Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-2699 State: PUBLISHED Published: 2023-05-14T12:00:04.999Z Last Updated: 2024-08-02T06:33:04.300Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Lost and Found Information System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Lost and Found Information System 1.0. Affected by this issue is some unknown functionality of the file admin/?page=items/view_item of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier o
ion. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228980. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.228980 - https://vuldb.com/?ctiid.228980 - https://github.com/tht1997/CVE_2023/blob/main/Lost%20and%20Found%20Information%20System/img/view_item.png
CVE ID: CVE-2023-2700 State: PUBLISHED Published: 2023-05-15T00:00:00.000Z Last Updated: 2025-01-28T16:26:08.310Z Vendors: n/a Products: libvirt Problem Types: Memory leak Description: A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction array within the parent struct's g_autoptr cleanup. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-2700 - https://bugzilla.redhat.com/show_bug.cgi?id=2203653 - https://gitlab.com/libvirt/libvirt/-/commit/6425a311b8a
023-2700 - https://bugzilla.redhat.com/show_bug.cgi?id=2203653 - https://gitlab.com/libvirt/libvirt/-/commit/6425a311b8ad19d6f9c0b315bf1d722551ea3585#874a1e768ade6ceb4538931cbc06248e73223306 - https://security.netapp.com/advisory/ntap-20230706-0001/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVK6JKP36CHE7YAFDJNPNLTW4OWJJ7TQ/
CVE ID: CVE-2023-2701 State: PUBLISHED Published: 2023-07-17T13:30:00.715Z Last Updated: 2024-10-30T13:59:16.682Z Vendors: Unknown Products: gravityforms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Gravity Forms WordPress plugin before 2.7.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high-privileged users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/298fbe34-62c2-4e56-9bdb-90da570c5bbe
CVE ID: CVE-2023-2702 State: PUBLISHED Published: 2023-05-23T19:14:36.748Z Last Updated: 2025-01-17T17:44:13.297Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Finex Media Products: Competition Management System Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Finex Media Competition Management System allows Authentication Abuse, Authentication Bypass.This issue affects Competition Management System: before 23.07. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0283
CVE ID: CVE-2023-2703 State: PUBLISHED Published: 2023-05-23T19:19:47.883Z Last Updated: 2025-01-17T16:11:59.898Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Finex Media Products: Competition Management System Problem Types: CWE-359 Description: Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Finex Media Competition Management System allows Retrieve Embedded Sensitive Data, Collect Data as Provided by Users.This issue affects Competition Management System: before 23.07. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0283
CVE ID: CVE-2023-2704 State: PUBLISHED Published: 2023-05-19T02:03:19.169Z Last Updated: 2025-01-13T16:49:06.520Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: vibethemes Products: BP Social Connect Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: The BP Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.5. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have a
sible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/44c96df2-530a-4ebe-b722-c606a7b135f9?source=cve - https://plugins.trac.wordpress.org/browser/bp-social-connect/tags/1.5/includes/social/facebook/class.facebook.php#L138 - https://plugins.trac.wordpress.org/browser/bp-social-connect/tags/1.5/includes/social/facebook/class.facebook.php#L188 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2914042%40bp-social-connect%2Ftrunk&old
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2914042%40bp-social-connect%2Ftrunk&old=1904372%40bp-social-connect%2Ftrunk&sfp_email=&sfph_mail=#file6 - https://lana.codes/lanavdb/1bd0dfd9-ffec-4d69-bc55-286751300cab/
CVE ID: CVE-2023-2705 State: PUBLISHED Published: 2023-09-11T19:46:06.500Z Last Updated: 2024-09-26T15:42:31.282Z Vendors: Unknown Products: gAppointments Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The gAppointments WordPress plugin before 1.10.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0b3c83ad-d490-4ca3-8589-39163ea5e24b
CVE ID: CVE-2023-2706 State: PUBLISHED Published: 2023-05-17T01:58:49.447Z Last Updated: 2025-01-13T16:49:33.542Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: xootix Products: OTP Login Woocommerce & Gravity Forms Problem Types: CWE-287 Improper Authentication Description: The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for unauthenticated attackers to obtain login codes for administrators. This does require an attacker hav
es it possible for unauthenticated attackers to obtain login codes for administrators. This does require an attacker have access to the phone number configured for an account, which can be obtained via social engineering or reconnaissance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b1b7b653-496f-467a-9513-4be1891f38ae?source=cve - https://plugins.trac.wordpress.org/browser/mobile-login-woocommerce/tags/2.2/includes/class-xoo-ml-verification.php#L362 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2912731%40mobile-login-woocommerce&new=2912731%40mobile-lo
