Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-2570 State: PUBLISHED Published: 2023-06-14T07:52:24.608Z Last Updated: 2024-08-02T06:26:09.828Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure Foxboro DCS Control Core Services Problem Types: CWE-129 Description: A CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service, and potentially kernel execution when a malicious actor with local user access crafts a script/program using an unpredictable index to an IOCTL call in the Foxboro.sys driver. Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p
driver. Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-164-04.pdf
CVE ID: CVE-2023-2571 State: PUBLISHED Published: 2023-06-05T13:39:02.507Z Last Updated: 2025-01-08T15:39:49.379Z Vendors: Unknown Products: Quiz Maker Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Quiz Maker WordPress plugin before 6.4.2.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2dc02e5c-1c89-4053-a6a7-29ee7b996183
CVE ID: CVE-2023-2572 State: PUBLISHED Published: 2023-06-05T13:38:59.749Z Last Updated: 2025-01-08T16:58:37.074Z Vendors: Unknown Products: Survey Maker Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Survey Maker WordPress plugin before 3.4.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2f7fe6e6-c3d0-4e27-8222-572d7a420153
CVE ID: CVE-2023-2573 State: PUBLISHED Published: 2023-05-08T12:33:06.707Z Last Updated: 2025-02-13T16:44:35.870Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-1524, EKI-1522, EKI-1521 Problem Types: CWE-78 Description: Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the NTP server input field, which can be triggered by authenticated users via a crafted POST request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.advantech.com/en/support/details/firmware?id=1-1J9BED3 - https://www.advantech.com/en/support/details/fi
: - https://www.advantech.com/en/support/details/firmware?id=1-1J9BED3 - https://www.advantech.com/en/support/details/firmware?id=1-1J9BEBL - https://www.advantech.com/en/support/details/firmware?id=1-1J9BECT - https://cyberdanube.com/en/multiple-vulnerabilities-in-advantech-eki-15xx-series/ - http://seclists.org/fulldisclosure/2023/May/4 - http://packetstormsecurity.com/files/172307/Advantech-EKI-15XX-Series-Command-Injection-Buffer-Overflow.html
CVE ID: CVE-2023-2574 State: PUBLISHED Published: 2023-05-08T12:28:59.918Z Last Updated: 2025-02-13T16:44:36.399Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-1524, EKI-1522, EKI-1521 Problem Types: CWE-78 Description: Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the device name input field, which can be triggered by authenticated users via a crafted POST request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.advantech.com/en/support/details/firmware?id=1-1J9BED3 - https://www.advantech.com/en/support/details/f
s: - https://www.advantech.com/en/support/details/firmware?id=1-1J9BED3 - https://www.advantech.com/en/support/details/firmware?id=1-1J9BEBL - https://www.advantech.com/en/support/details/firmware?id=1-1J9BECT - https://cyberdanube.com/en/multiple-vulnerabilities-in-advantech-eki-15xx-series/ - http://seclists.org/fulldisclosure/2023/May/4 - http://packetstormsecurity.com/files/172307/Advantech-EKI-15XX-Series-Command-Injection-Buffer-Overflow.html
CVE ID: CVE-2023-2575 State: PUBLISHED Published: 2023-05-08T12:11:34.963Z Last Updated: 2025-02-13T16:44:37.004Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-1524, EKI-1522, EKI-1521 Problem Types: CWE-121 Description: Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stack-based Buffer Overflow vulnerability, which can be triggered by authenticated users via a crafted POST request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.advantech.com/en/support/details/firmware?id=1-1J9BED3 - https://www.advantech.com/en/support/details/firmware?id=1-1J9BEBL
ntech.com/en/support/details/firmware?id=1-1J9BED3 - https://www.advantech.com/en/support/details/firmware?id=1-1J9BEBL - https://www.advantech.com/en/support/details/firmware?id=1-1J9BECT - https://cyberdanube.com/en/multiple-vulnerabilities-in-advantech-eki-15xx-series/ - http://seclists.org/fulldisclosure/2023/May/4 - http://packetstormsecurity.com/files/172307/Advantech-EKI-15XX-Series-Command-Injection-Buffer-Overflow.html
