Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-33744 State: PUBLISHED Published: 2023-07-27T00:00:00 Last Updated: 2024-10-23T13:02:18.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: TeleAdapt RoomCast TA-2400 1.0 through 3.1 suffers from Use of a Hard-coded Password (PIN): 385521, 843646, and 592671. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://packetstormsecurity.com/files/173764/RoomCast-TA-2400-Cleartext-Private-Key-Improper-Access-Control.html
CVE ID: CVE-2023-33745 State: PUBLISHED Published: 2023-07-27T00:00:00 Last Updated: 2024-10-23T14:17:34.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: TeleAdapt RoomCast TA-2400 1.0 through 3.1 is vulnerable to Improper Privilege Management: from the shell available after an adb connection, simply entering the su command provides root access (without requiring a password). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://packetstormsecurity.com/files/173764/RoomCast-TA-2400-Cleartext-Private-Key-Improper-Access-Control.html
CVE ID: CVE-2023-33747 State: PUBLISHED Published: 2023-06-06T00:00:00 Last Updated: 2025-01-08T15:26:47.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: CloudPanel v2.2.2 allows attackers to execute a path traversal. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/264.html - https://cwe.mitre.org/data/definitions/35.html - https://cwe.mitre.org/data/definitions/269.html - https://www.cloudpanel.io/docs/v2/changelog/ - https://github.com/EagleTube/CloudPanel - http://packetstormsecurity.com/files/172768/CloudPanel-2.2.2-Privilege-Escalation-Path-Traversal.html
CVE ID: CVE-2023-33750 State: PUBLISHED Published: 2023-05-25T00:00:00.000Z Last Updated: 2025-01-31T17:42:37.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description parameter at /index.php?s=/article/ApiAdminArticle/itemAdd. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sansanyun/mipjz/issues/15
CVE ID: CVE-2023-33751 State: PUBLISHED Published: 2023-05-25T00:00:00.000Z Last Updated: 2025-01-31T17:38:15.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter at /app/tag/controller/ApiAdminTagCategory.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sansanyun/mipjz/issues/14
CVE ID: CVE-2023-33754 State: PUBLISHED Published: 2023-06-01T00:00:00 Last Updated: 2025-01-09T16:38:01.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: The captive portal in Inpiazza Cloud WiFi versions prior to v4.2.17 does not enforce limits on the number of attempts for password recovery, allowing attackers to brute force valid user accounts to gain access to login credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Alkatraz97/CVEs/blob/main/CVE-2023-33754.md
CVE ID: CVE-2023-33756 State: PUBLISHED Published: 2023-08-08T00:00:00 Last Updated: 2024-10-15T18:00:25.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the SpreadSheetPlugin component of Foswiki v2.1.7 and below allows attackers to execute a directory traversal. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://foswiki.org/Support/SecurityAlert-CVE-2023-33756
CVE ID: CVE-2023-33757 State: PUBLISHED Published: 2024-01-25T00:00:00.000Z Last Updated: 2025-06-20T19:34:27.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: A lack of SSL certificate validation in Splicecom iPCS (iOS App) v1.3.4, iPCS2 (iOS App) v2.8 and before, and iPCS (Android App) v1.8.5 and before allows attackers to eavesdrop on communications via a man-in-the-middle attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/twignet/splicecom
CVE ID: CVE-2023-33758 State: PUBLISHED Published: 2024-01-25T00:00:00.000Z Last Updated: 2025-06-20T19:35:13.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: Splicecom Maximiser Soft PBX v1.5 and before was discovered to contain a cross-site scripting (XSS) vulnerability via the CLIENT_NAME and DEVICE_GUID fields in the login component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/twignet/splicecom
CVE ID: CVE-2023-33759 State: PUBLISHED Published: 2024-01-25T00:00:00.000Z Last Updated: 2025-05-30T14:16:00.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: SpliceCom Maximiser Soft PBX v1.5 and before does not restrict excessive authentication attempts, allowing attackers to bypass authentication via a brute force attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/twignet/splicecom
CVE ID: CVE-2023-33760 State: PUBLISHED Published: 2024-01-25T00:00:00.000Z Last Updated: 2025-06-17T15:23:39.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: SpliceCom Maximiser Soft PBX v1.5 and before was discovered to utilize a default SSL certificate. This issue can allow attackers to eavesdrop on communications via a man-in-the-middle attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/twignet/splicecom
CVE ID: CVE-2023-33761 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-08T20:04:32.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /view/cb/format_642.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rauschecker/CVEs/tree/main/CVE-2023-33761
CVE ID: CVE-2023-33762 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-08T20:03:10.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a SQL injection vulnerability via the Activity parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rauschecker/CVEs/tree/main/CVE-2023-33762
CVE ID: CVE-2023-33763 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-08T19:56:00.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /scheduler/index.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rauschecker/CVEs/tree/main/CVE-2023-33763
