Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-1240 State: PUBLISHED Published: 2023-03-07T00:00:00.000Z Last Updated: 2025-03-04T19:11:12.968Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: answerdev Products: answerdev/answer Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/a24f57a4-22e3-4a17-8227-6a410a11498a - https://github.com/answerdev/answer/commit/90bfa0dcc7b49482f1d1e31aee3ab073f3c13dd9
CVE ID: CVE-2023-1241 State: PUBLISHED Published: 2023-03-07T00:00:00.000Z Last Updated: 2025-03-06T17:04:08.685Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: answerdev Products: answerdev/answer Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/answerdev/answer/commit/90bfa0dcc7b49482f1d1e31aee3ab073f3c13dd9 - https://huntr.dev/bounties/e0e9b1bb-3025-4b9f-acb4-16a5da28aa3c
CVE ID: CVE-2023-1242 State: PUBLISHED Published: 2023-03-07T00:00:00.000Z Last Updated: 2025-03-05T19:29:06.967Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: answerdev Products: answerdev/answer Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/answerdev/answer/commit/90bfa0dcc7b49482f1d1e31aee3ab073f3c13dd9 - https://huntr.dev/bounties/71c24c5e-ceb2-45cf-bda7-fa195d37e289
CVE ID: CVE-2023-1243 State: PUBLISHED Published: 2023-03-07T00:00:00.000Z Last Updated: 2025-03-06T14:44:32.440Z Severity: MEDIUM (CVSS 6 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L) Vendors: answerdev Products: answerdev/answer Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/answerdev/answer/commit/9870ed87fb24ed468aaf1e169c2d028e0f375106 - https://huntr.dev/bounties/1d62d35a-b096-4b76-a021-347c3f1c570c
CVE ID: CVE-2023-1244 State: PUBLISHED Published: 2023-03-07T00:00:00.000Z Last Updated: 2025-03-06T14:41:31.634Z Severity: CRITICAL (CVSS 9.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: answerdev Products: answerdev/answer Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/answerdev/answer/commit/9870ed87fb24ed468aaf1e169c2d028e0f375106 - https://huntr.dev/bounties/bcab9555-8a35-42b2-a7de-0a79fd710b52
CVE ID: CVE-2023-1245 State: PUBLISHED Published: 2023-03-07T00:00:00.000Z Last Updated: 2025-03-06T14:40:01.895Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: answerdev Products: answerdev/answer Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/f8011bb3-8212-4937-aa58-79f4b73be004 - https://github.com/answerdev/answer/commit/71a4cdac81112975969129d308899edd155c0e80
CVE ID: CVE-2023-1246 State: PUBLISHED Published: 2023-03-10T10:58:45.107Z Last Updated: 2025-02-27T19:20:18.090Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Saysis Products: Starcities Problem Types: CWE-552 Description: Files or Directories Accessible to External Parties vulnerability in Saysis Starcities allows Collect Data from Common Resource Locations.This issue affects Starcities: through 1.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0140
CVE ID: CVE-2023-1247 State: REJECTED Published: N/A Last Updated: 2023-03-27T00:00:00 Description: No description available.
