Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ed in version 1.0.3. users are advised to upgrade. Users unable to upgrade should ensure that all input passed to find-exec comes from a trusted source. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shime/find-exec/security/advisories/GHSA-95rp-6gqp-6622 - https://github.com/shime/find-exec/commit/74fb108097c229b03d6dba4cce81e36aa364b51c
CVE ID: CVE-2023-40583 State: PUBLISHED Published: 2023-08-25T20:25:28.297Z Last Updated: 2024-10-02T14:45:16.702Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: libp2p Products: go-libp2p Problem Types: CWE-400 Description: libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use. In go-libp2p, by using signed peer records a malicious actor can store an arbitrary amount of data in a remote node’s memory. This memory does not get garbage collected and so the victim can run out of memory and crash. If users of go-libp2p in production are not monitoring memory consumption over time, it could be
t of memory and crash. If users of go-libp2p in production are not monitoring memory consumption over time, it could be a silent attack i.e. the attacker could bring down nodes over a period of time (how long depends on the node resources i.e. a go-libp2p node on a virtual server with 4 gb of memory takes about 90 sec to bring down; on a larger server, it might take a bit longer.) This issue was patched in version 0.27.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libp2p/go-libp2p/security/advisories/GHSA-gcq9-qqwx-rgj3 - https://github.com/libp2p/go-libp2p/commit/45d3c6fff662ddd6938982e7e9309ad5fa2ad8dd - https://github.com/l
9-qqwx-rgj3 - https://github.com/libp2p/go-libp2p/commit/45d3c6fff662ddd6938982e7e9309ad5fa2ad8dd - https://github.com/libp2p/go-libp2p/releases/tag/v0.27.4 - https://github.com/libp2p/go-libp2p/releases/tag/v0.27.7
CVE ID: CVE-2023-40584 State: PUBLISHED Published: 2023-09-07T22:14:58.573Z Last Updated: 2024-09-26T14:05:55.634Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: argoproj Products: argo-cd Problem Types: CWE-400 Description: Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating the size of its inner files. As a result, a malicious, low-privileged user can send a malicious tar.gz file that exploits this vulnerability t
files. As a result, a malicious, low-privileged user can send a malicious tar.gz file that exploits this vulnerability to the repo-server, thereby harming the system's functionality and availability. Additionally, the repo-server is susceptible to another vulnerability due to the fact that it does not check the extracted file permissions before attempting to delete them. Consequently, an attacker can craft a malicious tar.gz archive in a way that prevents the deletion of its inner files when the manifest generation process is completed. A patch for this vulnerability has been released in versions 2.6.15, 2.7.14, and 2.8.3. Users are advised to upgrade. The only way to completely resolve the
en released in versions 2.6.15, 2.7.14, and 2.8.3. Users are advised to upgrade. The only way to completely resolve the issue is to upgrade, however users unable to upgrade should configure RBAC (Role-Based Access Control) and provide access for configuring applications only to a limited number of administrators. These administrators should utilize trusted and verified Helm charts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd/security/advisories/GHSA-g687-f2gx-6wm8 - https://github.com/argoproj/argo-cd/commit/b8f92c4ff226346624f43de3f25d81dac6386674
CVE ID: CVE-2023-40585 State: PUBLISHED Published: 2023-08-25T20:31:50.639Z Last Updated: 2024-10-02T14:43:47.455Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: metal3-io Products: ironic-image Problem Types: CWE-306 Description: ironic-image is a container image to run OpenStack Ironic as part of Metal³. Prior to version capm3-v1.4.3, if Ironic is not deployed with TLS and it does not have API and Conductor split into separate services, access to the API is not protected by any authentication. Ironic API is also listening in host network. In case the node is not behind a firewall, the API could be accessed by anyone via network without authentication. By de
In case the node is not behind a firewall, the API could be accessed by anyone via network without authentication. By default, Ironic API in Metal3 is protected by TLS and basic authentication, so this vulnerability requires operator to configure API without TLS for it to be vulnerable. TLS and authentication however should not be coupled as they are in versions prior to capm3-v1.4.3. A patch exists in versions capm3-v1.4.3 and newer. Some workarounds are available. Either configure TLS for Ironic API (`deploy.sh -t ...`, `IRONIC_TLS_SETUP=true`) or split Ironic API and Conductor via configuration change (old implementation, not recommended). With both workarounds, services are configured wi