CVE ID: CVE-2023-33764 State: PUBLISHED Published: 2023-06-01T00:00:00 Last Updated: 2025-01-09T17:41:10.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component #/de/casting/show/detail/<ID>. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rauschecker/CVEs/tree/main/CVE-2023-33764
CVE ID: CVE-2023-33768 State: PUBLISHED Published: 2023-07-13T00:00:00 Last Updated: 2024-10-30T19:39:44.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect signature verification of the firmware during the Device Firmware Update process of Belkin Wemo Smart Plug WSP080 v1.2 allows attackers to cause a Denial of Service (DoS) via a crafted firmware file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://play.google.com/store/apps/details?id=com.belkin.wemoandroid&hl=en_US&gl=US - https://www.amazon.com/Control-Devices-Remotely-Assistant-HomeKit/dp/B08CJGZZZ1 - https://github.com/purseclab/CVE-2023-33768
CVE ID: CVE-2023-33770 State: PUBLISHED Published: 2025-05-06T00:00:00.000Z Last Updated: 2025-05-08T18:36:55.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: Real Estate Management System v1.0 was discovered to contain a SQL injection vulnerability via the message parameter at /contact.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ankkkush/Real-Estate-Php-main/issues/1 - https://gist.github.com/f1rstb100d/1fa225d2dd538df670e905feede3b98d
CVE ID: CVE-2023-33777 State: PUBLISHED Published: 2023-07-25T00:00:00 Last Updated: 2024-10-24T14:37:47.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in /functions/fbaorder.php of Prestashop amazon before v5.2.24 allows attackers to execute a directory traversal attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://addons.prestashop.com/fr/marketplace/2501-amazon-market-place.html - https://security.friendsofpresta.org/modules/2023/07/13/amazon.html?_sm_pdc=1&_sm_rid=8j3vvHn3kPrR9r7QVvHpFPR9WHVDpvvHP9PLPMj
CVE ID: CVE-2023-33778 State: PUBLISHED Published: 2023-06-01T00:00:00 Last Updated: 2025-01-09T17:24:35.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/Ji4n1ng/6
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/Ji4n1ng/6d028709d39458f5ab95b3ea211225ef
CVE ID: CVE-2023-33779 State: PUBLISHED Published: 2023-05-26T00:00:00 Last Updated: 2025-01-14T20:05:50.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component /jobinfo/. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://xxl-job.com - https://github.com/xuxueli/xxl-job - https://github.com/silence-silence/xxl-job-lateral-privilege-escalation-vulnerability-/blob/main/README.md
CVE ID: CVE-2023-33780 State: PUBLISHED Published: 2023-05-26T00:00:00 Last Updated: 2025-01-14T20:01:56.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in TFDi Design smartCARS 3 v0.7.0 and below allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the body of news article. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/invernyx/smartcars-3-bugs/security/advisories/GHSA-hx8p-f8h7-5h78
CVE ID: CVE-2023-33781 State: PUBLISHED Published: 2023-06-07T00:00:00 Last Updated: 2025-01-07T14:19:18.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in D-Link DIR-842V2 v1.0.3 allows attackers to execute arbitrary commands via importing a crafted file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://d-link.com - https://www.dlink.com/en/security-bulletin/ - http://dir-842v2.com - https://github.com/s0tr/CVE-2023-33781
CVE ID: CVE-2023-33782 State: PUBLISHED Published: 2023-06-07T00:00:00 Last Updated: 2025-01-06T20:21:33.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-842V2 v1.0.3 was discovered to contain a command injection vulnerability via the iperf3 diagnostics function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://d-link.com - https://www.dlink.com/en/security-bulletin/ - http://dir-842v2.com - https://github.com/s0tr/CVE-2023-33782
CVE ID: CVE-2023-33785 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2024-11-27T15:08:49.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Create Rack Roles (/dcim/rack-roles/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/anhdq201/netbox/issues/8
CVE ID: CVE-2023-33786 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2024-08-02T15:47:06.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Create Circuit Types (/circuits/circuit-types/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/anhdq201/netbox/issues/2
CVE ID: CVE-2023-33787 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2024-08-02T15:47:06.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Create Tenant Groups (/tenancy/tenant-groups/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/anhdq201/netbox/issues/6
CVE ID: CVE-2023-33788 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2024-08-02T15:47:06.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Create Providers (/circuits/providers/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/anhdq201/netbox/issues/3
CVE ID: CVE-2023-33789 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2024-08-02T15:47:06.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Create Contact Groups (/tenancy/contact-groups/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/anhdq201/netbox/issues/7
