Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-28128 State: PUBLISHED Published: 2023-05-09T00:00:00.000Z Last Updated: 2025-01-28T20:46:12.382Z Vendors: n/a Products: Avalanche Problem Types: CWE-434 Description: An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/ZDI-CAN-17812-Ivanti-Avalanche-FileStoreConfig-Arbitrary-File-Upload-Remote-Code-Execution-Vulnerability?language=en_US - http://packetstormsecurity.com/files/172398/Ivanti-Avalanche-FileStoreConfig-Shell-Upload.htm
erability?language=en_US - http://packetstormsecurity.com/files/172398/Ivanti-Avalanche-FileStoreConfig-Shell-Upload.html
CVE ID: CVE-2023-28129 State: PUBLISHED Published: 2023-08-10T19:07:44.291Z Last Updated: 2024-10-09T19:31:11.852Z Vendors: Ivanti Products: Desktop & Server Management (DSM) Description: DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installation user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/SA-2023-07-26-CVE-2023-28129
CVE ID: CVE-2023-28130 State: PUBLISHED Published: 2023-07-26T10:57:02.708Z Last Updated: 2025-02-13T16:45:40.198Z Vendors: n/a Products: Quantum Appliances, Quantum Security Gateways Problem Types: CWE-20 Description: Local user may lead to privilege escalation using Gaia Portal hostnames page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.checkpoint.com/results/sk/sk181311 - https://pentests.nl/pentest-blog/cve-2023-28130-command-injection-in-check-point-gaia-portal/ - http://seclists.org/fulldisclosure/2023/Jul/43 - http://seclists.org/fulldisclosure/2023/Aug/4 - http://packetstormsecurity.com/files/173918/Checkpoint-Gaia-Portal-
43 - http://seclists.org/fulldisclosure/2023/Aug/4 - http://packetstormsecurity.com/files/173918/Checkpoint-Gaia-Portal-R81.10-Remote-Command-Execution.html
CVE ID: CVE-2023-28131 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-02-04T16:33:56.283Z Vendors: Expo.io Products: Expo AuthSession module Problem Types: The use of AuthSession modules’s useProxy in Expo below SDK 48 may allow OAuth hijacking, which leads to credentials theft and Account Takeover. Description: A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achieved once a victim clicks a malicious link. The link itself may be sent to the victim in various ways (including email, text message, an atta
icks a malicious link. The link itself may be sent to the victim in various ways (including email, text message, an attacker-controlled website, etc). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.expo.dev/security-advisory-for-developers-using-authsessions-useproxy-options-and-auth-expo-io-e470fe9346df - https://www.darkreading.com/endpoint/oauth-flaw-in-expo-platform-affects-hundreds-of-third-party-sites-apps
CVE ID: CVE-2023-28133 State: PUBLISHED Published: 2023-07-23T09:07:35.383Z Last Updated: 2024-10-24T15:52:50.368Z Vendors: n/a Products: Harmony Endpoint. Problem Types: CWE-732 Description: Local privilege escalation in Check Point Endpoint Security Client (version E87.30) via crafted OpenSSL configuration file Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.checkpoint.com/results/sk/sk181276
CVE ID: CVE-2023-28134 State: PUBLISHED Published: 2023-11-12T22:36:19.549Z Last Updated: 2024-09-03T18:31:14.621Z Vendors: checkpoint Products: Harmony Endpoint. Problem Types: CWE-732 Description: Local attacker can escalate privileges on affected installations of Check Point Harmony Endpoint/ZoneAlarm Extreme Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.checkpoint.com/results/sk/sk181597
CVE ID: CVE-2023-28140 State: PUBLISHED Published: 2023-04-18T15:47:37.719Z Last Updated: 2025-02-26T19:23:20.308Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Qualys Products: Cloud Agent Problem Types: CWE-427 Description: An Executable Hijacking condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.5.3.1. Attackers may load a malicious copy of a Dependency Link Library (DLL) via a local attack vector instead of the DLL that the application was expecting, when processes are running with escalated privileges. This vulnerability is bounded only to the time of uninstallation and can only be exploited locally. At the time of t
es. This vulnerability is bounded only to the time of uninstallation and can only be exploited locally. At the time of this disclosure, versions before 4.0 are classified as End of Life. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qualys.com/security-advisories/
CVE ID: CVE-2023-28141 State: PUBLISHED Published: 2023-04-18T15:50:19.411Z Last Updated: 2025-03-03T19:22:56.830Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Qualys Products: Cloud Agent Problem Types: CWE-59 Description: An NTFS Junction condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.8.0.31. Attackers may write files to arbitrary locations via a local attack vector. This allows attackers to assume the privileges of the process, and they may delete or otherwise on unauthorized files, allowing for the potential modification or deletion of sensitive files limited only to that specific directory/file object. This vulne
he potential modification or deletion of sensitive files limited only to that specific directory/file object. This vulnerability is bounded to the time of installation/uninstallation and can only be exploited locally. At the time of this disclosure, versions before 4.0 are classified as End of Life. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qualys.com/security-advisories/
CVE ID: CVE-2023-28142 State: PUBLISHED Published: 2023-04-18T15:51:58.344Z Last Updated: 2025-03-03T19:22:08.808Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Qualys Products: Cloud Agent Problem Types: CWE-362 Description: A Race Condition exists in the Qualys Cloud Agent for Windows platform in versions from 3.1.3.34 and before 4.5.3.1. This allows attackers to escalate privileges limited on the local machine during uninstallation of the Qualys Cloud Agent for Windows. Attackers may gain SYSTEM level privileges on that asset to run arbitrary commands. At the time of this disclosure, versions before 4.0 are classified as End of Life. Additional Analyst