CVE ID: CVE-2023-1248 State: PUBLISHED Published: 2023-03-20T08:19:34.182Z Last Updated: 2025-02-26T19:22:27.396Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: OTRS AG Products: OTRS, ((OTRS)) Community Edition Problem Types: CWE-79 Description: Improper Input Validation vulnerability in OTRS AG OTRS (Ticket Actions modules), OTRS AG ((OTRS)) Community Edition (Ticket Actions modules) allows Cross-Site Scripting (XSS).This issue affects OTRS: from 7.0.X before 7.0.42; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-a
st Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-advisory-2023-01/
CVE ID: CVE-2023-1249 State: PUBLISHED Published: 2023-03-23T00:00:00.000Z Last Updated: 2025-03-19T15:45:25.837Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A use-after-free flaw was found in the Linux kernel’s core dump subsystem. This flaw allows a local user to crash the system. Only if patch 390031c94211 ("coredump: Use the vma snapshot in fill_files_note") not applied yet, then kernel could be affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchwork.kernel.org/project/linux-fsdevel/patch/87iltzn3nd.fsf_-_%40email.froward.int.ebiederm.org/ - http://packetstormsecurity.com/files/171912/CentOS-Stream-9-Miss
h/87iltzn3nd.fsf_-_%40email.froward.int.ebiederm.org/ - http://packetstormsecurity.com/files/171912/CentOS-Stream-9-Missing-Kernel-Security-Fix.html
CVE ID: CVE-2023-1250 State: PUBLISHED Published: 2023-03-20T08:20:39.331Z Last Updated: 2025-02-26T19:20:36.576Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: OTRS AG Products: OTRS, ((OTRS)) Community Edition Problem Types: CWE-20 Description: Improper Input Validation vulnerability in OTRS AG OTRS (ACL modules), OTRS AG ((OTRS)) Community Edition (ACL modules) allows Local Execution of Code. When creating/importing an ACL it was possible to inject code that gets executed via manipulated comments and ACL-names This issue affects OTRS: from 7.0.X before 7.0.42, from 8.0.X before 8.0.31; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34. Additional Analy
m 7.0.X before 7.0.42, from 8.0.X before 8.0.31; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-advisory-2023-02/
CVE ID: CVE-2023-1251 State: PUBLISHED Published: 2023-03-09T07:44:35.863Z Last Updated: 2025-02-28T17:13:16.717Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Akinsoft Products: Wolvox Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Akinsoft Wolvox. This issue affects Wolvox: before 8.02.03. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0136
CVE ID: CVE-2023-1252 State: PUBLISHED Published: 2023-03-23T00:00:00.000Z Last Updated: 2025-04-23T16:23:30.792Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations simultaneously with the overlay FS usage. This flaw allows a local user to crash or potentially escalate their privileges on the system. Only if patch 9a2544037600 ("ovl: fix use after free in struct ovl_aio_req") not applied yet, the kernel could be affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lore.kernel.org/lkml/20211115165433.4499512
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lore.kernel.org/lkml/20211115165433.449951285%40linuxfoundation.org/ - https://security.netapp.com/advisory/ntap-20230505-0005/
CVE ID: CVE-2023-1253 State: PUBLISHED Published: 2023-03-07T14:54:28.997Z Last Updated: 2024-08-02T05:40:59.826Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Health Center Patient Record Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Health Center Patient Record Management System 1.0. This affects an unknown part of the file login.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-2224
he exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222483. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222483 - https://vuldb.com/?ctiid.222483 - https://github.com/2689469248/bug_report/blob/main/vendors/razormist/Health%20Center%20Patient%20Record%20Management/SQLi-1.md
CVE ID: CVE-2023-1254 State: PUBLISHED Published: 2023-03-07T14:54:30.691Z Last Updated: 2024-08-02T05:40:59.808Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Health Center Patient Record Management System Problem Types: CWE-79 Description: A vulnerability has been found in SourceCodester Health Center Patient Record Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file birthing_print.php. The manipulation of the argument birth_id leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-
ted remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222484. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222484 - https://vuldb.com/?ctiid.222484 - https://github.com/2689469248/bug_report/blob/main/vendors/razormist/Health%20Center%20Patient%20Record%20Management/XSS-1.md