CVE ID: CVE-2023-33790 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2024-08-02T15:47:06.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Create Locations (/dcim/locations/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/anhdq201/netbox/issues/9
CVE ID: CVE-2023-33791 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2024-08-02T15:47:06.757Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Create Provider Accounts (/circuits/provider-accounts/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/anhdq201/netbox/issues/4
CVE ID: CVE-2023-33792 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2024-08-02T15:47:06.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Create Site Groups (/dcim/site-groups/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/anhdq201/netbox/issues/10
CVE ID: CVE-2023-33793 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2024-08-02T15:54:12.497Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Create Power Panels (/dcim/power-panels/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/anhdq201/netbox/issues/1
CVE ID: CVE-2023-33794 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2024-08-02T15:54:12.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Create Tenants (/tenancy/tenants/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/anhdq201/netbox/issues/5
CVE ID: CVE-2023-33795 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2024-11-27T15:07:49.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Create Contact Roles (/tenancy/contact-roles/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/anhdq201/netbox/issues/15
CVE ID: CVE-2023-33796 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2024-08-02T15:54:12.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, granting them access to sensitive data stored in the database. NOTE: the vendor disputes this because the reporter's only query was for the schema of the API, which is public; queries for database objects would have been denied. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/anhdq201/netbox/issues/16 - https://github.com/netbox-community/netbox/discussions/12729#discussioncomm
tps://github.com/anhdq201/netbox/issues/16 - https://github.com/netbox-community/netbox/discussions/12729#discussioncomment-6008669
CVE ID: CVE-2023-33797 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2024-08-02T15:54:12.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Create Sites (/dcim/sites/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/anhdq201/netbox/issues/12
CVE ID: CVE-2023-33798 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2024-08-02T15:54:12.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Create Rack (/dcim/rack/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/anhdq201/netbox/issues/13
CVE ID: CVE-2023-33799 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2024-08-02T15:54:12.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Create Contacts (/tenancy/contacts/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/anhdq201/netbox/issues/14
CVE ID: CVE-2023-33800 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2024-08-02T15:54:12.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Create Regions (/dcim/regions/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/anhdq201/netbox/issues/11
CVE ID: CVE-2023-33802 State: PUBLISHED Published: 2023-07-26T00:00:00 Last Updated: 2024-10-23T15:01:33.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in SumatraPDF Reader v3.4.6 allows attackers to cause a Denial of Service (DoS) via a crafted text file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CDACesec/CVE-2023-33802
CVE ID: CVE-2023-33806 State: PUBLISHED Published: 2024-04-15T00:00:00 Last Updated: 2024-08-02T15:54:12.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure default configurations in Hikvision Interactive Tablet DS-D5B86RB/B V2.3.0 build220119, allows attackers to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/s4fv4n/5a6374cf1dcad85226566eaa325a710d
CVE ID: CVE-2023-33817 State: PUBLISHED Published: 2023-06-13T00:00:00 Last Updated: 2025-01-03T02:20:41.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/leekenghwa/CVE-2023-33817---SQL-Injection-found-in-HotelDruid-3.0.5
CVE ID: CVE-2023-33829 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2025-01-16T15:59:13.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Cloudogu GmbH SCM Manager v1.2 to v1.60 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description text field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bitbucket.org/sdorra/docker-scm-manager/src/master/ - https://github.com/n3gox/Stored-XSS-on-SCM-Manager-1.60 - http://packetstormsecurity.com/files/172588/SCM-Manager-1.60-Cross-Site-Scripting.html
CVE ID: CVE-2023-33831 State: PUBLISHED Published: 2023-09-18T00:00:00 Last Updated: 2024-09-25T18:46:00.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://youtu.be/Xxa6yRB2Fpw - https://github.com/rodolfomarianocy/Unauthenticated-RCE-FUXA-CVE-2023-33831
CVE ID: CVE-2023-33832 State: PUBLISHED Published: 2023-07-19T00:51:17.495Z Last Updated: 2024-10-21T14:09:02.331Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Storage Protect Problem Types: CWE-20 Description: IBM Spectrum Protect 8.1.0.0 through 8.1.17.0 could allow a local user to cause a denial of service due to due to improper time-of-check to time-of-use functionality. IBM X-Force ID: 256012. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7011761 - https://exchange.xforce.ibmcloud.com/vulnerabilities/256012