bitrary commands. At the time of this disclosure, versions before 4.0 are classified as End of Life. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qualys.com/security-advisories/
CVE ID: CVE-2023-28143 State: PUBLISHED Published: 2023-04-18T15:54:16.031Z Last Updated: 2025-02-05T20:25:58.551Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Qualys Products: Cloud Agent Problem Types: CWE-426 Description: Qualys Cloud Agent for macOS (versions 2.5.1-75 before 3.7) installer allows a local escalation of privilege bounded only to the time of installation and only on older macOSX (macOS 10.15 and older) versions. Attackers may exploit incorrect file permissions to give them ROOT command execution privileges on the host. During the install of the PKG, a step in the process involves extracting the package and copying files to several direct
During the install of the PKG, a step in the process involves extracting the package and copying files to several directories. Attackers may gain writable access to files during the install of PKG when extraction of the package and copying files to several directories, enabling a local escalation of privilege. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://qualys.com/security-advisories
CVE ID: CVE-2023-28144 State: PUBLISHED Published: 2023-03-14T00:00:00.000Z Last Updated: 2025-02-27T19:55:05.944Z Vendors: n/a Products: n/a Problem Types: n/a Description: KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involving symlinks and elevate_perf_privileges.sh chown calls. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/KDAB/hotspot/releases - https://www.openwall.com/lists/oss-security/2023/03/14/8
CVE ID: CVE-2023-28147 State: PUBLISHED Published: 2023-06-01T00:00:00 Last Updated: 2025-01-09T19:34:08.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory. This affects Midgard r29p0 through r32p0, Bifrost r17p0 through r42p0 before r43p0, Valhall r19p0 through r42p0 before r43p0, and Arm's GPU Architecture Gen5 r41p0 through r42p0 before r43p0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilit
ISA ADP Vulnrichment: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE ID: CVE-2023-28149 State: PUBLISHED Published: 2024-07-31T00:00:00 Last Updated: 2024-11-07T16:49:18.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the IhisiServiceSmm module in Insyde InsydeH2O with kernel 5.2 before 05.28.42, 5.3 before 05.37.42, 5.4 before 05.45.39, 5.5 before 05.53.39, and 5.6 before 05.60.39 that could allow an attacker to modify UEFI variables. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge/SA-2023040
CVE ID: CVE-2023-28150 State: PUBLISHED Published: 2023-03-24T00:00:00.000Z Last Updated: 2025-05-30T16:02:41.574Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Independentsoft JODF before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.independentsoft.de/jword/index.html - https://excellium-services.com/cert-xlm-advisory/CVE-2023-28150 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-28150
CVE ID: CVE-2023-28151 State: PUBLISHED Published: 2023-03-24T00:00:00.000Z Last Updated: 2025-05-30T16:02:42.850Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Independentsoft JSpreadsheet before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.independentsoft.de/jword/index.html - https://excellium-services.com/cert-xlm-advisory/CVE-2023-28151 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-28151
CVE ID: CVE-2023-28152 State: PUBLISHED Published: 2023-03-24T00:00:00.000Z Last Updated: 2025-05-30T16:02:47.522Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Independentsoft JWord before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.independentsoft.de/jword/index.html - https://excellium-services.com/cert-xlm-advisory/CVE-2023-28152 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-28152
CVE ID: CVE-2023-28153 State: PUBLISHED Published: 2023-05-29T00:00:00 Last Updated: 2025-01-14T17:12:35.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Kiddoware Kids Place Parental Control application before 3.8.50 for Android. The child can remove all restrictions temporarily without the parents noticing by rebooting into Android Safe Mode and disabling the "Display over other apps" permission. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-kiddoware-kids-place-parental-control-android-app/
CVE ID: CVE-2023-28154 State: PUBLISHED Published: 2023-03-13T00:00:00.000Z Last Updated: 2025-02-27T19:54:32.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/webpack/webpack/pull/16500 - https://github.com/webpack/webpack/compare/v5.75.0...v5.76.0 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/messag
pare/v5.75.0...v5.76.0 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PPSAXUTXBCCTAHTCX5BUR4YVP25XALQ3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2AFCM6FFE3LRYI6KNEQWKMXMQOBZQ2D/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AU7BOXTBK3KDYSWH67ASZ22TUIOZ3X5G/
CVE ID: CVE-2023-28155 State: PUBLISHED Published: 2023-03-16T00:00:00 Last Updated: 2024-08-02T12:30:24.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/request/request/issues/3442 - https://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf - https://github.com/request/request/pull/3444 - https://secur
ec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf - https://github.com/request/request/pull/3444 - https://security.netapp.com/advisory/ntap-20230413-0007/
CVE ID: CVE-2023-28158 State: PUBLISHED Published: 2023-03-29T12:21:46.932Z Last Updated: 2025-02-13T16:45:40.751Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Apache Software Foundation Products: Apache Archiva Problem Types: CWE-79 Description: Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such admin user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/8pm6d5y9cptznm0bdny3n8voovmm0dtt - http://w
