Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-40037 State: PUBLISHED Published: 2023-08-18T21:54:52.454Z Last Updated: 2025-02-13T17:03:21.877Z Vendors: Apache Software Foundation Products: Apache NiFi Problem Types: CWE-184 Description: Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. The resolution enhances connection URL validation and introduces validation for additional related properties. Upgrading to Apache NiFi 1.23.1 is the recommended mitigation.
introduces validation for additional related properties. Upgrading to Apache NiFi 1.23.1 is the recommended mitigation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nifi.apache.org/security.html#CVE-2023-40037 - https://lists.apache.org/thread/bqbjlrs2p5ghh8sbk5nsxb8xpf9l687q - http://www.openwall.com/lists/oss-security/2023/08/18/2
CVE ID: CVE-2023-40038 State: PUBLISHED Published: 2023-12-27T00:00:00 Last Updated: 2024-08-02T18:24:54.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arris DG860A and DG1670A devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. (They use the first 6 characters of the SSID and the last 6 characters of the BSSID, decrementing the last digit.) Additional Analyst Notes: - CVE Program Container: References: - https://i.ebayimg.com/images/g/ByAAAOSwQCFi2b50/s-l1600.jpg - https://github.com/actuator/cve/blob/main/Arris/CVE-2023-40038
CVE ID: CVE-2023-40039 State: PUBLISHED Published: 2023-09-11T00:00:00 Last Updated: 2024-09-26T15:25:44.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on ARRIS TG852G, TG862G, and TG1672G devices. A remote attacker (in proximity to a Wi-Fi network) can derive the default WPA2-PSK value by observing a beacon frame. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://i.ebayimg.com/images/g/-UcAAOSwDe1kyD-Z/s-l1600.png - https://i.ebayimg.com/images/g/4P0AAOSwdhxkrZtt/s-l1600.jpg - https://github.com/actuator/cve/blob/main/Arris/CVE-2023-40039
CVE ID: CVE-2023-40040 State: PUBLISHED Published: 2023-09-11T00:00:00 Last Updated: 2024-09-26T15:53:44.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the MyCrops HiGrade "THC Testing & Cannabi" application 1.0.337 for Android. A remote attacker can start the camera feed via the com.cordovaplugincamerapreview.CameraActivity component in some situations. NOTE: this is only exploitable on Android versions that lack runtime permission checks, and of those only Android SDK 5.1.1 API 22 is consistent with the manifest. Thus, this applies only to Android Lollipop, affecting less than five percent of Android devices as of 2023. Additional Analyst Notes:
ies only to Android Lollipop, affecting less than five percent of Android devices as of 2023. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/actuator/cve/blob/main/CVE-2023-40040
CVE ID: CVE-2023-40041 State: PUBLISHED Published: 2023-08-08T00:00:00 Last Updated: 2024-10-10T19:45:20.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer overflow in setWiFiWpsConfig in /lib/cste_modules/wps.so. Attackers can send crafted data in an MQTT packet, via the pin parameter, to control the return address and execute code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Korey0sh1/IoT_vuln/blob/main/TOTOLINK/T10_V2/lib-cste_modules-wps.md
CVE ID: CVE-2023-40042 State: PUBLISHED Published: 2023-08-08T00:00:00 Last Updated: 2024-10-10T19:39:02.065Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer overflow in setStaticDhcpConfig in /lib/cste_modules/lan.so. Attackers can send crafted data in an MQTT packet, via the comment parameter, to control the return address and execute code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.totolink.cn - https://github.com/Korey0sh1/IoT_vuln/blob/main/TOTOLINK/T10_V2/setStaticDhcpConfig.md - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/172/ids/36.h
TOTOLINK/T10_V2/setStaticDhcpConfig.md - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/172/ids/36.html
CVE ID: CVE-2023-40043 State: PUBLISHED Published: 2023-09-20T16:06:00.755Z Last Updated: 2025-02-27T20:49:18.650Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: MOVEit Transfer Problem Types: CWE-89 Description: In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer web interface that could allow a MOVEit system administrator account to gain unauthorized access to the MOVEit Transfer database. A MOVEit system administrator could submit a crafted payload to the MOVEit Transfe