c.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2912731%40mobile-login-woocommerce&new=2912731%40mobile-login-woocommerce&sfp_email=&sfph_mail= - https://lana.codes/lanavdb/87b5e80e-fd5b-47c3-bf82-088bdf4573b5/
CVE ID: CVE-2023-2707 State: PUBLISHED Published: 2023-11-27T16:22:05.473Z Last Updated: 2025-06-05T13:58:40.324Z Vendors: Unknown Products: gAppointments Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The gAppointments WordPress plugin through 1.9.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/e5664da4-5b78-4e42-be6b-e0d7b73a85b0
CVE ID: CVE-2023-2708 State: PUBLISHED Published: 2023-05-16T02:04:27.089Z Last Updated: 2025-02-05T19:45:22.594Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nik00726 Products: Video Gallery Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully
it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8cfbad9f-61ba-4216-9078-c1e7e809899a?source=cve - https://plugins.trac.wordpress.org/browser/video-slider-with-thumbnails/tags/1.0.11/video-slider-with-thumbnails.php#L1105 - https://plugins.trac.wordpress.org/browser/video-slider-with-thumbnails/tags/1.0.10/video-slider-with-thumbnails.php#L1103
CVE ID: CVE-2023-2709 State: PUBLISHED Published: 2023-07-10T12:40:49.989Z Last Updated: 2024-11-08T18:22:53.616Z Vendors: Unknown Products: AN_GradeBook Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The AN_GradeBook WordPress plugin through 5.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2504dadb-1086-4fa9-8fc7-b93018423515
CVE ID: CVE-2023-2710 State: PUBLISHED Published: 2023-05-16T02:04:29.448Z Last Updated: 2025-02-05T19:45:11.888Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nik00726 Products: video carousel slider with lightbox Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The video carousel slider with lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in p
itization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e88bb3a8-de24-46fb-a3e4-9ca3fdd4cca7?source=cve - https://plugins.trac.wordpress.org/browser/wp-responsive-video-gallery-with-lightbox/tags/1.0.23/wp-responsive-video-gallery-with-lightbox.php#L1023 - https://plugins.trac.wordpress.org/browser/wp-responsive-video-gallery-with-lightbox/tags/1.0.22/wp-responsive-video-gall
ttps://plugins.trac.wordpress.org/browser/wp-responsive-video-gallery-with-lightbox/tags/1.0.22/wp-responsive-video-gallery-with-lightbox.php#L1023
CVE ID: CVE-2023-2711 State: PUBLISHED Published: 2023-06-27T13:17:18.296Z Last Updated: 2024-11-27T19:21:58.460Z Vendors: Unknown Products: Ultimate Product Catalog Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ultimate Product Catalog WordPress plugin before 5.2.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/71c5b5b5-8694-4738-8e4b-8670a8d21c86
CVE ID: CVE-2023-2712 State: PUBLISHED Published: 2023-05-20T09:49:53.583Z Last Updated: 2025-02-12T16:23:56.028Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Unknown Products: Rental Module Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform allows Command Injection, Using Malicious Files, Upload a Web Shell to a Web Server.This issue affects Rental Module: before 23.05.15. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0276
CVE ID: CVE-2023-2713 State: PUBLISHED Published: 2023-05-20T09:52:22.896Z Last Updated: 2025-02-12T16:32:42.735Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Unknown Products: Rental Module Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform allows Authentication Abuse, Authentication Bypass.This issue affects Rental Module: before 23.05.15. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0276
CVE ID: CVE-2023-2714 State: PUBLISHED Published: 2023-05-20T02:03:20.188Z Last Updated: 2025-01-13T16:48:48.322Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: trainingbusinesspros Products: WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg Problem Types: CWE-862 Missing Authorization Description: The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'check_license' functions in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change the license key and suppo
t possible for authenticated attackers, with subscriber-level permissions and above, to change the license key and support license key, but it can only be changed to a valid license key. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/29700844-b41d-4f10-90a7-06c8574d8d2a?source=cve - https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/admin/guided-setup/guided-setup.php#L111 - https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/admin/help/help-page.php#L41 - https://plugins.trac.wordpress.org/changeset/2914493/groundhogg/tags/2.7.10/admin/help/help-page.php
CVE ID: CVE-2023-2715 State: PUBLISHED Published: 2023-05-20T02:03:18.674Z Last Updated: 2025-01-13T16:48:57.118Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: trainingbusinesspros Products: WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg Problem Types: CWE-862 Missing Authorization Description: The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_ticket' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers to create a support ticket that sends the website's data to the plugin developer,