CVE ID: CVE-2023-1255 State: PUBLISHED Published: 2023-04-20T16:14:54.707Z Last Updated: 2025-02-13T16:39:19.031Z Vendors: OpenSSL Products: OpenSSL Problem Types: buffer over-read Description: Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, leading to a crash. Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM platform can crash in rare circumstances. The AES-XTS algorithm is usually used for disk encryption. The AES-XTS cipher decryption implementation for 64 bit ARM platform will read past the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16
ntation for 64 bit ARM platform will read past the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16 byte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext buffer is unmapped, this will trigger a crash which results in a denial of service. If an attacker can control the size and location of the ciphertext buffer being decrypted by an application using AES-XTS on 64 bit ARM, the application is affected. This is fairly unlikely making this issue a Low severity one. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20230419.txt - https://git.openssl.org/gitweb/?p=openssl.git;a=c
ment: References: - https://www.openssl.org/news/secadv/20230419.txt - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=bc2f61ad70971869b242fc1cb445b98bad50074a - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=02ac9c9420275868472f33b01def01218742b8bb - https://security.netapp.com/advisory/ntap-20230908-0006/
CVE ID: CVE-2023-1256 State: PUBLISHED Published: 2023-03-16T18:33:52.907Z Last Updated: 2025-01-16T21:42:14.018Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: AVEVA Products: AVEVA Plant SCADA, AVEVA Telemetry Server Problem Types: CWE-285 Improper Authorization Description: The listed versions of AVEVA Plant SCADA and AVEVA Telemetry Server are vulnerable to an improper authorization exploit which could allow an unauthenticated user to remotely read data, cause denial of service, and tamper with alarm states. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-04
CVE ID: CVE-2023-1257 State: PUBLISHED Published: 2023-03-07T16:54:21.053Z Last Updated: 2025-01-16T21:55:20.265Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: MOXA Products: UC-8580 Series, UC-8540 Series, UC-8410A Series, UC-8200 Series, UC-8100A-ME-T Series, UC-8100 Series, UC-5100 Series, UC-3100 Series, UC-2100 Series, UC-2100-W Series Problem Types: CWE-1263 Description: An attacker with physical access to the affected Moxa UC Series devices can initiate a restart of the device and gain access to its BIOS. Command line options can then be altered, allowing the attacker to access the terminal. From the terminal, the attacker can modify the device’s auth
n be altered, allowing the attacker to access the terminal. From the terminal, the attacker can modify the device’s authentication files to create a new user and gain full access to the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-04
CVE ID: CVE-2023-1258 State: PUBLISHED Published: 2023-03-31T07:56:05.133Z Last Updated: 2025-02-13T16:39:19.647Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ABB Products: Flow-X Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ABB Flow-X firmware on Flow-X embedded hardware (web service modules) allows Footprinting.This issue affects Flow-X: before 4.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A9754&LanguageCode=en&DocumentPartId=&Action=Launch - http://packetstormsecurity.com/f
ownload.aspx?DocumentID=9AKK108467A9754&LanguageCode=en&DocumentPartId=&Action=Launch - http://packetstormsecurity.com/files/173610/ABB-FlowX-4.00-Information-Disclosure.html
CVE ID: CVE-2023-1259 State: PUBLISHED Published: 2023-10-14T11:09:10.321Z Last Updated: 2025-02-05T19:16:08.491Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: hotjar Products: Hotjar Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Hotjar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the hotjar_site_id in versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute
d attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9c640bcb-b6bf-4865-b713-32ca846e4ed9?source=cve - https://plugins.trac.wordpress.org/browser/hotjar/tags/1.0.14/includes/class-hotjar.php#L40
CVE ID: CVE-2023-1260 State: PUBLISHED Published: 2023-09-24T00:07:08.130Z Last Updated: 2024-08-02T05:40:59.774Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat OpenShift Container Platform 4.10, Red Hat OpenShift Container Platform 4.11, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4 Problem Types: CWE-288 Description: An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralconta
sue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:3976 - https://access.redhat.com/errata/RHSA-2023:4093 - https://access.redhat.com/errata/RHSA-2023:4312 - https://access.redhat.com/errata/RHSA-2023:4898 - https://access.redhat.com/errata/RHSA-2023:5008 - https://access.redhat.com/sec