CVE ID: CVE-2023-2576 State: PUBLISHED Published: 2023-07-13T02:08:59.291Z Last Updated: 2024-10-30T19:24:40.514Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. This allowed a developer to remove the CODEOWNERS rules and merge to a protected branch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/410123 - https://hack
am Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/410123 - https://hackerone.com/reports/1898054
CVE ID: CVE-2023-2578 State: PUBLISHED Published: 2023-07-10T12:40:13.155Z Last Updated: 2024-11-12T14:07:20.314Z Vendors: Unknown Products: Buy Me a Coffee Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Buy Me a Coffee WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4dad1c0d-bcf9-4486-bd8e-387ac8e6c892
CVE ID: CVE-2023-2579 State: PUBLISHED Published: 2023-07-17T13:29:49.306Z Last Updated: 2024-10-30T15:05:57.264Z Vendors: Unknown Products: InventoryPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The InventoryPress WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3cfcb8cc-9c4f-409c-934f-9f3f043de6fe - https://github.com/daniloalbuqrque/poc-cve-xss-inventory-press-plugin
CVE ID: CVE-2023-2580 State: PUBLISHED Published: 2023-06-27T13:17:08.326Z Last Updated: 2024-08-02T06:26:09.866Z Vendors: Unknown Products: AI Engine: ChatGPT Chatbot, Content Generator, GPT 3 & 4, Ultra-Customizable Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The AI Engine WordPress plugin before 1.6.83 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup). Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7ee1efb1-9969-40b2-8ab2-ea427091bbd8
CVE ID: CVE-2023-2582 State: PUBLISHED Published: 2023-05-08T00:00:00.000Z Last Updated: 2025-01-28T20:28:19.473Z Vendors: n/a Products: Strikingly Problem Types: Cross-Site Scripting Description: A prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting (XSS) in affected applications and sites built with Strikingly. The vulnerability exists because of Strikingly JavaScript library parsing the URL fragment allows access to the __proto__ or constructor properties and the Object prototype. By leveraging an embedded gadget like jQuery, an attacker who convinces a victim to visit a specially crafted link could achieve arbitrary javascript exe
like jQuery, an attacker who convinces a victim to visit a specially crafted link could achieve arbitrary javascript execution in the context of the user's browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-18
CVE ID: CVE-2023-2583 State: PUBLISHED Published: 2023-05-08T00:00:00.000Z Last Updated: 2025-01-28T20:23:00.419Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: jsreport Products: jsreport/jsreport Problem Types: CWE-94 Description: Code Injection in GitHub repository jsreport/jsreport prior to 3.11.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/397ea68d-1e28-44ff-b830-c8883d067d96 - https://github.com/jsreport/jsreport/commit/afaff3804b34b38e959f5ae65f9e672088de13d7
CVE ID: CVE-2023-2584 State: PUBLISHED Published: 2023-06-09T05:33:19.003Z Last Updated: 2025-02-05T19:43:08.188Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: pixelyoursite Products: PixelYourSite Pro – Your smart PIXEL (TAG) Manager, PixelYourSite – Your smart PIXEL (TAG) Manager Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.3.6 (9.6.1 in the Pro version) due to insufficient input sanitization and output escaping. This makes it possible for auth
6 (9.6.1 in the Pro version) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5ebf1e83-50b8-4f56-ba76-10100375edda?source=cve - https://plugins.trac.wordpress.org/browser/pixelyoursite/trunk/modules/head_footer/head_footer.php?rev=277394
urce=cve - https://plugins.trac.wordpress.org/browser/pixelyoursite/trunk/modules/head_footer/head_footer.php?rev=2773949#L73 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2912301%40pixelyoursite%2Ftrunk&old=2897911%40pixelyoursite%2Ftrunk&sfp_email=&sfph_mail=#file2
CVE ID: CVE-2023-2585 State: PUBLISHED Published: 2023-12-21T09:24:16.632Z Last Updated: 2024-08-02T06:26:09.896Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat Single Sign-On 7, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, RHEL-8 based Middleware Containers Problem Types: CWE-358 Description: Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or poss