possible for authenticated attackers to create a support ticket that sends the website's data to the plugin developer, and it is also possible to create an admin access with an auto login link that is also sent to the plugin developer with the ticket. It only works if the plugin is activated with a valid license. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/24747507-8f24-499e-a257-d379dc171e18?source=cve - https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/admin/help/help-page.php#L220 - https://plugins.trac.wordpress.org/changeset/2914493/groundhogg/tags/2.7.10/admin/help/
/admin/help/help-page.php#L220 - https://plugins.trac.wordpress.org/changeset/2914493/groundhogg/tags/2.7.10/admin/help/help-page.php
CVE ID: CVE-2023-2716 State: PUBLISHED Published: 2023-05-20T02:03:22.121Z Last Updated: 2025-01-13T16:48:38.115Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: trainingbusinesspros Products: WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg Problem Types: CWE-862 Missing Authorization Description: The Groundhogg plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'ajax_upload_file' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload a file to
2.7.9.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload a file to the contact, and then lists all the other uploaded files related to the contact. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3c5bde0e-3138-4995-92ae-6deaf6b7be5b?source=cve - https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/admin/contacts/contacts-page.php#L458 - https://plugins.trac.wordpress.org/changeset/2914493/groundhogg/tags/2.7.10/admin/contacts/contacts-page.php
CVE ID: CVE-2023-2717 State: PUBLISHED Published: 2023-05-20T02:03:24.840Z Last Updated: 2025-01-13T16:48:20.565Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: trainingbusinesspros Products: WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8. This is due to missing nonce validation on the 'enable_safe_mode' function. This makes it possible for unauthenticated attackers to enable safe mode, which disables all other plugins, via a forg
. This makes it possible for unauthenticated attackers to enable safe mode, which disables all other plugins, via a forged request if they can successfully trick an administrator into performing an action such as clicking on a link. A warning message about safe mode is displayed to the admin, which can be easily disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/af73240c-b711-4e91-9998-5f7e6a9a4fb9?source=cve - https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/admin/help/help-page.php#L67 - https://plugins.trac.wordpress.org/changeset/2914493/groundhogg/tags/2.7.10/admi
/2.7.9.8/admin/help/help-page.php#L67 - https://plugins.trac.wordpress.org/changeset/2914493/groundhogg/tags/2.7.10/admin/help/help-page.php
CVE ID: CVE-2023-2718 State: PUBLISHED Published: 2023-06-12T17:28:21.468Z Last Updated: 2024-08-02T06:33:05.488Z Vendors: Unknown Products: Contact Form Email Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Contact Form Email WordPress plugin before 1.3.38 does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8ad824a6-2d49-4f02-8252-393c59aa9705 - https://www.onvio.nl/nieuws/research-day-discovering-vulnerabilities-in-wordpress-plugins
CVE ID: CVE-2023-2719 State: PUBLISHED Published: 2023-06-19T10:52:42.822Z Last Updated: 2024-12-12T21:03:39.440Z Vendors: Unknown Products: SupportCandy Problem Types: CWE-89 SQL Injection Description: The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in the REST API before using it in an SQL statement, leading to an SQL Injection exploitable by users with a role as low as Subscriber. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d9f6f4e7-a237-49c0-aba0-2934ab019e35
CVE ID: CVE-2023-2721 State: PUBLISHED Published: 2023-05-16T18:45:33.757Z Last Updated: 2025-05-05T16:01:00.512Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Navigation in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html - https://crbug.com/1444360 - https://www.debian.org/security/2023/dsa-5404 - https://lists.fedoraproject.org/archives/list/package-a
ug.com/1444360 - https://www.debian.org/security/2023/dsa-5404 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73XUIHJ6UT75VFPDPLJOXJON7MVIKVZI/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXFL4TDAH72PRCPD5UPZMJMKIMVOPLTI/ - https://security.gentoo.org/glsa/202309-17 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2023-2722 State: PUBLISHED Published: 2023-05-16T18:45:33.967Z Last Updated: 2025-05-05T16:00:48.950Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Autofill UI in Google Chrome on Android prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html - https://crbug.com/1400905 - https://www.debian.org/security/2023/dsa-5404 - https://lists.fedoraproject.org/archives/list/p
ps://crbug.com/1400905 - https://www.debian.org/security/2023/dsa-5404 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73XUIHJ6UT75VFPDPLJOXJON7MVIKVZI/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXFL4TDAH72PRCPD5UPZMJMKIMVOPLTI/ - https://security.gentoo.org/glsa/202309-17 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2023-2723 State: PUBLISHED Published: 2023-05-16T18:45:34.099Z Last Updated: 2025-05-05T16:00:39.211Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in DevTools in Google Chrome prior to 113.0.5672.126 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html - https://crbug.com/1435166 - https://www.debian.org/security/2023/dsa-5404 - https://lists.fedora