Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6304 State: PUBLISHED Published: 2023-11-27T00:31:04.537Z Last Updated: 2024-08-02T08:28:20.813Z Severity: N/A (CVSS 8.3 AV:N/AC:L/Au:M/C:C/I:C/A:C) Vendors: Tecno Products: 4G Portable WiFi TR118 Problem Types: CWE-78 Description: A vulnerability was found in Tecno 4G Portable WiFi TR118 TR118-M30E-RR-D-EnFrArSwHaPo-OP-V008-20220830. It has been declared as critical. This vulnerability affects unknown code of the file /goform/goform_get_cmd_process of the component Ping Tool. The manipulation of the argument url leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-246130 is the identifier assi
n be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-246130 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.246130 - https://vuldb.com/?ctiid.246130 - https://drive.google.com/file/d/1DUSlAxTbNLBdv1aLUAn-tDMu6Z1rHYH8/view
CVE ID: CVE-2023-6305 State: PUBLISHED Published: 2023-11-27T00:31:05.561Z Last Updated: 2024-08-02T08:28:20.351Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Free and Open Source Inventory Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file ample/app/ajax/suppliar_data.php. The manipulation of the argument columns leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this
y be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246131. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.246131 - https://vuldb.com/?ctiid.246131 - https://github.com/BigTiger2020/2023/blob/main/Free%20and%20Open%20Source%20inventory%20management%20system/Free%20and%20Open%20Source%20inventory%20management%20system.md
CVE ID: CVE-2023-6306 State: PUBLISHED Published: 2023-11-27T01:00:05.795Z Last Updated: 2024-08-02T08:28:21.276Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Free and Open Source Inventory Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Free and Open Source Inventory Management System 1.0. Affected is an unknown function of the file /ample/app/ajax/member_data.php. The manipulation of the argument columns leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is
attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-246132. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.246132 - https://vuldb.com/?ctiid.246132 - https://github.com/BigTiger2020/2023/blob/main/Free%20and%20Open%20Source%20inventory%20management%20system/Free%20and%20Open%20Source%20inventory%20management%20system2.md
CVE ID: CVE-2023-6307 State: PUBLISHED Published: 2023-11-27T01:00:06.877Z Last Updated: 2024-10-11T18:05:37.481Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: jeecgboot Products: JimuReport Problem Types: CWE-23 Description: A vulnerability classified as critical was found in jeecgboot JimuReport up to 1.6.1. Affected by this vulnerability is an unknown functionality of the file /download/image. The manipulation of the argument imageUrl leads to relative path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-246133 was assigned to this vulnerability. NOTE: The vendor was contacted early about this
be used. The identifier VDB-246133 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.246133 - https://vuldb.com/?ctiid.246133 - https://github.com/N0b1e6/exp/blob/main/README.md
CVE ID: CVE-2023-6308 State: PUBLISHED Published: 2023-11-27T01:31:03.980Z Last Updated: 2024-08-02T08:28:21.827Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Xiamen Four-Faith Products: Video Surveillance Management System Problem Types: CWE-434 Description: A vulnerability, which was classified as critical, has been found in Xiamen Four-Faith Video Surveillance Management System 2016/2017. Affected by this issue is some unknown functionality of the component Apache Struts. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-246134 is the identifier assigned to this vulnerabilit
The exploit has been disclosed to the public and may be used. VDB-246134 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.246134 - https://vuldb.com/?ctiid.246134 - https://github.com/gatsby2003/Struts2-046/blob/main/Xiamen%20Four-Faith%20Communication%20Technology%20Co.,%20Ltd.%20video%20surveillance%20management%20system%20has%20a%20command%20execution%20vulnerability.md
CVE ID: CVE-2023-6309 State: PUBLISHED Published: 2023-11-27T01:31:05.012Z Last Updated: 2024-10-10T20:27:23.943Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: moses-smt Products: mosesdecoder Problem Types: CWE-78 Description: A vulnerability, which was classified as critical, was found in moses-smt mosesdecoder up to 4.0. This affects an unknown part of the file contrib/iSenWeb/trans_result.php. The manipulation of the argument input1 leads to os command injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246135. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
ated identifier of this vulnerability is VDB-246135. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.246135 - https://vuldb.com/?ctiid.246135 - https://github.com/moses-smt/mosesdecoder/issues/237
CVE ID: CVE-2023-6310 State: PUBLISHED Published: 2023-11-27T02:00:05.747Z Last Updated: 2024-08-29T19:08:05.546Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Loan Management System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Loan Management System 1.0 and classified as critical. This vulnerability affects the function delete_borrower of the file deleteBorrower.php. The manipulation of the argument borrower_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-246136. Additional Analyst Notes: - C
sclosed to the public and may be used. The identifier of this vulnerability is VDB-246136. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.246136 - https://vuldb.com/?ctiid.246136 - https://github.com/joinia/webray.com.cn/blob/main/Loan-Management-System/lmssql%20-%20browser.md