cess to the MOVEit Transfer database. A MOVEit system administrator could submit a crafted payload to the MOVEit Transfer web interface which could result in modification and disclosure of MOVEit database content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.progress.com/moveit - https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-September-2023
CVE ID: CVE-2023-40044 State: PUBLISHED Published: 2023-09-27T14:48:08.190Z Last Updated: 2025-10-21T23:05:36.645Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: WS_FTP Server Problem Types: CWE-502 Description: In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.progress.com/ws_ftp - https://community.progress.com/s/article/WS-FTP-
CISA ADP Vulnrichment: References: - https://www.progress.com/ws_ftp - https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023 - https://www.theregister.com/2023/10/02/ws_ftp_update/ - https://www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server/ - https://attackerkb.com/topics/bn32f9sNax/cve-2023-40044 - https://censys.com/cve-2023-40044/ - https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044 - http://packetstormsecurity.com/files/174917/Progress-Software-WS_FTP-Unauthenticated-Remote-Code-Execution.html
CVE ID: CVE-2023-40045 State: PUBLISHED Published: 2023-09-27T14:49:45.334Z Last Updated: 2024-09-24T14:25:59.931Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: WS_FTP Server Problem Types: CWE-79 Description: In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Ad Hoc Transfer module. An attacker could leverage this vulnerability to target WS_FTP Server users with a specialized payload which results in the execution of malicious JavaScript within the context of the victims browser. Additional Analyst Notes: - CVE Program Container: - CISA AD
cious JavaScript within the context of the victims browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.progress.com/ws_ftp - https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023
CVE ID: CVE-2023-40046 State: PUBLISHED Published: 2023-09-27T14:50:18.549Z Last Updated: 2024-09-23T15:07:01.880Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L) Vendors: Progress Software Corporation Products: WS_FTP Server Problem Types: CWE-89 Description: In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.progress.com/ws_ftp - ht
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.progress.com/ws_ftp - https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023
CVE ID: CVE-2023-40047 State: PUBLISHED Published: 2023-09-27T14:50:55.329Z Last Updated: 2024-09-24T14:36:57.450Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: WS_FTP Server Problem Types: CWE-79 Description: In WS_FTP Server version prior to 8.8.2, a stored cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Management module. An attacker with administrative privileges could import a SSL certificate with malicious attributes containing cross-site scripting payloads. Once the cross-site scripting payload is successfully stored, an attacker could leverage this vulnerability to target WS_FTP Server admins
e scripting payload is successfully stored, an attacker could leverage this vulnerability to target WS_FTP Server admins with a specialized payload which results in the execution of malicious JavaScript within the context of the victims browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.progress.com/ws_ftp - https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023
CVE ID: CVE-2023-40048 State: PUBLISHED Published: 2023-09-27T14:51:35.413Z Last Updated: 2024-09-23T15:06:42.221Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: Progress Software Corporation Products: WS_FTP Server Problem Types: CWE-352 Description: In WS_FTP Server version prior to 8.8.2, the WS_FTP Server Manager interface was missing cross-site request forgery (CSRF) protection on a POST transaction corresponding to a WS_FTP Server administrative function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.progress.com/ws_ftp - https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerabili
erences: - https://www.progress.com/ws_ftp - https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023
CVE ID: CVE-2023-40049 State: PUBLISHED Published: 2023-09-27T14:52:04.667Z Last Updated: 2024-09-24T14:38:11.547Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Progress Software Corporation Products: WS_FTP Server Problem Types: CWE-200 Description: In WS_FTP Server version prior to 8.8.2, an unauthenticated user could enumerate files under the 'WebServiceHost' directory listing. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.progress.com/ws_ftp - https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023