iner: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/8pm6d5y9cptznm0bdny3n8voovmm0dtt - http://www.openwall.com/lists/oss-security/2023/04/18/2
CVE ID: CVE-2023-28159 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-09T16:42:21.361Z Vendors: Mozilla Products: Firefox Problem Types: Fullscreen Notification could have been hidden by download popups on Android Description: The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion or spoofing attacks. <br>*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 111. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-09/ - https://bu
Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-09/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1783561
CVE ID: CVE-2023-28160 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-09T15:37:44.951Z Vendors: Mozilla Products: Firefox Problem Types: Redirect to Web Extension files may have leaked local path Description: When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual local path, leaking potentially sensitive information. This vulnerability affects Firefox < 111. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-09/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1802385
CVE ID: CVE-2023-28161 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-09T15:29:22.404Z Vendors: Mozilla Products: Firefox Problem Types: One-time permissions granted to a local file were extended to other local files loaded in the same tab Description: If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in that tab for all other documents loaded from a file: URL. This is potentially dangerous if the local files came from different sources, such as in a download directory. This vulnerability affects Firefox < 111. Additional Analyst Notes: - CVE Program Container: - CI
a download directory. This vulnerability affects Firefox < 111. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-09/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1811181
CVE ID: CVE-2023-28162 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-09T15:25:44.090Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Invalid downcast in Worklets Description: While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have led to a potentially exploitable crash. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-09/ - https://www.mozilla.org/security/advisories/mfsa2023-10/ - https://www.mozi
zilla.org/security/advisories/mfsa2023-09/ - https://www.mozilla.org/security/advisories/mfsa2023-10/ - https://www.mozilla.org/security/advisories/mfsa2023-11/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1811327
CVE ID: CVE-2023-28163 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-09T15:18:12.128Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Windows Save As dialog resolved environment variables Description: When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. <br>*This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.*. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichmen
Firefox ESR < 102.9, and Thunderbird < 102.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-09/ - https://www.mozilla.org/security/advisories/mfsa2023-10/ - https://www.mozilla.org/security/advisories/mfsa2023-11/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1817768
CVE ID: CVE-2023-28164 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-09T15:04:54.232Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation Description: Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-09/ - https://www.mozilla.org/security/a
ulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-09/ - https://www.mozilla.org/security/advisories/mfsa2023-10/ - https://www.mozilla.org/security/advisories/mfsa2023-11/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1809122
CVE ID: CVE-2023-28165 State: PUBLISHED Published: 2024-12-09T11:31:20.301Z Last Updated: 2024-12-09T18:44:14.469Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Tech Banker Products: Backup Bank: WordPress Backup Plugin Problem Types: CWE-862 Description: Missing Authorization vulnerability in Tech Banker Backup Bank: WordPress Backup Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backup Bank: WordPress Backup Plugin: from n/a through 4.0.28. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-backup-bank/vulnerability/wordpress-backup-bank-w
ent: References: - https://patchstack.com/database/wordpress/plugin/wp-backup-bank/vulnerability/wordpress-backup-bank-wordpress-backup-plugin-plugin-4-0-28-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-28166 State: PUBLISHED Published: 2023-06-22T08:05:24.116Z Last Updated: 2024-10-10T17:26:27.757Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Aakif Kadiwala Products: Tags Cloud Manager Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Aakif Kadiwala Tags Cloud Manager plugin <= 1.0.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/tags-cloud-manager/wordpress-tags-cloud-manager-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28167 State: PUBLISHED Published: 2023-11-12T22:31:28.204Z Last Updated: 2024-08-30T19:27:32.575Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Vsourz Digital Products: CF7 Invisible reCAPTCHA Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Vsourz Digital CF7 Invisible reCAPTCHA plugin <= 1.3.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/cf7-invisible-recaptcha/wordpress-cf7-invisible-recaptcha-plugin-1-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-28168 State: PUBLISHED Published: 2024-12-09T11:31:19.502Z Last Updated: 2024-12-09T18:44:21.937Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Jerod Santo Products: WordPress Console Problem Types: CWE-862 Description: Missing Authorization vulnerability in Jerod Santo WordPress Console allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Console: from n/a through 0.3.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wordpress-console/vulnerability/wordpress-wordpress-console-plugin-0-3-9-broken-access-control-vulnerability?_s_i