Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-1273 State: PUBLISHED Published: 2023-07-04T07:23:31.243Z Last Updated: 2024-11-25T16:20:36.240Z Vendors: Unknown Products: ND Shortcodes Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0805ed7e-395d-48de-b484-6c3ec1cd4b8e
CVE ID: CVE-2023-1274 State: PUBLISHED Published: 2023-04-17T12:17:46.362Z Last Updated: 2025-03-03T19:24:13.637Z Vendors: Unknown Products: Pricing Tables For WPBakery Page Builder (formerly Visual Composer) Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
iber to perform LFI attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/267acb2c-1a95-487f-a714-516de05d2b2f
CVE ID: CVE-2023-1275 State: PUBLISHED Published: 2023-03-08T17:57:30.222Z Last Updated: 2024-08-02T05:40:59.773Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Phone Shop Sales Managements System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in SourceCodester Phone Shop Sales Managements System 1.0. This vulnerability affects unknown code of the file /osms/assets/plugins/jquery-validation-1.11.1/demo/captcha/index.php of the component CAPTCHA Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-222598 is the
g. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-222598 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222598 - https://vuldb.com/?ctiid.222598 - https://github.com/blairting/bug_report/blob/main/vendors/Roo/Phone%20Shop%20Sales%20Managements%20System/XSS-1.md
CVE ID: CVE-2023-1276 State: PUBLISHED Published: 2023-03-08T18:00:40.000Z Last Updated: 2024-08-02T05:40:59.821Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: SUL1SS_shop Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SUL1SS_shop. This issue affects some unknown processing of the file application\merch\controller\Order.php. The manipulation of the argument keyword leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The
is product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-222599. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222599 - https://vuldb.com/?ctiid.222599 - https://tib36.github.io/2023/03/04/SUL1SS-shop-SQLi/
CVE ID: CVE-2023-1277 State: PUBLISHED Published: 2023-03-08T18:06:40.265Z Last Updated: 2025-02-28T19:45:16.911Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: kylin-system-updater Problem Types: CWE-77 Description: A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin. Affected is the function InstallSnap of the component Update Handler. The manipulation leads to command injection. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222600. Additional Analyst Notes: - CVE Program Conta
ublic and may be used. The identifier of this vulnerability is VDB-222600. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.222600 - https://vuldb.com/?ctiid.222600 - https://github.com/cn-lwj/vuldb/blob/master/kylin-system-updater_vuln.md
CVE ID: CVE-2023-1278 State: PUBLISHED Published: 2023-03-08T18:19:19.712Z Last Updated: 2024-11-25T15:22:28.347Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: IBOS Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in IBOS up to 4.5.5. Affected by this issue is some unknown functionality of the file mobil/index.php. The manipulation of the argument accesstoken leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-222608. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.222608 - https://vuldb.c
st Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.222608 - https://vuldb.com/?ctiid.222608 - https://gitee.com/ibos/IBOS/issues/I6G5IJ
CVE ID: CVE-2023-1279 State: PUBLISHED Published: 2023-09-01T10:01:41.677Z Last Updated: 2025-11-20T04:06:18.262Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-601 Description: An issue has been discovered in GitLab affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 where it was possible to create a URL that would redirect to a different project. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/395437 - https://hackerone.com/reports/18
ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/395437 - https://hackerone.com/reports/1889230
CVE ID: CVE-2023-1281 State: PUBLISHED Published: 2023-03-22T13:18:55.460Z Last Updated: 2025-03-05T19:22:29.884Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Linux Kernel Problem Types: CWE-416 Description: Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55f
lity to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kernel.dance/#ee059170b1f7e94e55fa6cadee544e176a6e59c2 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ee059170b1f7e94e55fa6cadee544e176a6e59c2 - http://www.openwall.com/lists/oss-security/2023/04/11/3 - https://security.netapp.com/advisory/ntap-20230427-0004/ - https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html - https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
CVE ID: CVE-2023-1282 State: PUBLISHED Published: 2023-04-17T12:17:42.385Z Last Updated: 2025-02-06T15:28:52.381Z Vendors: Unknown Products: Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard, Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard WordPress plugin before 2.11.1 and Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations WordPress plugin before 5.0.6.4 do not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scrip
.4 do not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8a9548c5-59ea-46b0-bfa5-a0f7a259351a - https://wpscan.com/vulnerability/f4b2617f-5235-4587-9eaf-d0f6bb23dc27