CVE ID: CVE-2023-40050 State: PUBLISHED Published: 2023-10-31T14:07:59.881Z Last Updated: 2024-09-06T15:41:14.418Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: Chef Automate Problem Types: CWE-94, CWE-434 Description: Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.chef.io/release_notes_automate/ - https://docs.chef.io/automate/profiles/ - https://community.progress
s: - https://docs.chef.io/release_notes_automate/ - https://docs.chef.io/automate/profiles/ - https://community.progress.com/s/article/Product-Alert-Bulletin-October-2023-CHEF-Automate-CVE-2023-40050
CVE ID: CVE-2023-40051 State: PUBLISHED Published: 2024-01-18T15:11:04.080Z Last Updated: 2025-06-02T15:03:50.714Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L) Vendors: Progress Software Corporation Products: OpenEdge Problem Types: CWE-434 Description: This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE. If the upload contains a payload that can further exploit the server or its network, the launch of a la
m running PASOE. If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.progress.com/openedge - https://community.progress.com/s/article/Important-Progress-OpenEdge-Critical-Alert-for-Progress-Application-Server-in-OpenEdge-PASOE-Arbitrary-File-Upload-Vulnerability-in-WEB-Transport
CVE ID: CVE-2023-40052 State: PUBLISHED Published: 2024-01-18T15:11:51.468Z Last Updated: 2024-08-29T19:52:53.852Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Progress Software Corporation Products: OpenEdge Problem Types: CWE-119 Description: This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0 . An attacker who can produce a malformed web request may cause the crash of a PASOE agent potentially disrupting the thread activities of many web application clients. Multiple of these DoS attacks could lead to the flooding of invalid requests as compare
of many web application clients. Multiple of these DoS attacks could lead to the flooding of invalid requests as compared to the server’s remaining ability to process valid requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.progress.com/openedge - https://community.progress.com/s/article/Important-Progress-OpenEdge-Product-Alert-for-Progress-Application-Server-for-OpenEdge-PASOE-Denial-of-Service-Vulnerability-in-WEB-Transport
CVE ID: CVE-2023-40053 State: PUBLISHED Published: 2023-12-06T03:23:59.651Z Last Updated: 2024-08-02T18:24:54.649Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: SolarWinds Products: Serv-U Problem Types: CWE-20 Description: A vulnerability has been identified within Serv-U 15.4 that allows an authenticated actor to insert content on the file share function feature of Serv-U, which could be used maliciously. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-40053 - https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-4-1_release_notes.htm
CVE ID: CVE-2023-40054 State: PUBLISHED Published: 2023-11-09T15:05:53.355Z Last Updated: 2024-09-04T13:41:17.792Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Network Configuration Manager Problem Types: CWE-22 Description: The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to perform the actions with SYSTEM privileges. We found this issue was not resolved in CVE-2023-33226 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-40054
ainer: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-40054 - https://documentation.solarwinds.com/en/success_center/ncm/content/release_notes/ncm_2023-4-1_release_notes.htm
CVE ID: CVE-2023-40055 State: PUBLISHED Published: 2023-11-09T15:06:35.640Z Last Updated: 2024-09-03T18:17:49.458Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Network Configuration Manager Problem Types: CWE-22 Description: The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to perform the actions with SYSTEM privileges. We found this issue was not resolved in CVE-2023-33227 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-40055
CVE ID: CVE-2023-40056 State: PUBLISHED Published: 2023-11-28T17:51:48.838Z Last Updated: 2024-08-02T18:24:54.700Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-89 Description: SQL Injection Remote Code Vulnerability was found in the SolarWinds Platform. This vulnerability can be exploited with a low privileged account. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-40056 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-4-2_release_notes.htm
