Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-38932 State: PUBLISHED Published: 2023-08-07T00:00:00 Last Updated: 2024-10-15T20:19:35.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda F1202 V1.2.0.9, PA202 V1.1.2.5, PW201A V1.1.2.5 and FH1202 V1.2.0.9 were discovered to contain a stack overflow via the page parameter in the SafeEmailFilter function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/formSafeEmailFilter
CVE ID: CVE-2023-38933 State: PUBLISHED Published: 2023-08-07T00:00:00 Last Updated: 2024-10-17T13:51:46.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, F1203 V2.0.1.6, AC5 V1.0 V15.03.06.28, FH1203 V2.0.1.6 and AC9 V3.0 V15.03.06.42_multi, and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the deviceId parameter in the formSetClientState function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/formSetClientState/README.md
CVE ID: CVE-2023-38934 State: PUBLISHED Published: 2023-08-07T00:00:00 Last Updated: 2024-10-15T20:09:42.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda F1203 V2.0.1.6, FH1203 V2.0.1.6 and FH1205 V2.0.0.7(775) was discovered to contain a stack overflow via the deviceId parameter in the formSetDeviceName function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/formSetDeviceName/README.md
CVE ID: CVE-2023-38935 State: PUBLISHED Published: 2023-08-07T00:00:00 Last Updated: 2024-10-15T20:07:56.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC1206 V15.03.06.23, AC8 V4 V16.03.34.06, AC5 V1.0 V15.03.06.28, AC10 v4.0 V16.03.10.13 and AC9 V3.0 V15.03.06.42_multi were discovered to contain a tack overflow via the list parameter in the formSetQosBand function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/formSetQosBand/README.md
CVE ID: CVE-2023-38936 State: PUBLISHED Published: 2023-08-07T00:00:00 Last Updated: 2024-10-15T20:05:36.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC10 V1.0 V15.03.06.23, AC1206 V15.03.06.23, AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, AC5 V1.0 V15.03.06.28, FH1203 V2.0.1.6, AC9 V3.0 V15.03.06.42_multi and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the speed_dir parameter in the formSetSpeedWan function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/formSetSpeedWan/README.md
CVE ID: CVE-2023-38937 State: PUBLISHED Published: 2023-08-07T00:00:00 Last Updated: 2024-10-17T14:40:31.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC10 V1.0 V15.03.06.23, AC1206 V15.03.06.23, AC8 v4 V16.03.34.06, AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, AC5 V1.0 V15.03.06.28, AC9 V3.0 V15.03.06.42_multi and AC10 v4.0 V16.03.10.13 were discovered to contain a stack overflow via the list parameter in the formSetVirtualSer function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/formSetVirtualSer/README.md
CVE ID: CVE-2023-38938 State: PUBLISHED Published: 2023-08-07T00:00:00 Last Updated: 2024-10-11T14:21:52.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda F1202 V1.2.0.9, PA202 V1.1.2.5, PW201A V1.1.2.5 and FH1202 V1.2.0.9 were discovered to contain a stack overflow via the page parameter at /L7Im. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/frmL7ImForm
CVE ID: CVE-2023-38939 State: PUBLISHED Published: 2023-08-07T00:00:00 Last Updated: 2024-10-11T14:20:02.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda F1202 V1.2.0.9 and FH1202 V1.2.0.9 were discovered to contain a stack overflow via the mit_ssid parameter in the formWrlsafeset function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/formWrlsafeset
CVE ID: CVE-2023-38940 State: PUBLISHED Published: 2023-08-07T00:00:00 Last Updated: 2024-10-11T14:17:51.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda F1203 V2.0.1.6, FH1203 V2.0.1.6 and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/form_fast_setting_wifi_set
CVE ID: CVE-2023-38941 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T16:09:08.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: django-sspanel v2022.2.2 was discovered to contain a remote command execution (RCE) vulnerability via the component sspanel/admin_view.py -> GoodsCreateView._post. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Ehco1996/django-sspanel
