Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rnal kernel information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-3397 - https://bugzilla.redhat.com/show_bug.cgi?id=2217271 - https://www.spinics.net/lists/kernel/msg4788636.html
CVE ID: CVE-2023-3398 State: PUBLISHED Published: 2023-06-26T10:05:09.278Z Last Updated: 2024-12-03T18:47:29.317Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: jgraph Products: jgraph/drawio Problem Types: CWE-400 Description: Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/aa087215-80e1-433d-b870-650705630e69 - https://github.com/jgraph/drawio/commit/064729fec4262f9373d9fdcafda0be47cd18dd50
CVE ID: CVE-2023-3399 State: PUBLISHED Published: 2023-11-06T12:08:54.970Z Last Updated: 2025-11-20T04:07:28.274Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-201 Description: An issue has been discovered in GitLab EE affecting all versions starting from 11.6 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. It was possible for an unauthorised project or group member to read the CI/CD variables using the custom project templates. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/
l Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/416244 - https://hackerone.com/reports/2021616
CVE ID: CVE-2023-3401 State: PUBLISHED Published: 2023-08-02T08:30:48.302Z Last Updated: 2025-11-20T04:07:33.267Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-94 Description: An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/416252 - htt
CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/416252 - https://hackerone.com/reports/2031845
CVE ID: CVE-2023-3402 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:15.987Z Description: No description available.
CVE ID: CVE-2023-3403 State: PUBLISHED Published: 2023-07-18T02:39:25.938Z Last Updated: 2025-02-05T19:39:07.306Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: metagauss Products: ProfileGrid – User Profiles, Memberships, Groups and Communities Problem Types: CWE-862 Missing Authorization Description: The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pm_upload_csv' function in versions up to, and including, 5.5.1. This makes it possible for authenticated attackers, with subscriber-level permissions or above to import new users and update existing users. Additional Analyst Notes
kers, with subscriber-level permissions or above to import new users and update existing users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b335fc19-2998-4711-8813-6cb68d7447bd?source=cve - https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.4.8/admin/class-profile-magic-admin.php#L1027 - https://plugins.trac.wordpress.org/changeset/2938904/profilegrid-user-profiles-groups-and-communities#file0
CVE ID: CVE-2023-3404 State: PUBLISHED Published: 2023-08-31T05:33:10.376Z Last Updated: 2025-02-05T19:33:06.520Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: metagauss Products: ProfileGrid – User Profiles, Memberships, Groups and Communities Problem Types: CWE-321 Use of Hard-coded Cryptographic Key Description: The ProfileGrid plugin for WordPress is vulnerable to unauthorized decryption of private information in versions up to, and including, 5.5.0. This is due to the passphrase and iv being hardcoded in the 'pm_encrypt_decrypt_pass' function and used across all sites running the plugin. This makes it possible for authenticated attackers, with adminis
function and used across all sites running the plugin. This makes it possible for authenticated attackers, with administrator-level permissions or above to decrypt and view users' passwords. If combined with another vulnerability, this can potentially grant lower-privileged users access to users' passwords. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6d490bfb-6560-428e-ad91-0f8d8bc9b1f2?source=cve - https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.4.8/includes/class-profile-magic-request.php#L325 - https://plugins.trac.wordpress.org/change
ups-and-communities/tags/5.4.8/includes/class-profile-magic-request.php#L325 - https://plugins.trac.wordpress.org/changeset/2936383/profilegrid-user-profiles-groups-and-communities#file475
CVE ID: CVE-2023-3405 State: PUBLISHED Published: 2023-06-27T14:24:40.316Z Last Updated: 2024-08-28T18:21:55.335Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: M-Files Products: M-Files Server Problem Types: CWE-248 Description: Unchecked parameter value in M-Files Server in versions before 23.6.12695.3 (excluding 23.2 SR2 and newer) allows anonymous user to cause denial of service Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://product.m-files.com/security-advisories/cve-2023-3405/
CVE ID: CVE-2023-3406 State: PUBLISHED Published: 2023-08-25T08:11:46.246Z Last Updated: 2024-08-28T18:29:05.426Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: M-Files Products: M-Files Web Problem Types: CWE-22 Description: Path Traversal issue in M-Files Classic Web versions below 23.6.12695.3 and LTS Service Release Versions before 23.2 LTS SR3 allows authenticated user to read some restricted files on the web server Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://product.m-files.com/security-advisories/cve-2023-3406/