CVE ID: CVE-2023-40057 State: PUBLISHED Published: 2024-02-15T20:36:12.759Z Last Updated: 2024-08-12T20:38:17.160Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SolarWinds Products: Access Rights Manager Problem Types: CWE-502 Description: The SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authenticated user to abuse a SolarWinds service resulting in remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-40057
CVE ID: CVE-2023-40058 State: PUBLISHED Published: 2023-12-21T16:14:48.077Z Last Updated: 2024-08-27T15:01:09.799Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: SolarWinds Products: Access Rights Manager Problem Types: CWE-200 Description: Sensitive data was added to our public-facing knowledgebase that, if exploited, could be used to access components of Access Rights Manager (ARM) if the threat actor is in the same environment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-40058
CVE ID: CVE-2023-40060 State: PUBLISHED Published: 2023-09-07T15:57:49.521Z Last Updated: 2025-02-27T20:57:19.408Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Serv-U Problem Types: CWE-284 Description: A vulnerability has been identified within Serv-U 15.4 and 15.4 Hotfix 1 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action. 15.4. SolarWinds found that the issue was not completely fixed in 15.4 Hotfix 1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/tru
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-40060 - https://support.solarwinds.com/SuccessCenter/s/article/Serv-U-15-4-0-Hotfix-2?language=en_US
CVE ID: CVE-2023-40061 State: PUBLISHED Published: 2023-11-01T15:30:29.512Z Last Updated: 2024-10-15T17:54:31.905Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-20 Description: Insecure job execution mechanism vulnerability. This vulnerability can lead to other attacks as a result. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-40061
CVE ID: CVE-2023-40062 State: PUBLISHED Published: 2023-11-01T15:29:56.898Z Last Updated: 2024-09-05T19:40:57.255Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-20 Description: SolarWinds Platform Incomplete List of Disallowed Inputs Remote Code Execution Vulnerability. If executed, this vulnerability would allow a low-privileged user to execute commands with SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.solarwinds.com/en/success_center/hco/content/release_notes/hco_2023-4_release_notes.htm - https://www.solarwinds.co
tion.solarwinds.com/en/success_center/hco/content/release_notes/hco_2023-4_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-40062
CVE ID: CVE-2023-40067 State: PUBLISHED Published: 2024-08-14T13:45:40.037Z Last Updated: 2025-11-03T21:49:20.484Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N) Vendors: n/a Products: Intel(R) CSME Problem Types: escalation of privilege, CWE-252 Description: Unchecked return value in firmware for some Intel(R) CSME may allow an unauthenticated user to potentially enable escalation of privilege via physical access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00999.html
CVE ID: CVE-2023-40068 State: PUBLISHED Published: 2023-08-21T08:13:50.271Z Last Updated: 2024-10-04T17:57:33.499Z Vendors: WP Engine Products: Advanced Custom Fields, Advanced Custom Fields Pro Problem Types: Cross-site scripting (XSS) Description: Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative privilege. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.advancedcustomfields.com/blog/acf-6-1-8
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.advancedcustomfields.com/blog/acf-6-1-8/ - https://wordpress.org/plugins/advanced-custom-fields/ - https://www.advancedcustomfields.com/ - https://jvn.jp/en/jp/JVN98946408/
CVE ID: CVE-2023-40069 State: PUBLISHED Published: 2023-08-18T09:44:43.138Z Last Updated: 2024-10-08T19:14:06.984Z Vendors: ELECOM CO.,LTD. Products: WRC-F1167ACF, WRC-1750GHBK, WRC-1167GHBK2, WRC-1750GHBK2-I, WRC-1750GHBK-E Problem Types: OS command injection Description: OS command injection vulnerability in ELECOM wireless LAN routers allows an attacker who can access the product to execute an arbitrary OS command by sending a specially crafted request. Affected products and versions are as follows: WRC-F1167ACF all versions, WRC-1750GHBK all versions, WRC-1167GHBK2 all versions, WRC-1750GHBK2-I all versions, and WRC-1750GHBK-E all versions. Additional Analyst Notes: - CVE Program Contain
versions, WRC-1750GHBK2-I all versions, and WRC-1750GHBK-E all versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.elecom.co.jp/news/security/20230810-01/ - https://jvn.jp/en/vu/JVNVU91630351/