poof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:3883 - https://access.redhat.com/errata/RHSA-2023:3884 - https://access.redhat.com/errata/RHSA-2023:3885 - https://access.redhat.com/errata/RHSA-2023:3888 - https://access.redhat.com/errata/RHSA-2023:3892 - https://access.redhat.com/security/cve/CVE-2023-2585 - https://bugzilla.redhat.com/show_bug.cgi?id=2196335
CVE ID: CVE-2023-2586 State: PUBLISHED Published: 2023-05-22T15:05:15.519Z Last Updated: 2025-01-16T21:34:46.618Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Teltonika Products: Remote Management System Problem Types: CWE-287 Description: Teltonika’s Remote Management System versions 4.14.0 is vulnerable to an unauthorized attacker registering previously unregistered devices through the RMS platform. If the user has not disabled the "RMS management feature" enabled by default, then an attacker could register that device to themselves. This could enable the attacker to perform different operations on the user's devices, including remote code execution wit
his could enable the attacker to perform different operations on the user's devices, including remote code execution with 'root' privileges (using the 'Task Manager' feature on RMS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08
CVE ID: CVE-2023-2587 State: PUBLISHED Published: 2023-05-22T15:06:30.677Z Last Updated: 2025-01-16T21:34:38.037Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Teltonika Products: Remote Management System Problem Types: CWE-79 Description: Teltonika’s Remote Management System versions prior to 4.10.0 contain a cross-site scripting (XSS) vulnerability in the main page of the web interface. An attacker with the MAC address and serial number of a connected device could send a maliciously crafted JSON file with an HTML object to trigger the vulnerability. This could allow the attacker to execute scripts in the account context and obtain remote code execution on
nerability. This could allow the attacker to execute scripts in the account context and obtain remote code execution on managed devices. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08
CVE ID: CVE-2023-2588 State: PUBLISHED Published: 2023-05-22T15:09:31.169Z Last Updated: 2025-01-16T21:34:31.046Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Teltonika Products: Remote Management System Problem Types: CWE-830 Description: Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed devices’ local secure shell (SSH)/web management services over the cloud proxy. A user can request a web proxy and obtain a URL in the Remote Management System cloud subdomain. This URL could be shared with others without Remote Management System authentication . An attacker could exploit this vulnerability to cre
shared with others without Remote Management System authentication . An attacker could exploit this vulnerability to create a malicious webpage that uses a trusted and certified domain. An attacker could initiate a reverse shell when a victim connects to the malicious webpage, achieving remote code execution on the victim device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08
CVE ID: CVE-2023-2589 State: PUBLISHED Published: 2023-06-07T00:00:00 Last Updated: 2025-01-07T16:25:26.100Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker can clone a repository from a public project, from a disallowed IP, even after the top-level group has enabled IP restrictions on the group. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment
oup has enabled IP restrictions on the group. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/407891 - https://hackerone.com/reports/1941803 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2589.json
CVE ID: CVE-2023-2590 State: PUBLISHED Published: 2023-05-09T00:00:00.000Z Last Updated: 2025-01-28T19:50:54.401Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: answerdev Products: answerdev/answer Problem Types: CWE-862 Description: Missing Authorization in GitHub repository answerdev/answer prior to 1.0.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/a4238a30-3ddb-4415-9055-e179c3d4dea7 - https://github.com/answerdev/answer/commit/51ac1e6b76ae9ab3ca2008ca4819c0cc3bd2fcd3
CVE ID: CVE-2023-2591 State: PUBLISHED Published: 2023-05-09T00:00:00.000Z Last Updated: 2025-01-28T19:26:03.623Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N) Vendors: nilsteampassnet Products: nilsteampassnet/teampass Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to 3.0.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/705f79f4-f5e3-41d7-82a5-f00441cd984b - https://github.com/nilsteampassnet/teampass/commit/57a977c6323656e5dc06ab5c227e75c3465a1a4a
