Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/artifacthub/hub/security/advisories/GHSA-hmq4-c2r4-5q8h - https://artifacthub.io/packages/helm/artifact-hub/artifact-hub?modal=changelog&version=1.16.0
CVE ID: CVE-2023-45824 State: PUBLISHED Published: 2024-03-25T18:15:32.850Z Last Updated: 2024-08-22T17:57:06.788Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: oroinc Products: platform Problem Types: CWE-200 Description: OroPlatform is a PHP Business Application Platform (BAP). A logged in user can access page state data of pinned pages of other users by pageId hash. This vulnerability is fixed in 5.1.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/oroinc/platform/security/advisories/GHSA-vxq2-p937-3px3 - https://github.com/oroinc/platform/commit/cf94df7595afca052796e26b299d2ce031e289cd
CVE ID: CVE-2023-45825 State: PUBLISHED Published: 2023-10-19T18:22:31.034Z Last Updated: 2024-09-12T17:52:08.400Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: ydb-platform Products: ydb-go-sdk Problem Types: CWE-532 Description: ydb-go-sdk is a pure Go native and database/sql driver for the YDB platform. Since ydb-go-sdk v3.48.6 if you use a custom credentials object (implementation of interface Credentials it may leak into logs. This happens because this object could be serialized into an error message using `fmt.Errorf("something went wrong (credentials: %q)", credentials)` during connection to the YDB server. If such logging occurred, a malicious user
wrong (credentials: %q)", credentials)` during connection to the YDB server. If such logging occurred, a malicious user with access to logs could read sensitive information (i.e. credentials) information and use it to get access to the database. ydb-go-sdk contains this problem in versions from v3.48.6 to v3.53.2. The fix for this problem has been released in version v3.53.3. Users are advised to upgrade. Users unable to upgrade should implement the `fmt.Stringer` interface in your custom credentials type with explicit stringify of object state. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ydb-platform/ydb-go-sdk/security/advis
CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ydb-platform/ydb-go-sdk/security/advisories/GHSA-q24m-6h38-5xj8 - https://github.com/ydb-platform/ydb-go-sdk/pull/859 - https://github.com/ydb-platform/ydb-go-sdk/blob/master/credentials/credentials.go#L10 - https://github.com/ydb-platform/ydb-go-sdk/blob/v3.48.6/internal/balancer/balancer.go#L71
CVE ID: CVE-2023-45826 State: PUBLISHED Published: 2023-10-19T18:28:54.167Z Last Updated: 2024-09-12T17:51:49.888Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Leantime Products: leantime Problem Types: CWE-89 Description: Leantime is an open source project management system. A 'userId' variable in `app/domain/files/repositories/class.files.php` is not parameterized. An authenticated attacker can send a carefully crafted POST request to `/api/jsonrpc` to exploit an SQL injection vulnerability. Confidentiality is impacted as it allows for dumping information from the database. This issue has been addressed in version 2.4-beta-4. Users are advised to upgrad
dumping information from the database. This issue has been addressed in version 2.4-beta-4. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Leantime/leantime/security/advisories/GHSA-559g-3h98-g3fj - https://github.com/Leantime/leantime/commit/be75f1e0f311d11c00a0bdc7079a62eef3594bf0
CVE ID: CVE-2023-45827 State: PUBLISHED Published: 2023-11-06T17:25:43.774Z Last Updated: 2024-09-04T18:54:55.435Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: clickbar Products: dot-diver Problem Types: CWE-1321 Description: Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` function which can leads to remote code execution (RCE). This issue has been addressed in commit `98daf567` which has been included in release 1.0.2. Users are advised to upgrade. There
e has been addressed in commit `98daf567` which has been included in release 1.0.2. Users are advised to upgrade. There are no known workarounds to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/clickbar/dot-diver/security/advisories/GHSA-9w5f-mw3p-pj47 - https://github.com/clickbar/dot-diver/commit/98daf567390d816fd378ec998eefe2e97f293d5a
CVE ID: CVE-2023-45828 State: PUBLISHED Published: 2025-01-02T11:59:56.028Z Last Updated: 2025-01-03T19:10:30.102Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: RumbleTalk Ltd Products: RumbleTalk Live Group Chat Problem Types: CWE-862 Description: Missing Authorization vulnerability in RumbleTalk Ltd RumbleTalk Live Group Chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RumbleTalk Live Group Chat: from n/a through 6.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/rumbletalk-chat-a-chat-with-themes/vulnerability/wordpress-rumbletalk-live-gr
//patchstack.com/database/wordpress/plugin/rumbletalk-chat-a-chat-with-themes/vulnerability/wordpress-rumbletalk-live-group-chat-plugin-6-1-9-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-45829 State: PUBLISHED Published: 2023-10-24T12:24:08.080Z Last Updated: 2024-08-02T20:29:32.498Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: HappyBox Products: Newsletter & Bulk Email Sender – Email Newsletter Plugin for WordPress Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in HappyBox Newsletter & Bulk Email Sender – Email Newsletter Plugin for WordPress plugin <= 2.0.1 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/newsletter-bulk-email/wordpress-newsletter-bulk-email-sender-plugin-2-0-1-cross-site-scri