ductor via configuration change (old implementation, not recommended). With both workarounds, services are configured with httpd front-end, which has proper authentication configuration in place. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/metal3-io/ironic-image/security/advisories/GHSA-jwpr-9fwh-m4g7 - https://github.com/metal3-io/ironic-image/commit/f64bb6ce0945bbfb30d9965f98149ea183311de9
CVE ID: CVE-2023-40586 State: PUBLISHED Published: 2023-08-25T20:35:27.459Z Last Updated: 2024-10-02T14:41:35.285Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: corazawaf Products: coraza Problem Types: CWE-400 Description: OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of `log.Fatalf`, the application using coraza crashed after receiving crafted requests from attackers. The application will immediately crash after receiving a malicious request that triggers an error in `mime.ParseMediaType`. This issue was patched in version 3.0.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
iaType`. This issue was patched in version 3.0.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/corazawaf/coraza/security/advisories/GHSA-c2pj-v37r-2p6h - https://github.com/corazawaf/coraza/commit/a5239ba3ce839e14d9b4f9486e1b4a403dcade8c
CVE ID: CVE-2023-40587 State: PUBLISHED Published: 2023-08-25T20:46:35.688Z Last Updated: 2025-02-13T17:08:35.421Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Pylons Products: pyramid Problem Types: CWE-22 Description: Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a `index.html` file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be disclosed accidentally is `index.html`. Pyr
stem path. No further path traversal exists, and the only file that could be disclosed accidentally is `index.html`. Pyramid version 2.0.2 rejects any path that contains a null-byte out of caution. While valid in directory/file names, we would strongly consider it a mistake to use null-bytes in naming files/directories. Secondly, Python 3.11, and 3.12 has fixed the underlying issue in `os.path.normpath` to no longer truncate on the first `0x00` found, returning the behavior to pre-3.11 Python, un an as of yet unreleased version. Fixes will be available in:Python 3.12.0rc2 and 3.11.5. Some workarounds are available. Use a version of Python 3 that is not affected, downgrade to Python 3.10 seri
nd 3.11.5. Some workarounds are available. Use a version of Python 3 that is not affected, downgrade to Python 3.10 series temporarily, or wait until Python 3.11.5 is released and upgrade to the latest version of Python 3.11 series. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Pylons/pyramid/security/advisories/GHSA-j8g2-6fc7-q8f8 - https://github.com/python/cpython/issues/106242 - https://github.com/python/cpython/pull/106816 - https://github.com/Pylons/pyramid/commit/347d7750da6f45c7436dd0c31468885cc9343c85 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQIPHQTM3XE5NIEXCTQFV2J2RK2YUSMT/ - https://lists
ect.org/archives/list/package-announce@lists.fedoraproject.org/message/OQIPHQTM3XE5NIEXCTQFV2J2RK2YUSMT/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYSDTQ7NP5GHPQ7HBE47MBJQK7YEIYMF/
CVE ID: CVE-2023-40588 State: PUBLISHED Published: 2023-09-15T19:23:39.480Z Last Updated: 2024-09-24T18:17:15.320Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: discourse Products: discourse Problem Types: CWE-770 Description: Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, a malicious user could add a 2FA or security key with a carefully crafted name to their account and cause a denial of service for other users. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches. Ther
patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-2hg5-3xm3-9vvx
CVE ID: CVE-2023-40589 State: PUBLISHED Published: 2023-08-31T18:31:07.355Z Last Updated: 2025-11-03T20:35:56.796Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-120 Description: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted input into this function can trigger the overflow which has only been shown to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this
been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gc34-mw6m-g42x - https://github.com/FreeRDP/FreeRDP/commit/16141a30f983dd6f7a6e5b0356084171942c9416 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.