CVE ID: CVE-2023-6311 State: PUBLISHED Published: 2023-11-27T02:00:06.792Z Last Updated: 2024-08-02T08:28:21.325Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Loan Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Loan Management System 1.0 and classified as critical. This issue affects the function delete_ltype of the file delete_ltype.php of the component Loan Type Page. The manipulation of the argument ltype_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-246137 was assigned to this vulnerability. Addition
has been disclosed to the public and may be used. The identifier VDB-246137 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.246137 - https://vuldb.com/?ctiid.246137 - https://github.com/joinia/webray.com.cn/blob/main/Loan-Management-System/lmssql%20-%20deleteltype.md
CVE ID: CVE-2023-6312 State: PUBLISHED Published: 2023-11-27T02:31:03.946Z Last Updated: 2024-10-10T20:26:21.780Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Loan Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Loan Management System 1.0. It has been classified as critical. Affected is the function delete_user of the file deleteUser.php of the component Users Page. The manipulation of the argument user_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-246138 is the identifier assigned to this vulnerability. Additio
t has been disclosed to the public and may be used. VDB-246138 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.246138 - https://vuldb.com/?ctiid.246138 - https://github.com/joinia/webray.com.cn/blob/main/Loan-Management-System/lmssql%20-%20deleteuser.md
CVE ID: CVE-2023-6313 State: PUBLISHED Published: 2023-11-27T02:31:04.995Z Last Updated: 2024-11-21T15:30:05.913Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: URL Shortener Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester URL Shortener 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Long URL Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246139. Additional Analyst Notes: - CVE Program Container
e used. The associated identifier of this vulnerability is VDB-246139. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.246139 - https://vuldb.com/?ctiid.246139 - https://github.com/will121351/wenqin.webray.com.cn/blob/main/CVE-project/url-shortener.md
CVE ID: CVE-2023-6314 State: PUBLISHED Published: 2023-12-19T00:24:37.946Z Last Updated: 2024-08-27T19:01:32.558Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Panasonic Products: Control FPWIN Pro Description: Stack-based buffer overflow in FPWin Pro version 7.7.0.0 and all previous versions may allow attackers to execute arbitrary code via a specially crafted project file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://industry.panasonic.eu/products/automation-devices-solutions/programmable-logic-controllers-plc/plc-software/programming-software-control-fpwin-pro
CVE ID: CVE-2023-6315 State: PUBLISHED Published: 2023-12-19T00:25:12.122Z Last Updated: 2024-09-24T14:14:13.807Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Panasonic Products: Control FPWIN Pro Description: Out-of-bouds read vulnerability in FPWin Pro version 7.7.0.0 and all previous versions may allow attackers to execute arbitrary code via a specially crafted project file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://industry.panasonic.eu/products/automation-devices-solutions/programmable-logic-controllers-plc/plc-software/programming-software-control-fpwin-pro
CVE ID: CVE-2023-6316 State: PUBLISHED Published: 2024-01-11T08:32:51.833Z Last Updated: 2024-11-14T15:49:35.806Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: inc2734 Products: MW WP Form Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The MW WP Form plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the '_single_file_upload' function in versions up to, and including, 5.0.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CVE Progr
files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b2c03142-be30-4173-a140-14d73a16dd2b?source=cve - https://plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.0.1/classes/models/class.file.php#L60 - https://plugins.trac.wordpress.org/changeset/3003065/mw-wp-form#file15
CVE ID: CVE-2023-6317 State: PUBLISHED Published: 2024-04-09T13:41:34.843Z Last Updated: 2024-08-02T08:28:21.578Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: LG Products: WebOS Problem Types: CWE-639 Description: A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account without asking the user for the security PIN. Full versions and TV models affected: webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA webOS 5.5.0 - 04.50.51 running on OLED55CXPUA webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA
42 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/ - https://lgsecurity.lge.com/bulletins/tv#updateDetails
CVE ID: CVE-2023-6318 State: PUBLISHED Published: 2024-04-09T13:41:47.666Z Last Updated: 2024-08-02T08:28:21.366Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: LG Products: webOS Problem Types: CWE-78 Description: A command injection vulnerability exists in the processAnalyticsReport method from the com.webos.service.cloudupload service on webOS version 5 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability. Full versions and TV models affected: * webOS 5.5.0 - 04.50.51 running on OLED55CXPUA * webOS 6.3.3-442 (kisscurl-kinglake) - 03.36
ns and TV models affected: * webOS 5.5.0 - 04.50.51 running on OLED55CXPUA * webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB * webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/ - https://lgsecurity.lge.com/bulletins/tv#updateDetails
CVE ID: CVE-2023-6319 State: PUBLISHED Published: 2024-04-09T13:42:06.203Z Last Updated: 2024-08-02T08:28:21.212Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: LG Products: webOS Problem Types: CWE-78 Description: A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS version 4 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability. * webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA * webOS 5.5.0 - 04.50.51 running on OLED55CXPUA * webOS 6.3.3-442 (kisscurl-k
