Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-49178 State: PUBLISHED Published: 2023-12-15T14:40:46.985Z Last Updated: 2024-08-02T21:53:43.411Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Mr. Hdwplayer Products: HDW Player Plugin (Video Player & Video Gallery) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mr. Hdwplayer HDW Player Plugin (Video Player & Video Gallery) allows Reflected XSS.This issue affects HDW Player Plugin (Video Player & Video Gallery): from n/a through 5.0. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/hdw-playe
Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/hdw-player-video-player-video-gallery/wordpress-hdw-player-plugin-video-player-video-gallery-plugin-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-49179 State: PUBLISHED Published: 2023-12-15T14:45:17.613Z Last Updated: 2024-08-02T21:53:43.443Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: N.O.U.S. Open Useful and Simple Products: Event post Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N.O.U.S. Open Useful and Simple Event post allows Stored XSS.This issue affects Event post: from n/a through 5.8.6. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/event-post/wordpress-event-post-plugin-5-8-6-cross-site-scripting-xss-vulnerability?_s
hstack.com/database/vulnerability/event-post/wordpress-event-post-plugin-5-8-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-49180 State: PUBLISHED Published: 2023-12-15T14:47:32.658Z Last Updated: 2024-08-02T21:53:43.415Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Ternstyle LLC Products: Automatic Youtube Video Posts Plugin Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ternstyle LLC Automatic Youtube Video Posts Plugin allows Stored XSS.This issue affects Automatic Youtube Video Posts Plugin: from n/a through 5.2.2. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/automatic-youtube-video-posts/wordpress-auto
gram Container: References: - https://patchstack.com/database/vulnerability/automatic-youtube-video-posts/wordpress-automatic-youtube-video-posts-plugin-plugin-5-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-49181 State: PUBLISHED Published: 2023-12-15T14:49:51.927Z Last Updated: 2024-08-02T21:53:43.415Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: WP Event Manager Products: WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Event Manager WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce allows Stored XSS.This issue affects WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce: from n/a through 3.1.40. Additional Analy
Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce: from n/a through 3.1.40. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-event-manager/wordpress-wp-event-manager-plugin-3-1-39-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE ID: CVE-2023-49182 State: PUBLISHED Published: 2023-12-15T14:52:08.191Z Last Updated: 2024-08-02T21:53:43.426Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Fabio Marzocca Products: List all posts by Authors, nested Categories and Titles Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fabio Marzocca List all posts by Authors, nested Categories and Titles allows Reflected XSS.This issue affects List all posts by Authors, nested Categories and Titles: from n/a through 2.7.10. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/databa
from n/a through 2.7.10. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/list-all-posts-by-authors-nested-categories-and-titles/wordpress-list-all-posts-by-authors-nested-categories-and-title-plugin-2-7-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-49183 State: PUBLISHED Published: 2023-12-15T14:54:38.275Z Last Updated: 2024-08-02T21:53:43.449Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NextScripts Products: NextScripts: Social Networks Auto-Poster Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NextScripts NextScripts: Social Networks Auto-Poster allows Reflected XSS.This issue affects NextScripts: Social Networks Auto-Poster: from n/a through 4.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/social-networks-auto-poster-faceboo
- CVE Program Container: References: - https://patchstack.com/database/vulnerability/social-networks-auto-poster-facebook-twitter-g/wordpress-nextscripts-social-networks-auto-poster-plugin-4-4-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-49184 State: PUBLISHED Published: 2023-12-15T14:56:35.899Z Last Updated: 2024-08-02T21:53:44.897Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: WPDeveloper Products: Parallax Slider Block Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Parallax Slider Block allows Stored XSS.This issue affects Parallax Slider Block: from n/a through 1.2.4. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/parallax-slider-block/wordpress-parallax-slider-block-plugin-1-2-4-cross-site-scripting-xss-v