ack.com/database/vulnerability/newsletter-bulk-email/wordpress-newsletter-bulk-email-sender-plugin-2-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-45830 State: PUBLISHED Published: 2023-11-06T08:57:32.818Z Last Updated: 2024-08-02T20:29:32.489Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: Online ADA Products: Accessibility Suite by Online ADA Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Online ADA Accessibility Suite by Online ADA allows SQL Injection.This issue affects Accessibility Suite by Online ADA: from n/a through 4.12. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/online-accessibility/wordpress-acc
- CVE Program Container: References: - https://patchstack.com/database/vulnerability/online-accessibility/wordpress-accessibility-suite-by-online-ada-plugin-4-11-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-45831 State: PUBLISHED Published: 2023-10-16T10:23:05.292Z Last Updated: 2025-02-19T21:21:00.614Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Pixelative, Mohsin Rafique Products: AMP WP – Google AMP For WordPress Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Pixelative, Mohsin Rafique AMP WP – Google AMP For WordPress plugin <= 1.5.15 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/amp-wp/wordpress-amp-wp-google-amp-for-wordpress-plugin-1-5-15-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45832 State: PUBLISHED Published: 2023-10-24T12:12:07.040Z Last Updated: 2025-02-19T21:20:14.329Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Martin Gibson Products: WP GoToWebinar Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Martin Gibson WP GoToWebinar plugin <= 14.45 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-gotowebinar/wordpress-wp-gotowebinar-plugin-14-45-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-45833 State: PUBLISHED Published: 2023-10-24T12:28:22.227Z Last Updated: 2024-09-09T21:00:41.721Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: LeadSquared, Inc Products: LeadSquared Suite Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in LeadSquared Suite plugin <= 0.7.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/leadsquared-suite/wordpress-leadsquared-suite-plugin-0-7-4-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-45834 State: PUBLISHED Published: 2023-11-30T14:40:42.151Z Last Updated: 2024-08-02T20:29:32.309Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Libsyn Products: Libsyn Publisher Hub Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Libsyn Libsyn Publisher Hub.This issue affects Libsyn Publisher Hub: from n/a through 1.4.4. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/libsyn-podcasting/wordpress-libsyn-publisher-hub-plugin-1-4-4-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2023-45835 State: PUBLISHED Published: 2023-10-24T12:44:41.142Z Last Updated: 2024-11-20T21:12:21.978Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Libsyn Products: Libsyn Publisher Hub Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Libsyn Libsyn Publisher Hub plugin <= 1.4.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/libsyn-podcasting/wordpress-libsyn-publisher-hub-plugin-1-4-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-45836 State: PUBLISHED Published: 2023-10-16T10:25:31.935Z Last Updated: 2024-09-13T19:39:18.354Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: XYDAC Products: Ultimate Taxonomy Manager Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in XYDAC Ultimate Taxonomy Manager plugin <= 2.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ultimate-taxonomy-manager/wordpress-ultimate-taxonomy-manager-plugin-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45837 State: PUBLISHED Published: 2023-10-24T12:49:10.570Z Last Updated: 2024-09-09T14:43:52.673Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: XYDAC Products: Ultimate Taxonomy Manager Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in XYDAC Ultimate Taxonomy Manager plugin <= 2.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ultimate-taxonomy-manager/wordpress-ultimate-taxonomy-manager-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-45838 State: PUBLISHED Published: 2023-12-05T11:30:10.671Z Last Updated: 2025-11-04T19:25:26.131Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Buildroot Products: Buildroot Problem Types: CWE-494 Description: Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the `aufs` package. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1844 - h
st Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1844 - http://www.openwall.com/lists/oss-security/2023/12/11/1
CVE ID: CVE-2023-45839 State: PUBLISHED Published: 2023-12-05T11:30:10.770Z Last Updated: 2025-11-04T19:25:27.249Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Buildroot Products: Buildroot Problem Types: CWE-494 Description: Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the `aufs-util` package. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-184
Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1844 - http://www.openwall.com/lists/oss-security/2023/12/11/1
CVE ID: CVE-2023-45840 State: PUBLISHED Published: 2023-12-05T11:30:10.883Z Last Updated: 2025-11-04T19:25:28.325Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Buildroot Products: Buildroot Problem Types: CWE-494 Description: Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the `riscv64-elf-toolchain` package. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TA
Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1844 - http://www.openwall.com/lists/oss-security/2023/12/11/1
CVE ID: CVE-2023-45841 State: PUBLISHED Published: 2023-12-05T11:30:10.990Z Last Updated: 2025-11-04T19:25:29.398Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Buildroot Products: Buildroot Problem Types: CWE-494 Description: Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the `versal-firmware` package. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-20
ional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1844 - http://www.openwall.com/lists/oss-security/2023/12/11/1