CVE ID: CVE-2023-1283 State: PUBLISHED Published: 2023-03-08T00:00:00.000Z Last Updated: 2025-03-05T15:18:04.224Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: builderio Products: builderio/qwik Problem Types: CWE-94 Description: Code Injection in GitHub repository builderio/qwik prior to 0.21.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/63f1ff91-48f3-4886-a179-103f1ddd8ff8 - https://github.com/BuilderIO/qwik/pull/3249/commits/4d9ba6e098ae6e537aa55abb6b8369bb670ffe66
CVE ID: CVE-2023-1285 State: PUBLISHED Published: 2023-04-14T02:17:55.175Z Last Updated: 2025-02-06T20:57:38.924Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Mitsubishi Electric India Products: GC-ENET-COM Problem Types: CWE-364 Description: Signal Handler Race Condition vulnerability in Mitsubishi Electric India GC-ENET-COM whose first 2 digits of 11-digit serial number of unit are "16" allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition in Ethernet communication by sending a large number of specially crafted packets to any UDP port when GC-ENET-COM is configured as a Modbus TCP Server. The communication resumes only when
afted packets to any UDP port when GC-ENET-COM is configured as a Modbus TCP Server. The communication resumes only when the power of the main unit is turned off and on or when the GC-ENET-COM is hot-swapped from the main unit. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mitsubishielectric.in/fa/cnc-pdf/DoS_in_Ethernet_Communication_Extension_Unit_GC_ENET_COM_of_GOC35_Series.pdf - https://www.cisa.gov/news-events/ics-advisories/icsa-23-103-15
CVE ID: CVE-2023-1286 State: PUBLISHED Published: 2023-03-09T00:00:00.000Z Last Updated: 2025-02-28T16:33:29.186Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:H) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/31d97442-3f87-439f-83f0-1c7862ef0c7c - https://github.com/pimcore/pimcore/commit/82cca7f4a7560b160336cce2610481098ca52c18
CVE ID: CVE-2023-1287 State: PUBLISHED Published: 2023-03-09T16:30:42.445Z Last Updated: 2025-02-28T17:09:52.808Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Dassault Systèmes Products: ENOVIA Live Collaboration Problem Types: CWE-74 Description: An XSL template vulnerability in ENOVIA Live Collaboration V6R2013xE allows Remote Code Execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2023-1288 State: PUBLISHED Published: 2023-03-09T16:33:09.843Z Last Updated: 2025-02-27T21:29:48.940Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Dassault Systèmes Products: ENOVIA Live Collaboration Problem Types: CWE-611 Description: An XML External Entity injection (XXE) vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2023-1289 State: PUBLISHED Published: 2023-03-23T00:00:00 Last Updated: 2024-08-02T05:40:59.961Z Vendors: n/a Products: ImageMagick Problem Types: CWE-20 Description: A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of
f the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2176858 - https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j96m-mjp6-99xr - https://github.com/ImageMagick/ImageMagick/commit/c5b23cbf2119540725e6dc81f4deb25798ead6a4 - https://lists.debian.org/debian-lts-announce/2024/02/msg00007.html
CVE ID: CVE-2023-1290 State: PUBLISHED Published: 2023-03-09T14:26:00.790Z Last Updated: 2024-08-02T05:40:59.890Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Sales Tracker Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Sales Tracker Management System 1.0. Affected by this issue is some unknown functionality of the file admin/clients/view_client.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222644. Addit
The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222644. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222644 - https://vuldb.com/?ctiid.222644 - https://github.com/Mart1nD0t/vul-test/blob/main/sts-1.md
CVE ID: CVE-2023-1291 State: PUBLISHED Published: 2023-03-09T14:26:02.421Z Last Updated: 2025-02-28T17:11:59.027Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Sales Tracker Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Sales Tracker Management System 1.0. This affects an unknown part of the file admin/clients/manage_client.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222645 was assigned to this vulnerability. Additional
been disclosed to the public and may be used. The identifier VDB-222645 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.222645 - https://vuldb.com/?ctiid.222645 - https://github.com/Mart1nD0t/vul-test/blob/main/sts-2.md
CVE ID: CVE-2023-1292 State: PUBLISHED Published: 2023-03-09T14:26:04.112Z Last Updated: 2024-08-02T05:41:00.059Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Sales Tracker Management System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Sales Tracker Management System 1.0 and classified as critical. This vulnerability affects the function delete_client of the file classes/Master.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-222646 is the identifier assigned to this vulnerability. Additional An
been disclosed to the public and may be used. VDB-222646 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222646 - https://vuldb.com/?ctiid.222646 - https://github.com/Mart1nD0t/vul-test/blob/main/sts-3.md