com/database/vulnerability/parallax-slider-block/wordpress-parallax-slider-block-plugin-1-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-49185 State: PUBLISHED Published: 2023-12-15T14:59:27.925Z Last Updated: 2024-08-02T21:53:44.642Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Doofinder Products: Doofinder WP & WooCommerce Search Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Doofinder Doofinder WP & WooCommerce Search allows Reflected XSS.This issue affects Doofinder WP & WooCommerce Search: from n/a through 2.1.7. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/doofinder-for-woocommerce/wordpress-doofinder-wp-woocommerce
References: - https://patchstack.com/database/vulnerability/doofinder-for-woocommerce/wordpress-doofinder-wp-woocommerce-search-plugin-2-0-33-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-49187 State: PUBLISHED Published: 2023-12-15T15:02:17.908Z Last Updated: 2024-08-02T21:53:43.397Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Spoonthemes Products: Adifier - Classified Ads WordPress Theme Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spoonthemes Adifier - Classified Ads WordPress Theme allows Reflected XSS.This issue affects Adifier - Classified Ads WordPress Theme: from n/a before 3.1.4. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/adifier/wordpress-adifier-classified
CVE Program Container: References: - https://patchstack.com/database/vulnerability/adifier/wordpress-adifier-classified-ads-wordpress-theme-theme-3-9-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-49188 State: PUBLISHED Published: 2023-12-15T15:05:27.588Z Last Updated: 2024-08-02T21:53:44.942Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: ZealousWeb Products: Track Geolocation Of Users Using Contact Form 7 Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZealousWeb Track Geolocation Of Users Using Contact Form 7 allows Stored XSS.This issue affects Track Geolocation Of Users Using Contact Form 7: from n/a through 2.0. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/track-geolocation-o
Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/track-geolocation-of-users-using-contact-form-7/wordpress-track-geolocation-of-users-using-contact-form-7-plugin-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-49189 State: PUBLISHED Published: 2023-12-15T15:08:01.376Z Last Updated: 2024-08-02T21:53:44.643Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Getsocial, S.A. Products: Social Share Buttons & Analytics Plugin – GetSocial.io Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Getsocial, S.A. Social Share Buttons & Analytics Plugin – GetSocial.Io allows Stored XSS.This issue affects Social Share Buttons & Analytics Plugin – GetSocial.Io: from n/a through 4.3.12. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database
rom n/a through 4.3.12. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-share-buttons-analytics-by-getsocial/wordpress-social-share-buttons-analytics-plugin-getsocial-io-plugin-4-3-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-49190 State: PUBLISHED Published: 2023-12-15T15:10:56.818Z Last Updated: 2024-08-02T21:53:44.802Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Chandra Shekhar Sahu Products: Site Offline Or Coming Soon Or Maintenance Mode Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chandra Shekhar Sahu Site Offline Or Coming Soon Or Maintenance Mode allows Stored XSS.This issue affects Site Offline Or Coming Soon Or Maintenance Mode: from n/a through 1.5.6. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerabili
ough 1.5.6. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/site-offline/wordpress-site-offline-or-coming-soon-or-maintenance-mode-plugin-1-5-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-49191 State: PUBLISHED Published: 2023-12-15T15:13:35.661Z Last Updated: 2024-08-02T21:53:44.797Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Supsystic Products: GDPR Cookie Consent by Supsystic Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Supsystic GDPR Cookie Consent by Supsystic allows Stored XSS.This issue affects GDPR Cookie Consent by Supsystic: from n/a through 2.1.2. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/gdpr-compliance-by-supsystic/wordpress-gdpr-cookie-consent-by-su
rences: - https://patchstack.com/database/vulnerability/gdpr-compliance-by-supsystic/wordpress-gdpr-cookie-consent-by-supsystic-plugin-2-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-49192 State: PUBLISHED Published: 2024-12-09T11:30:19.252Z Last Updated: 2024-12-09T16:32:14.540Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Clever Widgets Products: Enhanced Text Widget Problem Types: CWE-862 Description: Missing Authorization vulnerability in Clever Widgets Enhanced Text Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Enhanced Text Widget: from n/a through 1.6.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/enhanced-text-widget/vulnerability/wordpress-enhanced-text-widget-plugin-1-6-2-broken-access-co