/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/ - https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html - https://security.gentoo.org/glsa/202401-16
CVE ID: CVE-2023-40590 State: PUBLISHED Published: 2023-08-28T17:24:09.965Z Last Updated: 2024-10-02T14:04:39.463Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: gitpython-developers Products: GitPython Problem Types: CWE-426 Description: GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the `git` command, if a user runs GitPython from a repo has a `git.exe` or `git` executable, that program will be run instead of the one in the user's `PATH`. This is more of a problem on how Python interacts with
hat program will be run instead of the one in the user's `PATH`. This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren't affected by this. But probably people using GitPython usually run it from the CWD of a repo. An attacker can trick a user to download a repository with a malicious `git` executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands. There is no fix currently available for windows users, however there are a few mitigations. 1: Default to an absolute path for the git program on Windows, like `C:\\Program Files\\Git\\cmd\\git.EXE` (default git path installation). 2: Requir
h for the git program on Windows, like `C:\\Program Files\\Git\\cmd\\git.EXE` (default git path installation). 2: Require users to set the `GIT_PYTHON_GIT_EXECUTABLE` environment variable on Windows systems. 3: Make this problem prominent in the documentation and advise users to never run GitPython from an untrusted repo, or set the `GIT_PYTHON_GIT_EXECUTABLE` env var to an absolute path. 4: Resolve the executable manually by only looking into the `PATH` environment variable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wfm5-v35h-vwf4 - https://docs.python.org/3/library/sub
ithub.com/gitpython-developers/GitPython/security/advisories/GHSA-wfm5-v35h-vwf4 - https://docs.python.org/3/library/subprocess.html#popen-constructor
CVE ID: CVE-2023-40591 State: PUBLISHED Published: 2023-09-06T18:07:20.899Z Last Updated: 2024-09-26T15:19:33.428Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ethereum Products: go-ethereum Problem Types: CWE-400 Description: go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix is included in geth version `1.12.1-stable`, i.e, `1.12.2-unstable` and onwards. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE P
. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ethereum/go-ethereum/security/advisories/GHSA-ppjg-v974-84cm - https://geth.ethereum.org/docs/developers/geth-developer/disclosures - https://github.com/ethereum/go-ethereum/releases/tag/v1.12.1
CVE ID: CVE-2023-40592 State: PUBLISHED Published: 2023-08-30T16:19:38.525Z Last Updated: 2025-02-28T11:03:48.911Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Problem Types: CWE-79 Description: In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting (XSS) on the “/app/search/table” web endpoint. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk platform instance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advi
latform instance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2023-0801 - https://research.splunk.com/application/182f9080-4137-4629-94ac-cb1083ac981a/
CVE ID: CVE-2023-40593 State: PUBLISHED Published: 2023-08-30T16:19:41.308Z Last Updated: 2025-02-28T11:03:56.605Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Problem Types: CWE-400 Description: In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0802 - https://research.splunk.com/applica
gram Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0802 - https://research.splunk.com/application/8e8a86d5-f323-4567-95be-8e817e2baee6/
CVE ID: CVE-2023-40594 State: PUBLISHED Published: 2023-08-30T16:19:40.677Z Last Updated: 2025-02-28T11:03:47.517Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Problem Types: CWE-400 Description: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the `printf` SPL function to perform a denial of service (DoS) against the Splunk Enterprise instance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2023-0803 - https://research.splunk.com/application/78b48d08-075c-4eac-bd07-e364c3780867/