CVE ID: CVE-2023-1293 State: PUBLISHED Published: 2023-03-09T14:30:29.708Z Last Updated: 2024-08-02T05:40:59.857Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Online Graduate Tracer System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0 and classified as critical. This issue affects the function mysqli_query of the file admin_cs.php. The manipulation leads to sql injection. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The associa
gh. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222647. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222647 - https://vuldb.com/?ctiid.222647 - https://blog.csdn.net/weixin_43864034/article/details/129418770
CVE ID: CVE-2023-1294 State: PUBLISHED Published: 2023-03-09T14:39:23.579Z Last Updated: 2024-08-02T05:40:59.949Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: File Tracker Manager System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester File Tracker Manager System 1.0. It has been classified as critical. Affected is an unknown function of the file /file_manager/login.php of the component POST Parameter Handler. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is V
attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222648. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222648 - https://vuldb.com/?ctiid.222648 - https://github.com/godownio/bug_report/blob/main/vendors/hemedy99/File%20Tracker%20Manager%20System/SQLi-1.md
CVE ID: CVE-2023-1295 State: PUBLISHED Published: 2023-06-28T11:08:54.348Z Last Updated: 2025-02-13T16:39:20.773Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Linux Kernel Problem Types: CWE-367 Description: A time-of-check to time-of-use issue exists in io_uring subsystem's IORING_OP_CLOSE operation in the Linux kernel's versions 5.6 - 5.11 (inclusive), which allows a local user to elevate their privileges to root. Introduced in b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb, patched in 9eac1904d3364254d622bf2c771c4f85cd435fc2, backported to stable in 788d0824269bef539fe31a785b1517882eafed93. Additional Analyst Notes: - CVE Program Container: Ref
backported to stable in 788d0824269bef539fe31a785b1517882eafed93. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9eac1904d3364254d622bf2c771c4f85cd435fc2 - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=788d0824269bef539fe31a785b1517882eafed93 - https://kernel.dance/9eac1904d3364254d622bf2c771c4f85cd435fc2 - https://kernel.dance/788d0824269bef539fe31a785b1517882eafed93 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb - https://security.netapp.com/advisory/ntap-20230731-0006/
CVE ID: CVE-2023-1296 State: PUBLISHED Published: 2023-03-14T14:45:24.074Z Last Updated: 2025-02-27T15:28:15.947Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: HashiCorp Products: Nomad, Nomad Enterprise Problem Types: CWE-682 Description: HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.5.0 did not correctly enforce deny policies applied to a workload’s variables. Fixed in 1.4.6 and 1.5.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2023-09-nomad-acls-can-not-deny-access-to-workloads-own-variables/51390
CVE ID: CVE-2023-1297 State: PUBLISHED Published: 2023-06-02T22:48:28.938Z Last Updated: 2025-01-08T17:51:02.037Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: HashiCorp Products: Consul, Consul Enterprise Problem Types: CWE-826 Description: Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2023-15-consul-cluster
E Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2023-15-consul-cluster-peering-can-result-in-denial-of-service/54515
CVE ID: CVE-2023-1298 State: PUBLISHED Published: 2023-07-06T17:13:27.552Z Last Updated: 2024-10-21T21:11:09.595Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: ServiceNow Products: Now User Experience Problem Types: CWE-79 Description: ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow Polaris Layout. This vulnerability would enable an authenticated user to inject arbitrary scripts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1310230 - https://w
P Vulnrichment: References: - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1310230 - https://www.linkedin.com/in/osamay/
CVE ID: CVE-2023-1299 State: PUBLISHED Published: 2023-03-14T14:46:41.456Z Last Updated: 2025-02-27T15:27:31.165Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: HashiCorp Products: Nomad, Nomad Enterprise Problem Types: CWE-862 Description: HashiCorp Nomad and Nomad Enterprise 1.5.0 allow a job submitter to escalate to management-level privileges using workload identity and task API. Fixed in 1.5.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2023-08-nomad-job-submitter-privilege-escalation-using-workload-identity/51389
CVE ID: CVE-2023-1300 State: PUBLISHED Published: 2023-03-09T21:30:17.774Z Last Updated: 2025-02-13T21:19:24.259Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: COVID 19 Testing Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester COVID 19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file patient-report.php of the component POST Parameter Handler. The manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222661
attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222661 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.222661 - https://vuldb.com/?ctiid.222661 - https://github.com/mhz2846415362/bug_report/blob/main/vendors/unyasoft/COVID%2019%20Testing%20Management%20System/SQLi-1.md