBoss Enterprise Application Platform Expansion Pack Problem Types: CWE-665 Description: An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attack
g Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:7637 - https://access.redhat.com/errata/RHSA-2023:7638 - https://access.redhat.com/errata/RHSA-2023:7639 - https://access.redhat.com/errata/RHSA-2023:7641 - https://access.redhat.com/security/cve/CVE-2023-4503 - https://bugzilla.redhat.com/show_bug.cgi?id=2184751
CVE ID: CVE-2023-4504 State: PUBLISHED Published: 2023-09-21T22:47:41.879Z Last Updated: 2025-11-04T16:10:38.138Z Vendors: OpenPrinting Products: CUPS, libppd Problem Types: CWE-122 Description: Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://takeonme.org/cves/CVE-2023-4504.html - https://github.com/OpenPrinting/libppd/security/advisories/GHSA-4f65-6ph5-qwh6 - https://github.co
/CVE-2023-4504.html - https://github.com/OpenPrinting/libppd/security/advisories/GHSA-4f65-6ph5-qwh6 - https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h - https://github.com/OpenPrinting/cups/releases/tag/v2.4.7 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AMYDKIE4PSJDEMC5OWNFCDMHFGLJ57XG/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WVS4I7JG3LISFPKTM6ADKJXXEPEEWBQ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WHEJIYMMAIXU2EC35MGTB5LGGO2FFJE/ - https://lists.fedoraproject.org/archives/list/package-announce@lis
oject.org/message/5WHEJIYMMAIXU2EC35MGTB5LGGO2FFJE/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2GSPQAFK2Z6L57TRXEKZDF42K2EVBH7/ - https://lists.debian.org/debian-lts-announce/2023/09/msg00041.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXPVADB56NMLJWG4IZ3OZBNJ2ZOLPQJ6/
CVE ID: CVE-2023-4505 State: PUBLISHED Published: 2023-09-26T01:51:13.836Z Last Updated: 2025-02-05T19:19:01.832Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: cyberlord92 Products: Staff / Employee Business Directory for Active Directory Problem Types: CWE-306 Missing Authentication for Critical Function Description: The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 1.2.3. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access and above, to change the LDAP server and ret
s makes it possible for authenticated attackers, with administrative access and above, to change the LDAP server and retrieve the credentials for the original LDAP server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1ea40b96-4693-4f98-8e6e-2ed8186cedd8?source=cve - https://wordpress.org/plugins/ldap-ad-staff-employee-directory-search/ - https://medium.com/%40cybertrinchera/cve-2023-4506-cve-2023-4505-ldap-passback-on-miniorange-plugins-ca7328c84313
CVE ID: CVE-2023-4506 State: PUBLISHED Published: 2023-09-26T01:51:13.277Z Last Updated: 2025-02-05T19:19:10.246Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: cyberlord92 Products: Active Directory Integration / LDAP Integration Problem Types: CWE-306 Missing Authentication for Critical Function Description: The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4.1.10. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access and above, to change the LDAP server and retrieve the credent
le for authenticated attackers, with administrative access and above, to change the LDAP server and retrieve the credentials for the original LDAP server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0585969d-dd08-4058-9d72-138a55a2cdf1?source=cve - https://wordpress.org/plugins/ldap-login-for-intranet-sites/ - https://medium.com/%40cybertrinchera/cve-2023-4506-cve-2023-4505-ldap-passback-on-miniorange-plugins-ca7328c84313
CVE ID: CVE-2023-4507 State: PUBLISHED Published: 2024-08-17T07:34:22.442Z Last Updated: 2024-08-19T16:54:28.112Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: zvijerka Products: Admission AppManager Problem Types: CWE-79 Description: The Admission AppManager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'q' parameter in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Ana
that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/55367b9b-8ae1-4282-bf9f-8fb3848eb579?source=cve - https://plugins.trac.wordpress.org/browser/admission-appmanager/trunk/admin/class-admission-app-manager-admin.php#L843
CVE ID: CVE-2023-4508 State: PUBLISHED Published: 2023-08-24T22:51:47.669Z Last Updated: 2024-08-02T07:31:05.854Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Gerbv Products: gerbv Problem Types: CWE-824 Description: A user able to control file input to Gerbv, between versions 2.4.0 and 2.10.0, can cause a crash and cause denial-of-service with a specially crafted Gerber RS-274X file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gerbv/gerbv/issues/191 - https://github.com/gerbv/gerbv/commit/5517e22250e935dc7f86f64ad414aeae3dbcb36a - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4508
CVE ID: CVE-2023-4509 State: PUBLISHED Published: 2024-04-17T23:10:37.111Z Last Updated: 2024-11-07T16:55:13.840Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Octopus Deploy Products: Octopus Server Problem Types: API key disclosed in Octopus Server audit log Description: It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.octopus.com/post/2024/sa2024-02/
CVE ID: CVE-2023-4511 State: PUBLISHED Published: 2023-08-24T06:30:40.729Z Last Updated: 2025-11-03T21:49:48.634Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Wireshark Foundation Products: Wireshark Problem Types: CWE-835 Description: BT SDP dissector infinite loop in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2023-24.html - https://gitlab.com/wireshark/wireshark/-/issues/19258
CVE ID: CVE-2023-4512 State: PUBLISHED Published: 2023-08-24T06:30:45.722Z Last Updated: 2025-11-03T21:49:50.136Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Wireshark Foundation Products: Wireshark Problem Types: CWE-674 Description: CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wireshark.org/security/wnpa-sec-2023-23.html - https://gitlab.com/wireshark/wireshark/-/issues/19144
CVE ID: CVE-2023-4513 State: PUBLISHED Published: 2023-08-24T06:30:50.727Z Last Updated: 2025-11-03T21:49:51.600Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Wireshark Foundation Products: Wireshark Problem Types: CWE-401 Description: BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2023-25.html - https://gitlab.com/wireshark/wireshark/-/issues/19259
CVE ID: CVE-2023-4514 State: PUBLISHED Published: 2023-11-27T16:22:04.350Z Last Updated: 2024-08-02T07:31:05.536Z Vendors: Unknown Products: Mmm Simple File List Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Mmm Simple File List WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/365b15e6-3755-4ed5-badd-c9dd962bd9fa
CVE ID: CVE-2023-4515 State: PUBLISHED Published: 2025-08-16T13:25:50.562Z Last Updated: 2025-08-16T13:25:50.562Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate command request size In commit 2b9b8f3b68ed ("ksmbd: validate command payload size"), except for SMB2_OPLOCK_BREAK_HE command, the request size of other commands is not checked, it's not expected. Fix it by add check for request size of other commands. References: - https://git.kernel.org/stable/c/595679098bdcdbfbba91ebe07a2f7f208df93870 - https://git.kernel.org/stable/c/c6bef3bc30fd4a175aef846b7d928a6c40d091cd - https://git.kernel.org/stable/c/ff7236b66
0 - https://git.kernel.org/stable/c/c6bef3bc30fd4a175aef846b7d928a6c40d091cd - https://git.kernel.org/stable/c/ff7236b66d69582f90cf5616e63cfc3dc18142bb - https://git.kernel.org/stable/c/5aa4fda5aa9c2a5a7bac67b4a12b089ab81fee3c