CVE ID: CVE-2023-38942 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T16:07:56.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dango-Translator v4.5.5 was discovered to contain a remote command execution (RCE) vulnerability via the component app/config/cloud_config.json. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PantsuDango/Dango-Translator - https://github.com/PantsuDango/Dango-Translator/issues/127
CVE ID: CVE-2023-38943 State: PUBLISHED Published: 2023-08-05T00:00:00 Last Updated: 2024-10-17T14:46:20.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: ShuiZe_0x727 v1.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /iniFile/config.ini. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/0x727/ShuiZe_0x727 - https://github.com/0x727/ShuiZe_0x727/issues/160
CVE ID: CVE-2023-38944 State: PUBLISHED Published: 2024-03-05T00:00:00.000Z Last Updated: 2025-11-04T18:16:13.768Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Multilaser RE160V firmware v12.03.01.09_pt and Multilaser RE163V firmware v12.03.01.10_pt allows attackers to bypass the access control and gain complete access to the application via modifying a HTTP header. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/fulldisclosure/2024/Mar/0
CVE ID: CVE-2023-38945 State: PUBLISHED Published: 2024-03-06T00:00:00.000Z Last Updated: 2025-11-04T18:16:14.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multilaser RE160 v5.07.51_pt_MTL01 and v5.07.52_pt_MTL01, Multilaser RE160V v12.03.01.08_pt and V12.03.01.09_pt, and Multilaser RE163V v12.03.01.08_pt allows attackers to bypass the access control and gain complete access to the application via supplying a crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2024/Mar/1
CVE ID: CVE-2023-38946 State: PUBLISHED Published: 2024-03-06T00:00:00 Last Updated: 2024-08-26T19:48:30.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Multilaser RE160 firmware v5.07.51_pt_MTL01 and v5.07.52_pt_MTL01 allows attackers to bypass the access control and gain complete access to the application via supplying a crafted cookie. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://seclists.org/fulldisclosure/2024/Mar/2
CVE ID: CVE-2023-38947 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-08-02T17:54:39.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to execute arbitrary code via a crafted PHP file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/CTF-hacker/pwn/issues/I7LH2N - https://github.com/capture0x/WBCE_CMS - https://packetstormsecurity.com/files/176018/WBCE-CMS-1.6.1-Shell-Upload.html
CVE ID: CVE-2023-38948 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T16:06:54.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers to execute arbitrary code via downloading a crafted plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/CTF-hacker/pwn/issues/I7LI4E
CVE ID: CVE-2023-38949 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T16:05:54.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a crafted web request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://zkteco.com - https://claroty.com/team82/disclosure-dashboard/cve-2023-38949
CVE ID: CVE-2023-38950 State: PUBLISHED Published: 2023-08-03T00:00:00.000Z Last Updated: 2025-11-04T16:56:10.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://zkteco.com - https://claroty.com/team82/disclosure-dashboard/cve-2023-38950
CVE ID: CVE-2023-38951 State: PUBLISHED Published: 2023-08-03T00:00:00.000Z Last Updated: 2025-05-27T19:16:38.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sanitization on the SSH Key field. Overwriting specific files may lead to arbitrary code execution as NT AUTHORITY\SYSTEM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://claroty.com/team82/disclosure
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://claroty.com/team82/disclosure-dashboard/cve-2023-38951 - https://github.com/omair2084/biotime-rce-8.5.5/blob/main/biotime_enum.py - https://krashconsulting.com/fury-of-fingers-biotime-rce/ - https://www.zkteco.com/en/ZKBio_Time/ZKBioTime#Download - https://www.zkteco.com/en/announcement
CVE ID: CVE-2023-38952 State: PUBLISHED Published: 2023-08-03T00:00:00.000Z Last Updated: 2025-05-27T19:15:57.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforced and any authenticated user can leverage admin functions without restriction by making direct requests to administrative endpoints. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http:
dministrative endpoints. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://zkteco.com - https://claroty.com/team82/disclosure-dashboard/cve-2023-38952 - https://github.com/omair2084/biotime-rce-8.5.5/blob/main/biotime_enum.py - https://krashconsulting.com/fury-of-fingers-biotime-rce/
CVE ID: CVE-2023-38954 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T19:38:08.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZKTeco BioAccess IVS v3.3.1 was discovered to contain a SQL injection vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://zkteco.com - https://claroty.com/team82/disclosure-dashboard/cve-2023-38954
CVE ID: CVE-2023-38955 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T19:37:11.309Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device names. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://zkteco.com - https://claroty.com/team82/disclosure-dashboard/cve-2023-38955
CVE ID: CVE-2023-38956 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T20:02:56.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://zkteco.com - https://claroty.com/team82/disclosure-dashboard/cve-2023-38956
CVE ID: CVE-2023-38958 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-18T13:55:00.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to arbitrarily close and open the doors managed by the platform remotely via sending a crafted web request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://zkteco.com - https://claroty.com/team82/disclosure-dashboard/cve-2023-38958
CVE ID: CVE-2023-38960 State: PUBLISHED Published: 2024-02-13T00:00:00.000Z Last Updated: 2025-05-07T21:11:19.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissions issue in Raiden Professional Server RaidenFTPD v.2.4 build 4005 allows a local attacker to gain privileges and execute arbitrary code via crafted executable running from the installation directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rodelllemit.medium.com/insecure-permissions-vulnerability-in-raidenftpd-v2-4-build-4005-2016-04-01-ea7389be3d33
CVE ID: CVE-2023-38961 State: PUBLISHED Published: 2023-08-21T00:00:00 Last Updated: 2024-10-07T17:03:43.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflwo vulnerability in JerryScript Project jerryscript v.3.0.0 allows a remote attacker to execute arbitrary code via the scanner_is_context_needed component in js-scanner-until.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jerryscript-project/jerryscript/issues/5092
CVE ID: CVE-2023-38964 State: PUBLISHED Published: 2023-08-04T00:00:00 Last Updated: 2024-10-17T15:13:01.727Z Vendors: n/a Products: n/a Problem Types: n/a Description: Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vida03.gitbook.io/redteam/web/cve-2023-38964
CVE ID: CVE-2023-38965 State: PUBLISHED Published: 2023-11-03T00:00:00.000Z Last Updated: 2025-11-11T17:02:36.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lost and Found Information System 1.0 allows account takeover via username and password to a /classes/Users.php?f=save URI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Or4ngm4n/vulnreability-code-review-php/blob/main/Lost%20and%20Found%20Information%20System%20v1.0.txt - http://packetstormsecurity.com/files/175077/Lost-And-Found-Information-System-1.0-Insecure-Direct-Object-Reference.html - https://www.exploit-db.com/exploits/51795
CVE ID: CVE-2023-38969 State: PUBLISHED Published: 2023-08-28T00:00:00 Last Updated: 2024-10-02T16:09:40.037Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerabiltiy in Badaso v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the title parameter in the new book and edit book function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/anh91/uasoft-indonesia--badaso/blob/main/XSS2.md - https://panda002.hashnode.dev/badaso-version-297-has-an-xss-vulnerability-in-add-books
CVE ID: CVE-2023-38970 State: PUBLISHED Published: 2023-08-30T00:00:00 Last Updated: 2024-10-01T20:25:24.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the Name of member parameter in the add new member function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/anh91/uasoft-indonesia--badaso/blob/main/XSS3.md - https://panda002.hashnode.dev/badaso-version-297-has-an-xss-vulnerability-in-new-member