atabase/wordpress/plugin/enhanced-text-widget/vulnerability/wordpress-enhanced-text-widget-plugin-1-6-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-49193 State: PUBLISHED Published: 2024-12-09T11:30:18.438Z Last Updated: 2024-12-09T16:35:51.651Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: NerdPress Products: Social Pug Problem Types: CWE-862 Description: Missing Authorization vulnerability in NerdPress Social Pug allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Pug: from n/a through 1.30.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/social-pug/vulnerability/wordpress-grow-social-plugin-1-20-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-49194 State: PUBLISHED Published: 2024-12-09T11:30:17.608Z Last Updated: 2024-12-09T16:38:55.495Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Importify Products: Importify (Dropshipping WooCommerce) Problem Types: CWE-215 Description: Insertion of Sensitive Information Into Debugging Code vulnerability in Importify Importify (Dropshipping WooCommerce) allows Retrieve Embedded Sensitive Data.This issue affects Importify (Dropshipping WooCommerce): from n/a through 1.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/importify/vulnerability/wordpress-importify-dropshipping
References: - https://patchstack.com/database/wordpress/plugin/importify/vulnerability/wordpress-importify-dropshipping-woocommerce-plugin-1-0-4-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2023-49195 State: PUBLISHED Published: 2023-12-14T15:39:26.529Z Last Updated: 2024-08-02T21:53:44.593Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Kyle Phillips Products: Nested Pages Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Phillips Nested Pages allows Stored XSS.This issue affects Nested Pages: from n/a through 3.2.6. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-nested-pages/wordpress-nested-pages-plugin-3-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-49196 State: PUBLISHED Published: 2024-12-09T11:30:16.800Z Last Updated: 2024-12-09T13:59:58.172Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Pagelayer Team Products: PageLayer Problem Types: CWE-862 Description: Missing Authorization vulnerability in Pagelayer Team PageLayer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PageLayer: from n/a through 1.7.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/pagelayer/vulnerability/wordpress-pagelayer-plugin-1-7-7-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-49197 State: PUBLISHED Published: 2023-12-15T15:39:22.792Z Last Updated: 2024-08-02T21:53:44.724Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Apasionados, Apasionados del Marketing, NetConsulting Products: DoFollow Case by Case Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Apasionados, Apasionados del Marketing, NetConsulting DoFollow Case by Case.This issue affects DoFollow Case by Case: from n/a through 3.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/dofollow-case-by-case/wordpress-dofollow-case-by-case-plugin-3-4-2-cross-site
ps://patchstack.com/database/vulnerability/dofollow-case-by-case/wordpress-dofollow-case-by-case-plugin-3-4-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-49198 State: PUBLISHED Published: 2024-08-21T09:37:57.478Z Last Updated: 2024-08-23T13:04:21.616Z Vendors: Apache Software Foundation Products: Apache SeaTunnel Web Problem Types: CWE-552 Description: Mysql security vulnerability in Apache SeaTunnel. Attackers can read files on the MySQL server by modifying the information in the MySQL URL allowLoadLocalInfile=true&allowUrlInLocalInfile=true&allowLoadLocalInfileInPath=/&maxAllowedPacket=655360 This issue affects Apache SeaTunnel: 1.0.0. Users are recommended to upgrade to version [1.0.1], which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/
sue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/48j9f1nsn037mgzc4j9o51nwglb1s08h
CVE ID: CVE-2023-49203 State: PUBLISHED Published: 2024-09-18T00:00:00 Last Updated: 2024-09-18T18:20:55.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: Technitium 11.5.3 allows remote attackers to cause a denial of service (bandwidth amplification) because the DNSBomb manipulation causes accumulation of low-rate DNS queries such that there is a large-sized response in a burst of traffic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://technitium.com/dns/ - https://gist.github.com/idealeer/89947ca07836fd0f7e9761198ca9a0f3.