CVE ID: CVE-2023-40595 State: PUBLISHED Published: 2023-08-30T16:19:29.761Z Last Updated: 2025-02-28T11:03:49.175Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Problem Types: CWE-502 Description: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that they can then use to serialize untrusted data. The attacker can use the query to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0804 - https://research.splunk.com/application/d1d8fda6-874a-400f-82cf-dcbb59d8e
advisory.splunk.com/advisories/SVD-2023-0804 - https://research.splunk.com/application/d1d8fda6-874a-400f-82cf-dcbb59d8e4db/
CVE ID: CVE-2023-40596 State: PUBLISHED Published: 2023-08-30T16:19:43.630Z Last Updated: 2025-02-28T11:03:54.197Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Enterprise Problem Types: CWE-665 Description: In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) that ships with Splunk Enterprise references an insecure path for the OPENSSLDIR build definition. An attacker can abuse this reference and subsequently install malicious code to achieve privilege escalation on the Windows machine. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisory
dows machine. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0805
CVE ID: CVE-2023-40597 State: PUBLISHED Published: 2023-08-30T16:19:44.220Z Last Updated: 2025-07-01T13:45:24.210Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Problem Types: CWE-36 Description: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2023-0806 - https://research.splunk.com/application/356bd3fe-f59b-4f64-baa1-51495411b7ad/
CVE ID: CVE-2023-40598 State: PUBLISHED Published: 2023-08-30T16:19:28.135Z Last Updated: 2025-02-28T11:03:41.623Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Problem Types: CWE-77 Description: In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
he Splunk platform Instance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2023-0807 - https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/
CVE ID: CVE-2023-40599 State: PUBLISHED Published: 2023-08-25T02:18:19.849Z Last Updated: 2024-10-02T17:42:18.480Z Vendors: SYNCK GRAPHICA Products: Mailform Pro CGI Problem Types: Regular expression Denial-of-Service (ReDoS) Description: Regular expression Denial-of-Service (ReDoS) exists in multiple add-ons for Mailform Pro CGI 4.3.1.3 and earlier, which allows a remote unauthenticated attacker to cause a denial-of-service condition. Affected add-ons are as follows: call/call.js, prefcodeadv/search.cgi, estimate/estimate.js, search/search.js, suggest/suggest.js, and coupon/coupon.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.synck
n/coupon.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.synck.com/blogs/news/newsroom/detail_1691668841.html - https://jvn.jp/en/jp/JVN86484824/
CVE ID: CVE-2023-40600 State: PUBLISHED Published: 2023-11-30T15:00:09.354Z Last Updated: 2024-11-20T20:52:34.672Z Vendors: Exactly WWW Products: EWWW Image Optimizer Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exactly WWW EWWW Image Optimizer. It works only when debug.log is turned on.This issue affects EWWW Image Optimizer: from n/a through 7.2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ewww-image-optimizer/wordpress-ewww-image-optimizer-plugin-7-2-0-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2023-40601 State: PUBLISHED Published: 2023-09-06T08:45:41.448Z Last Updated: 2024-09-24T18:47:09.110Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Estatik Products: Estatik Mortgage Calculator Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Estatik Estatik Mortgage Calculator plugin <= 2.0.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/estatik-mortgage-calculator/wordpress-mortgage-calculator-estatik-plugin-2-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-40602 State: PUBLISHED Published: 2023-12-19T19:54:43.220Z Last Updated: 2024-08-02T18:38:50.903Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: Doofinder Products: Doofinder WP & WooCommerce Search Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Doofinder Doofinder WP & WooCommerce Search.This issue affects Doofinder WP & WooCommerce Search: from n/a through 1.5.49. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/doofinder-for-woocommerce/wordpress-doofinder-for-woocommerce-plugin-1-5-49-open-redirection-vulnerability?_s_
erability/doofinder-for-woocommerce/wordpress-doofinder-for-woocommerce-plugin-1-5-49-open-redirection-vulnerability?_s_id=cve