S 4.9.7 - 5.30.40 running on LG43UM7000PLA * webOS 5.5.0 - 04.50.51 running on OLED55CXPUA * webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB * webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/ - https://lgsecurity.lge.com/bulletins/tv#updateDetails
CVE ID: CVE-2023-6320 State: PUBLISHED Published: 2024-04-09T13:43:35.166Z Last Updated: 2024-08-02T08:28:21.166Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: LG Products: webOS Problem Types: CWE-78 Description: A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and 6. A series of specially crafted requests can lead to command execution as the dbus user. An attacker can make authenticated requests to trigger this vulnerability. Full versions and TV models affected: * webOS 5.5.0 - 04.50.51 running on OLED55CXPUA * webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running
odels affected: * webOS 5.5.0 - 04.50.51 running on OLED55CXPUA * webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/ - https://lgsecurity.lge.com/bulletins/tv#updateDetails
CVE ID: CVE-2023-6321 State: PUBLISHED Published: 2024-05-15T12:07:44.554Z Last Updated: 2024-08-02T08:28:21.329Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Owlet Products: Cam v2, Cam v1 Problem Types: CWE-78 Description: A command injection vulnerability exists in the IOCTL that manages OTA updates. A specially crafted command can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bitdefender.com/blog/labs/notes-on-throughtek-kalay-vulnerabilities-and-their-impact/
CVE ID: CVE-2023-6322 State: PUBLISHED Published: 2024-05-15T12:08:24.069Z Last Updated: 2024-08-02T08:28:21.761Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Roku, Wyze Products: Indoor Camera SE, Cam v3 Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the message parsing functionality of the Roku Indoor Camera SE version 3.0.2.4679 and Wyze Cam v3 version 4.36.11.5859. A specially crafted message can lead to stack-based buffer overflow. An attacker can make authenticated requests to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bitdefen
ulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bitdefender.com/blog/labs/notes-on-throughtek-kalay-vulnerabilities-and-their-impact/
CVE ID: CVE-2023-6323 State: PUBLISHED Published: 2024-05-15T12:08:57.397Z Last Updated: 2024-08-02T08:28:21.783Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ThroughTek Products: Kalay SDK Problem Types: CWE-345 Description: ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bitdefender.com/blog/labs/notes-on-throughtek-kalay-vulnerabilities-and-their-impact/
CVE ID: CVE-2023-6324 State: PUBLISHED Published: 2024-05-15T12:09:29.682Z Last Updated: 2024-08-02T08:28:21.511Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: ThroughTek Products: Kalay SDK Problem Types: CWE-457 Description: ThroughTek Kalay SDK uses a predictable PSK value in the DTLS session when encountering an unexpected PSK identity Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bitdefender.com/blog/labs/notes-on-throughtek-kalay-vulnerabilities-and-their-impact/
CVE ID: CVE-2023-6325 State: PUBLISHED Published: 2024-05-23T04:30:53.799Z Last Updated: 2024-08-02T08:28:21.144Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: rometheme Products: RomethemeForm For Elementor Problem Types: CWE-862 Missing Authorization Description: The RomethemeForm For Elementor plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the export_entries, rtformnewform, and rtformupdate functions in all versions up to, and including, 1.1.5. This makes it possible for unauthenticated attackers to export arbitrary form submissions, create new forms, or update any post title or ce
ble for unauthenticated attackers to export arbitrary form submissions, create new forms, or update any post title or certain metadata. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/81a293ea-abda-4c90-a109-791ca5ba89a4?source=cve - https://plugins.trac.wordpress.org/browser/romethemeform/tags/1.1.2/modules/form/form.php - https://plugins.trac.wordpress.org/changeset/3090708/romethemeform/trunk?contextall=1&old=3079080&old_path=%2Fromethemeform%2Ftrunk
CVE ID: CVE-2023-6326 State: PUBLISHED Published: 2024-03-02T11:15:33.959Z Last Updated: 2024-08-02T08:28:21.306Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: averta Products: Master Slider – Responsive Touch Slider Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.9.3. This is due to missing or incorrect nonce validation on the 'process_bulk_action' function. This makes it possible for unauthenticated attackers to duplicate or delete arbitrary sliders via a forged request granted they can
it possible for unauthenticated attackers to duplicate or delete arbitrary sliders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5e0a7108-15ef-42d0-adce-fd5b0e6faf3c?source=cve - https://plugins.trac.wordpress.org/browser/master-slider/trunk/admin/includes/classes/class-msp-list-table.php
CVE ID: CVE-2023-6327 State: PUBLISHED Published: 2024-05-09T20:03:21.876Z Last Updated: 2024-08-02T08:28:21.809Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: devitemsllc Products: ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) Problem Types: CWE-862 Missing Authorization Description: The ShopLentor (formerly WooLentor) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the purchased_new_products function in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to view all products purchased in the
up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to view all products purchased in the past week, along with the users that purchased them. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/263324cb-31b7-40ad-ad7d-4582e128cd75?source=cve - https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/2.7.4/includes/modules/sales-notification/class.sale_notification.php - https://plugins.trac.wordpress.org/changeset/3080097/woolentor-addons/trunk/includes/modules/sales-notification/class.sale_notification.php?contextall=1&old=3061864&old_path=%2Fwoolentor-addo