CVE ID: CVE-2023-49208 State: PUBLISHED Published: 2023-11-23T00:00:00.000Z Last Updated: 2025-06-05T14:14:45.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: scheme/webauthn.c in Glewlwyd SSO server before 2.7.6 has a possible buffer overflow during FIDO2 credentials validation in webauthn registration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/babelouest/glewlwyd/commit/f9d8c06aae8dfe17e761b18b577ff169e059e812 - https://github.com/babelouest/glewlwyd/releases/tag/v2.7.6
CVE ID: CVE-2023-49210 State: PUBLISHED Published: 2023-11-23T00:00:00 Last Updated: 2024-08-02T21:53:44.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and accepts an opts argument that contains a verb field (used for command execution). NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/mcoimbra/b05a55a5760172dccaa0a827647ad63e - https://github.com/ossf/malicious-packages/tree/main/malicious/npm - https://www.n
ra/b05a55a5760172dccaa0a827647ad63e - https://github.com/ossf/malicious-packages/tree/main/malicious/npm - https://www.npmjs.com/package/openssl
CVE ID: CVE-2023-49213 State: PUBLISHED Published: 2023-11-23T00:00:00 Last Updated: 2024-08-02T21:53:44.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: The API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary commands via crafted HTTP requests if a param block is used, due to invalid sanitization of input strings. The fixed versions are 3.10.2, 4.1.10, and 4.2.1. Additional Analyst Notes: - CVE Program Container: References: - https://docs.powershelluniversal.com/changelogs/changelog - https://blog.ironmansoftware.com/powershell-universal-apis-cve/
CVE ID: CVE-2023-49214 State: PUBLISHED Published: 2023-11-23T00:00:00 Last Updated: 2024-08-02T21:53:45.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: Usedesk before 1.7.57 allows chat template injection. Additional Analyst Notes: - CVE Program Container: References: - https://usedesk.ru/updates_september23
CVE ID: CVE-2023-49215 State: PUBLISHED Published: 2023-11-23T00:00:00 Last Updated: 2024-11-26T19:35:47.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: Usedesk before 1.7.57 allows filter reflected XSS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://usedesk.ru/updates_september23
CVE ID: CVE-2023-49216 State: PUBLISHED Published: 2023-11-23T00:00:00 Last Updated: 2024-08-02T21:53:44.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: Usedesk before 1.7.57 allows profile stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://usedesk.ru/updates_september23
CVE ID: CVE-2023-49221 State: PUBLISHED Published: 2024-06-07T00:00:00 Last Updated: 2024-08-20T15:33:21.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: Precor touchscreen console P62, P80, and P82 could allow a remote attacker (within the local network) to bypass security restrictions, and access the service menu, because there is a hard-coded service code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securityintelligence.com/x-force/internet-connected-treadmill-vulnerabilities-discovered/
CVE ID: CVE-2023-49222 State: PUBLISHED Published: 2024-06-07T00:00:00 Last Updated: 2024-09-13T14:32:28.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: Precor touchscreen console P82 contains a private SSH key that corresponds to a default public key. A remote attacker could exploit this to gain root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securityintelligence.com/x-force/internet-connected-treadmill-vulnerabilities-discovered/
CVE ID: CVE-2023-49223 State: PUBLISHED Published: 2024-06-07T00:00:00 Last Updated: 2024-09-13T14:32:33.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: Precor touchscreen console P62, P80, and P82 could allow a remote attacker to obtain sensitive information because the root password is stored in /etc/passwd. An attacker could exploit this to extract files and obtain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securityintelligence.com/x-force/internet-connected-treadmill-vulnerabilities-discovered/
CVE ID: CVE-2023-49224 State: PUBLISHED Published: 2024-06-07T00:00:00 Last Updated: 2024-09-13T14:45:55.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: Precor touchscreen console P62, P80, and P82 contains a default SSH public key in the authorized_keys file. A remote attacker could use this key to gain root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securityintelligence.com/x-force/internet-connected-treadmill-vulnerabilities-discovered/
CVE ID: CVE-2023-49225 State: PUBLISHED Published: 2023-12-07T06:22:32.328Z Last Updated: 2025-05-28T13:58:41.326Z Vendors: CommScope, Inc. Products: ZoneDirector, SmartZone, AP Solo R750, AP Solo R650, AP Solo R730, AP Solo T750, AP Solo R550, AP Solo R850, AP Solo T750SE, AP Solo R510, AP Solo T310D, AP Solo E510, AP Solo C110, AP Solo R320, AP Solo H510, AP Solo H320, AP Solo T310S, AP Solo T310N, AP Solo T310C, AP Solo T305, AP Solo M510, AP Solo R720, AP Solo R710, AP Solo T710, AP Solo T710s, AP Solo T610, AP Solo T610s, AP Solo R610, AP Solo R310, AP Solo R760, AP Solo R560, AP Solo H550, AP Solo H350, AP Solo T350c, AP Solo T350d, AP Solo T350se, AP Solo R350 Problem Types: Cross-sit