ccess.redhat.com/errata/RHSA-2023:4898 - https://access.redhat.com/errata/RHSA-2023:5008 - https://access.redhat.com/security/cve/CVE-2023-1260 - https://bugzilla.redhat.com/show_bug.cgi?id=2176267 - https://github.com/advisories/GHSA-92hx-3mh6-hc49 - https://security.netapp.com/advisory/ntap-20231020-0010/
CVE ID: CVE-2023-1261 State: PUBLISHED Published: 2023-03-21T20:26:55.523Z Last Updated: 2025-02-26T16:28:41.639Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: silabs.com Products: Wi-SUN SDK Problem Types: CWE-862 Description: Missing MAC layer security in Silicon Labs Wi-SUN SDK v1.5.0 and earlier allows malicious node to route malicious messages through network. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/SiliconLabs/gecko_sdk - https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000SMyfRQAT?operationContext=S1
CVE ID: CVE-2023-1262 State: PUBLISHED Published: 2023-03-21T20:30:16.762Z Last Updated: 2025-02-26T16:27:52.856Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: silabs.com Products: Wi-SUN Linux Border Router Problem Types: CWE-862 Description: Missing MAC layer security in Silicon Labs Wi-SUN Linux Border Router v1.5.2 and earlier allows malicious node to route malicious messages through network. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/SiliconLabs/wisun-br-linux - https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000SMyfRQAT?operationContext=S1
CVE ID: CVE-2023-1263 State: PUBLISHED Published: 2023-03-07T21:07:47.140Z Last Updated: 2025-01-13T17:00:39.140Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: niteo Products: CMP – Coming Soon & Maintenance Plugin by NiteoThemes Problem Types: CWE-200 Information Exposure Description: The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 4.1.6 via the cmp_get_post_detail function. This can allow unauthenticated individuals to obtain the contents of any non-password-protected, published post or page even when maintenance mode is enabled. Additional Analyst Notes: - CVE Program Conta
d-protected, published post or page even when maintenance mode is enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e01b4259-ed8d-44a4-9771-470de45b14a8 - https://plugins.trac.wordpress.org/browser/cmp-coming-soon-maintenance/tags/4.1.6/niteo-cmp.php#L2759
CVE ID: CVE-2023-1264 State: PUBLISHED Published: 2023-03-07T00:00:00.000Z Last Updated: 2025-03-06T14:38:42.887Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-476 Description: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/b2989095-88f3-413a-9a39-c1c58a6e6815 - https://github.com/vim/vim/commit/7ac5023a5f1a37baafbe1043645f97ba3443d9f6 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIAKPMKJ4OZ6NYRZJO7YWMNQL2BICLYV/ - https:/
CVE ID: CVE-2023-1265 State: PUBLISHED Published: 2023-05-03T00:00:00.000Z Last Updated: 2025-01-29T21:48:35.944Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacker, under certain conditions, to obtain session tokens from all users of a GitLab instance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
all users of a GitLab instance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/394960 - https://hackerone.com/reports/1888690 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1265.json
CVE ID: CVE-2023-1266 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:15.190Z Description: No description available.
CVE ID: CVE-2023-1267 State: PUBLISHED Published: 2023-03-08T11:03:08.543Z Last Updated: 2025-02-28T18:31:17.551Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ulkem Company Products: PtteM Kart Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ulkem Company PtteM Kart.This issue affects PtteM Kart: before 2.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0133
CVE ID: CVE-2023-1269 State: PUBLISHED Published: 2023-03-08T00:00:00.000Z Last Updated: 2025-03-05T20:27:14.885Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: alextselegidis Products: alextselegidis/easyappointments Problem Types: CWE-798 Description: Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/91c31eb6-024d-4ad3-88fe-f15b03fd20f5 - https://github.com/alextselegidis/easyappointments/commit/2731d2f17c5140c562426b857e9f5d63da5c4593
CVE ID: CVE-2023-1270 State: PUBLISHED Published: 2023-03-08T00:00:00 Last Updated: 2024-08-02T05:40:59.874Z Severity: MEDIUM (CVSS 5.1 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L) Vendors: btcpayserver Products: btcpayserver/btcpayserver Problem Types: CWE-79 Description: Cross-site Scripting in GitHub repository btcpayserver/btcpayserver prior to 1.8.3. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/ad1f917f-2b25-40ef-9215-c805354c683b - https://github.com/btcpayserver/btcpayserver/commit/7b5ce8f70c060b01990d3f7109e97e0144d878a4
CVE ID: CVE-2023-1271 State: REJECTED Published: N/A Last Updated: 2023-04-13T19:37:47.060Z Description: No description available.