CVE ID: CVE-2023-3407 State: PUBLISHED Published: 2023-06-28T02:34:22.840Z Last Updated: 2025-02-05T19:41:56.071Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: wedevs Products: Subscribe2 – Form, Email Subscribers & Newsletters Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.40. This is due to missing or incorrect nonce validation when sending test emails. This makes it possible for unauthenticated attackers to send test emails with custom content to users on sites running a vulnerable version of this plugin via a forge
ackers to send test emails with custom content to users on sites running a vulnerable version of this plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/92b4d800-2895-4f7b-8b3b-ee6df75a7908?source=cve - https://plugins.trac.wordpress.org/browser/subscribe2/trunk/admin/send-email.php#L12 - https://plugins.trac.wordpress.org/changeset/2930676
CVE ID: CVE-2023-3408 State: PUBLISHED Published: 2024-08-17T08:37:24.796Z Last Updated: 2024-08-19T17:09:58.014Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Bricks Builder Products: Bricks Problem Types: CWE-352 Description: The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing or incorrect nonce validation on the 'save_settings' function. This makes it possible for unauthenticated attackers to modify the theme's settings, including enabling a setting which allows lower-privileged users such as contributors to perform code execution, via a forged request granted they ca
which allows lower-privileged users such as contributors to perform code execution, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d58fd503-84d0-4d62-9290-870b1dd32be7?source=cve - https://bricksbuilder.io/
CVE ID: CVE-2023-3409 State: PUBLISHED Published: 2024-08-17T08:37:23.103Z Last Updated: 2024-08-19T14:08:09.928Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Bricks Builder Products: Bricks Problem Types: CWE-352 Description: The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing or incorrect nonce validation on the 'reset_settings' function. This makes it possible for unauthenticated attackers to reset the theme's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CIS
hey can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/16800ece-da9c-431b-a015-42bd30b646e2?source=cve - https://bricksbuilder.io/
CVE ID: CVE-2023-3410 State: PUBLISHED Published: 2024-09-14T08:37:20.494Z Last Updated: 2024-09-15T19:57:13.528Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Bricks Builder Products: Bricks Problem Types: CWE-79 Description: The Bricks theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘customTag' attribute in versions up to, and including, 1.10.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the Bricks Builder (admin-only by default), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This becomes more
to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This becomes more of an issue when Bricks Builder access is granted to lower-privileged users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ba5e93a2-8f42-4747-86fa-297ba709be8f?source=cve - https://bricksbuilder.io/ - https://bricksbuilder.io/release/bricks-1-10-2/
CVE ID: CVE-2023-3411 State: PUBLISHED Published: 2023-06-27T03:28:27.320Z Last Updated: 2025-02-05T19:42:18.079Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: webcraftplugins Products: Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing nonce validation on the ajax_store_save() function. This makes it possible for unauthenticated attackers to modify plugin settings and inje
the ajax_store_save() function. This makes it possible for unauthenticated attackers to modify plugin settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/63e108f4-5d9d-4bcf-aef9-aa856f4241ea?source=cve - https://plugins.trac.wordpress.org/browser/image-map-pro-lite/trunk/image-map-pro-wordpress-lite.php#L410
CVE ID: CVE-2023-3412 State: PUBLISHED Published: 2023-06-27T03:28:27.818Z Last Updated: 2025-02-05T19:42:07.336Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: webcraftplugins Products: Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.0. This is due to a missing capability check on the ajax_store_save() function. This makes it possible for authent
, 1.0.0. This is due to a missing capability check on the ajax_store_save() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify plugin settings and inject malicious web scripts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b58403df-af09-4d74-88e6-140e3f2f291b?source=cve - https://plugins.trac.wordpress.org/browser/image-map-pro-lite/trunk/image-map-pro-wordpress-lite.php#L410
CVE ID: CVE-2023-3413 State: PUBLISHED Published: 2023-09-29T08:30:56.742Z Last Updated: 2025-11-20T04:07:38.285Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-201 Description: An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to read the source code of a project through a fork created before changing visibility to only project members. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/416284 - https://hackerone.com/reports/2027967
CVE ID: CVE-2023-3414 State: PUBLISHED Published: 2023-07-26T18:20:18.253Z Last Updated: 2024-10-15T15:54:57.698Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: ServiceNow Products: Jenkins plug-in for ServiceNow DevOps Problem Types: CWE-352 Description: A cross-site request forgery vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins plug-in for ServiceNow DevOps on your Jenkins server. No changes are required on your instances of the Now Platform. Additional An