CVE ID: CVE-2023-2592 State: PUBLISHED Published: 2023-06-27T13:17:20.071Z Last Updated: 2024-11-27T19:19:40.565Z Vendors: Unknown Products: FormCraft Problem Types: CWE-89 SQL Injection Description: The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d4298960-eaba-4185-a730-3e621d9680e1
CVE ID: CVE-2023-2593 State: PUBLISHED Published: 2025-07-30T15:15:53.952Z Last Updated: 2025-11-20T17:22:46.949Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-835 Description: A flaw exists within the Linux kernel's handling of new TCP connections. The issue results from the lack of memory release after its effective lifetime. This vulnerability allows an unauthenticated attacker to create a denial of service condition on the system. Additional Analyst Notes: - CISA ADP Vulnrichmen
ticated attacker to create a denial of service condition on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-2593 - https://bugzilla.redhat.com/show_bug.cgi?id=2384787 - https://lore.kernel.org/lkml/CAH2r5msyEy20e=FBx6wPWWc3kXzNR4b+zHshSqidRdFKVf_7Jg@mail.gmail.com/
CVE ID: CVE-2023-2594 State: PUBLISHED Published: 2023-05-09T12:31:03.673Z Last Updated: 2024-08-02T06:26:09.706Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Food Ordering Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Food Ordering Management System 1.0. Affected is an unknown function of the component Registration. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-228396. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.228
vulnerability is VDB-228396. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.228396 - https://vuldb.com/?ctiid.228396
CVE ID: CVE-2023-2595 State: PUBLISHED Published: 2023-05-09T12:31:04.703Z Last Updated: 2024-08-02T06:26:09.860Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Billing Management System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Billing Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file ajax_service.php of the component POST Parameter Handler. The manipulation of the argument drop_services leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228397 was ass
an be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228397 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.228397 - https://vuldb.com/?ctiid.228397 - https://github.com/Yastar/bug_report/blob/main/SQLi-1.md
CVE ID: CVE-2023-2596 State: PUBLISHED Published: 2023-05-09T13:00:05.254Z Last Updated: 2024-08-02T06:26:09.825Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Reviewer System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Reviewer System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /reviewer/system/system/admins/manage/users/user-update.php of the component GET Parameter Handler. The manipulation of the argument user_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-228398 is
ction. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-228398 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.228398 - https://vuldb.com/?ctiid.228398 - https://github.com/rick13795/bug_report/blob/main/SQLi-1.md
CVE ID: CVE-2023-2597 State: PUBLISHED Published: 2023-05-22T00:00:00 Last Updated: 2024-08-02T06:26:09.798Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Eclipse Foundation Products: Eclipse OpenJ9 Problem Types: CWE-120 Description: In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled by default in OpenJ9 builds) the size of a string is not properly checked against the size of the buffer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/eclipse-openj9/openj9/pull/17259 - https://security.netapp.com/advisory/ntap-20240621-0006/
CVE ID: CVE-2023-2598 State: PUBLISHED Published: 2023-06-01T00:00:00.000Z Last Updated: 2025-04-23T16:21:25.896Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A flaw was found in the fixed buffer registration code for io_uring (io_sqe_buffer_register in io_uring/rsrc.c) in the Linux kernel that allows out-of-bounds access to physical memory beyond the end of the buffer. This flaw enables full local privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openwall.com/lists/oss-security/2023/05/08/3 - https://security.netapp.com/advisory/ntap-20230703-0006/ - http://www.openwall.com/lists/oss-security/2024