CVE ID: CVE-2023-45842 State: PUBLISHED Published: 2023-12-05T11:30:11.082Z Last Updated: 2025-11-04T19:25:30.483Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Buildroot Products: Buildroot Problem Types: CWE-494 Description: Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the `mxsldr` package. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1844 -
lyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1844 - http://www.openwall.com/lists/oss-security/2023/12/11/1
CVE ID: CVE-2023-45844 State: PUBLISHED Published: 2023-10-25T13:07:15.053Z Last Updated: 2024-09-10T20:24:25.472Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Rexroth Products: ctrlX HMI Web Panel - WR21 (WR2107), ctrlX HMI Web Panel - WR21 (WR2110), ctrlX HMI Web Panel - WR21 (WR2115) Problem Types: CWE-284 Description: The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverage it to have access to critical device settings such as the device power management or eventually the device secure settings (ADB debug). Additional Analyst Notes: - CVE Program Cont
vice power management or eventually the device secure settings (ADB debug). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html
CVE ID: CVE-2023-45845 State: PUBLISHED Published: 2024-05-16T20:47:16.217Z Last Updated: 2024-08-02T20:29:32.376Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) Wireless Bluetooth(R) products for Windows Problem Types: denial of service, CWE-92 Description: Improper conditions check for some Intel(R) Wireless Bluetooth(R) products for Windows before version 23.20 may allow a privileged user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01039.html
CVE ID: CVE-2023-45846 State: PUBLISHED Published: 2024-05-16T20:47:22.273Z Last Updated: 2024-08-02T20:29:32.524Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) Power Gadget software for macOS Problem Types: denial of service, CWE-459 Description: Incomplete cleanup in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01037.html
CVE ID: CVE-2023-45847 State: PUBLISHED Published: 2023-12-12T08:17:10.088Z Last Updated: 2024-12-02T16:58:14.026Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-400 Description: Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to send a specially crafted request and crash the Playbooks plugin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-45849 State: PUBLISHED Published: 2023-11-08T15:40:29.648Z Last Updated: 2024-08-02T20:29:32.575Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Helix Products: Helix Core Problem Types: CWE-94 Description: An arbitrary code execution which results in privilege escalation was discovered in Helix Core versions prior to 2023.2. Reported by Jason Geffner. Additional Analyst Notes: - CVE Program Container: References: - https://perforce.com
CVE ID: CVE-2023-45850 State: REJECTED Published: N/A Last Updated: 2025-02-13T17:14:14.942Z Description: No description available.
CVE ID: CVE-2023-45851 State: PUBLISHED Published: 2023-10-25T14:18:08.811Z Last Updated: 2024-09-11T18:06:40.524Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Bosch Rexroth AG Products: ctrlX HMI Web Panel - WR21 (WR2107), ctrlX HMI Web Panel - WR21 (WR2110), ctrlX HMI Web Panel - WR21 (WR2115) Problem Types: CWE-306 Description: The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication. This issue allows an attacker to force the Android Client application to connect to a malicious MQTT broker, enabling it to send fake messages to the HMI device Additional Analyst Notes: - CVE
connect to a malicious MQTT broker, enabling it to send fake messages to the HMI device Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html
CVE ID: CVE-2023-45852 State: PUBLISHED Published: 2023-10-14T00:00:00 Last Updated: 2024-09-17T13:47:53.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://connectivity.viessmann.com/gb/mp-fp/vitogate/vitogate-300-bn-mb.html - https://github.com/Push3AX/vul/blob/main/viessmann/Vitogate300_RCE.md
CVE ID: CVE-2023-45853 State: PUBLISHED Published: 2023-10-14T00:00:00 Last Updated: 2024-08-02T20:29:32.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/madler/zlib/pull/843 - https://www.wi
- CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/madler/zlib/pull/843 - https://www.winimage.com/zLibDll/minizip.html - https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib#L1-L4 - https://chromium.googlesource.com/chromium/src/+/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61 - https://chromium.googlesource.com/chromium/src/+/d709fb23806858847131027da95ef4c548813356 - http://www.openwall.com/lists/oss-security/2023/10/20/9 - https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html - https://security.netapp.com/advisory/ntap-20231130-0009/ - https://pypi.org/project/pyminizip/#history - https://security.gento
/security.netapp.com/advisory/ntap-20231130-0009/ - https://pypi.org/project/pyminizip/#history - https://security.gentoo.org/glsa/202401-18 - http://www.openwall.com/lists/oss-security/2024/01/24/10
CVE ID: CVE-2023-45854 State: PUBLISHED Published: 2024-09-16T00:00:00 Last Updated: 2024-09-17T20:24:11.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Business Logic vulnerability in Shopkit 1.0 allows an attacker to add products with negative quantities to the shopping cart via the qtd parameter in the add-to-cart function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://shopk.it/ - https://kafka-esc.com/posts/2024/09/cve-2023-45854-interger-overflow-in-shopkit-1.0/
CVE ID: CVE-2023-45855 State: PUBLISHED Published: 2023-10-14T00:00:00 Last Updated: 2024-09-17T13:39:04.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/SunshineOtaku/Report-CVE/blob/main/qdPM/9.2/Directory%20Traversal.md - https://qdpm.net