CVE ID: CVE-2023-38971 State: PUBLISHED Published: 2023-08-29T00:00:00 Last Updated: 2024-10-02T14:45:02.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the rack number parameter in the add new rack function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/anh91/uasoft-indonesia--badaso/blob/main/XSS3.md - https://panda002.hashnode.dev/badaso-version-297-has-xss-vulnerability-in-add-ranks
CVE ID: CVE-2023-38973 State: PUBLISHED Published: 2023-08-25T00:00:00 Last Updated: 2024-10-02T18:18:46.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Add Tag function of Badaso v2.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/anh91/uasoft-indonesia--badaso/blob/main/xss5.md
CVE ID: CVE-2023-38974 State: PUBLISHED Published: 2023-08-25T00:00:00 Last Updated: 2024-10-02T18:13:11.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Edit Category function of Badaso v2.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/anh91/uasoft-indonesia--badaso/blob/main/XSS4.md
CVE ID: CVE-2023-38975 State: PUBLISHED Published: 2023-08-29T00:00:00 Last Updated: 2024-10-02T14:43:09.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: * Buffer Overflow vulnerability in qdrant v.1.3.2 allows a remote attacker cause a denial of service via the chucnked_vectors.rs component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/qdrant/qdrant/issues/2268 - https://aisec.today/Qdrant-56dd05e12ca94d75a5e798b3fee80fa3
CVE ID: CVE-2023-38976 State: PUBLISHED Published: 2023-08-21T00:00:00 Last Updated: 2024-10-07T17:03:00.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/weaviate/weaviate/issues/3258 - https://aisec.today/Weaviate-26981c6c5f794077bd51d24c88cebf7a
CVE ID: CVE-2023-38988 State: PUBLISHED Published: 2023-07-28T00:00:00 Last Updated: 2024-10-23T12:56:29.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by Administrators. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/thinkgem/jeesite/issues/517
CVE ID: CVE-2023-38989 State: PUBLISHED Published: 2023-07-31T00:00:00 Last Updated: 2024-10-22T15:37:10.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Administrator's role information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/thinkgem/jeesite/issues/518
CVE ID: CVE-2023-38990 State: PUBLISHED Published: 2023-08-01T00:00:00 Last Updated: 2024-10-17T19:03:18.848Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the delete function in the MenuController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete menus created by the Administrator. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/thinkgem/jeesite/issues/519
CVE ID: CVE-2023-38991 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-18T13:54:05.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete models created by the Administrator. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/thinkgem/jeesite/issues/520
CVE ID: CVE-2023-38992 State: PUBLISHED Published: 2023-07-28T00:00:00 Last Updated: 2024-10-22T20:02:03.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jeecgboot/jeecg-boot/issues/5173
CVE ID: CVE-2023-38994 State: PUBLISHED Published: 2023-10-31T00:00:00.000Z Last Updated: 2025-04-15T22:09:15.651Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AC:L/AV:L/A:N/C:H/I:H/PR:H/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The 'check_univention_joinstatus' prometheus monitoring script (and other scripts) in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuration of UCS does not allow local ssh access for regular users. Additional Analyst Notes: - CVE Program Container: References: - https://forge.univention.org/
access for regular users. Additional Analyst Notes: - CVE Program Container: References: - https://forge.univention.org/bugzilla/show_bug.cgi?id=56324 - https://www.drive-byte.de/en/blog/simple-yet-effective-the-story-of-some-simple-bugs-that-led-to-the-complete-compromise-of-a-network - https://forge.univention.org/bugzilla/show_bug.cgi?id=56324#c0 - https://raeph123.github.io/BlogPosts/Univention/Simple_yet_effective_The_story_of_some_simple_bugs_that_led_to_the_complete_compromise_of_a_network_en.html
CVE ID: CVE-2023-38995 State: PUBLISHED Published: 2024-02-07T00:00:00.000Z Last Updated: 2025-05-15T19:43:05.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in SCHUHFRIED v.8.22.00 allows remote attacker to obtain the database password via crafted curl command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2023-38995-Schuhfried-Preauth-PrivEsc.pdf