r ServiceNow DevOps on your Jenkins server. No changes are required on your instances of the Now Platform. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1434118
CVE ID: CVE-2023-3416 State: PUBLISHED Published: 2024-08-17T09:38:59.362Z Last Updated: 2024-08-20T19:35:30.721Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: TagDiv Products: tagDiv Opt-In Builder Problem Types: CWE-89 Description: The tagDiv Opt-In Builder plugin is vulnerable to Blind SQL Injection via the 'subscriptionCouponId' parameter via the 'create_stripe_subscription' REST API endpoint in versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator-level privileges to append additio
ting SQL query. This makes it possible for authenticated attackers with administrator-level privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7659ac9b-fa4e-4cb7-9887-38aa65b6d1c3?source=cve - https://tagdiv.com/tagdiv-opt-in-builder/
CVE ID: CVE-2023-3417 State: PUBLISHED Published: 2023-07-24T10:09:37.591Z Last Updated: 2025-02-13T16:55:20.883Z Vendors: Mozilla Products: Thunderbird Problem Types: File Extension Spoofing using the Text Direction Override Character Description: Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This vulnerability affects Thunderbird < 115.0.1 and Thunderbird < 102.13.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
0.1 and Thunderbird < 102.13.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1835582 - https://www.mozilla.org/security/advisories/mfsa2023-27/ - https://www.mozilla.org/security/advisories/mfsa2023-28/ - https://www.debian.org/security/2023/dsa-5463 - https://lists.debian.org/debian-lts-announce/2023/07/msg00032.html
CVE ID: CVE-2023-3418 State: REJECTED Published: 2023-07-17T13:29:55.323Z Last Updated: 2024-03-22T08:13:12.735Z Description: No description available.
CVE ID: CVE-2023-3419 State: PUBLISHED Published: 2024-08-17T09:38:54.872Z Last Updated: 2024-08-19T16:45:37.040Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: TagDiv Products: tagDiv Opt-In Builder Problem Types: CWE-89 Description: The tagDiv Opt-In Builder plugin is vulnerable to Blind SQL Injection via the 'couponId' parameter of the 'recreate_stripe_subscription' REST API endpoint in versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator-level privileges to append additional SQL que
ery. This makes it possible for authenticated attackers with administrator-level privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/17150263-261d-422f-8b36-a2981d4aaad3?source=cve - https://tagdiv.com/tagdiv-opt-in-builder/
CVE ID: CVE-2023-3420 State: PUBLISHED Published: 2023-06-26T20:40:11.837Z Last Updated: 2025-05-05T15:55:03.162Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_26.html - https://crbug.com/1452137 - https://www.debian.org/security/2023/dsa-5440 - https://lists.fedoraproject.org/archives/list/package-announce@list
37 - https://www.debian.org/security/2023/dsa-5440 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KREKCQTJDVI2AEBG5ECZPSOQXIC2L5XL/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBAHED5YFJPRGSEKNZIYHZBGSVHGEHOH/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-3421 State: PUBLISHED Published: 2023-06-26T20:40:12.035Z Last Updated: 2025-05-05T15:54:52.141Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Media in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_26.html - https://crbug.com/1447568 - https://www.debian.org/security/2023/dsa-5440 - https://lists.fedoraproject.org/archives/list/package-announce@l
47568 - https://www.debian.org/security/2023/dsa-5440 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KREKCQTJDVI2AEBG5ECZPSOQXIC2L5XL/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBAHED5YFJPRGSEKNZIYHZBGSVHGEHOH/ - https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1751 - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-3422 State: PUBLISHED Published: 2023-06-26T20:40:12.225Z Last Updated: 2025-02-13T16:55:23.703Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Guest View in Google Chrome prior to 114.0.5735.198 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_26.html - https://crbug.com/1450397 - https://www.debian.org/security/2023/dsa-5440 - https://lis
nel-update-for-desktop_26.html - https://crbug.com/1450397 - https://www.debian.org/security/2023/dsa-5440 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KREKCQTJDVI2AEBG5ECZPSOQXIC2L5XL/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBAHED5YFJPRGSEKNZIYHZBGSVHGEHOH/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-3423 State: PUBLISHED Published: 2023-06-27T03:29:26.759Z Last Updated: 2024-12-03T17:11:07.064Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: cloudexplorer-dev Products: cloudexplorer-dev/cloudexplorer-lite Problem Types: CWE-521 Description: Weak Password Requirements in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v 1.2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/dd19c7d0-70f1-4d86-a552-611dfa8e0139 - https://github.com/cloudexplorer-dev/cloudexplorer-lite/commit/7d4dab60352079953b7be120afe9bd14983ae3bc
CVE ID: CVE-2023-3424 State: PUBLISHED Published: 2023-07-13T02:08:07.284Z Last Updated: 2024-10-30T19:29:27.116Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-1333 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/iss
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/409802 - https://hackerone.com/reports/1960970