Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6037 State: PUBLISHED Published: 2024-01-01T14:18:57.409Z Last Updated: 2025-06-18T14:56:27.466Z Vendors: Unknown Products: WP TripAdvisor Review Slider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP TripAdvisor Review Slider WordPress plugin before 11.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/753df046-9fd7-4d15-9114-45cde6d6539b
CVE ID: CVE-2023-6038 State: PUBLISHED Published: 2023-11-16T16:06:43.684Z Last Updated: 2024-08-29T14:49:01.903Z Severity: CRITICAL (CVSS 9.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: h2oai Products: h2oai/h2o-3 Problem Types: CWE-862 Description: A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This is
be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/380fce33-fec5-49d9-a101-12c972125d8c
CVE ID: CVE-2023-6039 State: PUBLISHED Published: 2023-11-09T15:08:03.326Z Last Updated: 2025-02-27T20:34:12.368Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a, Red Hat, Fedora Products: Kernel, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Fedora Problem Types: CWE-416 Description: A use-after-free flaw was found in lan78xx_disconnect in drivers/net/usb/lan78xx.c in the network sub-component, net/usb/lan78xx in the Linux Kernel. This flaw allows a local attacker to crash the system when the LAN78XX USB device detaches. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnri
sh the system when the LAN78XX USB device detaches. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-6039 - https://bugzilla.redhat.com/show_bug.cgi?id=2248755 - https://github.com/torvalds/linux/commit/1e7417c188d0a83fb385ba2dbe35fd2563f2b6f3
CVE ID: CVE-2023-6040 State: PUBLISHED Published: 2024-01-12T01:37:45.387Z Last Updated: 2025-06-17T21:09:18.328Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: The Linux Kernel Organization Products: linux Problem Types: CWE-125 Description: An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an attacker to achieve out-of-bounds access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
es an attacker to achieve out-of-bounds access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6040 - https://www.openwall.com/lists/oss-security/2024/01/12/1 - http://www.openwall.com/lists/oss-security/2024/01/12/1 - http://packetstormsecurity.com/files/177029/Kernel-Live-Patch-Security-Notice-LSN-0100-1.html - https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html - https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
CVE ID: CVE-2023-6042 State: PUBLISHED Published: 2024-01-08T19:00:28.796Z Last Updated: 2025-06-03T14:34:57.602Z Vendors: Unknown Products: Getwid Problem Types: CWE-287 Improper Authentication Description: Any unauthenticated user may send e-mail from the site with any title or content to the admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/56a1c050-67b5-43bc-b5b6-28d9a5a59eba
CVE ID: CVE-2023-6043 State: PUBLISHED Published: 2024-01-19T20:08:26.945Z Last Updated: 2025-06-17T21:19:24.515Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Vantage Problem Types: CWE-295 Description: A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker to bypass integrity checks and execute arbitrary code with elevated privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-144736
CVE ID: CVE-2023-6044 State: PUBLISHED Published: 2024-01-19T20:09:05.706Z Last Updated: 2025-05-30T14:25:28.842Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Vantage Problem Types: CWE-290 Description: A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker with physical access to impersonate Lenovo Vantage Service and execute arbitrary code with elevated privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-144736
CVE ID: CVE-2023-6045 State: PUBLISHED Published: 2023-11-20T11:46:27.780Z Last Updated: 2024-08-14T17:58:17.084Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-843 Description: in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through type confusion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md
CVE ID: CVE-2023-6046 State: PUBLISHED Published: 2024-01-16T15:54:15.535Z Last Updated: 2025-06-13T19:10:24.185Z Vendors: Unknown Products: EventON Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored HTML Injection attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/97f1d403-ae96-4c90-8d47-9822f4d68033/
CVE ID: CVE-2023-6047 State: PUBLISHED Published: 2024-03-29T11:35:09.079Z Last Updated: 2024-08-02T08:21:17.138Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Algoritim Products: E-commerce Software Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Algoritim E-commerce Software allows Reflected XSS.This issue affects E-commerce Software: before 3.9.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-0252
CVE ID: CVE-2023-6048 State: PUBLISHED Published: 2024-01-15T15:10:40.683Z Last Updated: 2025-06-03T14:00:30.846Z Vendors: Unknown Products: Estatik Real Estate Plugin Problem Types: CWE-862 Missing Authorization Description: The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not prevent user with low privileges on the site, like subscribers, from setting any of the site's options to 1, which could be used to break sites and lead to DoS when certain options are reset Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/74cb07fe-fc82-472f-8c52-859c176d9e51
CVE ID: CVE-2023-6049 State: PUBLISHED Published: 2024-01-15T15:10:39.151Z Last Updated: 2025-06-03T14:00:44.618Z Vendors: Unknown Products: Estatik Real Estate Plugin Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8cfd8c1f-2834-4a94-a3fa-c0cfbe78a8b7
CVE ID: CVE-2023-6050 State: PUBLISHED Published: 2024-01-15T15:10:42.097Z Last Updated: 2025-06-03T14:00:22.782Z Vendors: Unknown Products: Estatik Real Estate Plugin Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not sanitise and escape various parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c08e0f24-bd61-4e83-a555-363568cf0e6e
CVE ID: CVE-2023-6051 State: PUBLISHED Published: 2023-12-15T16:02:50.265Z Last Updated: 2025-11-20T04:11:13.279Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-94 Description: An issue has been discovered in GitLab CE/EE affecting all versions before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when source code or installation packages are pulled from a specific tag. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/431345 - https://hackerone.com/reports/2237165
CVE ID: CVE-2023-6052 State: PUBLISHED Published: 2023-11-09T12:37:56.723Z Last Updated: 2024-11-21T15:37:52.982Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Tongda Products: OA 2017 Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.9. Affected is an unknown function of the file general/system/censor_words/module/delete.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulne
n 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-244872. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.244872 - https://vuldb.com/?ctiid.244872 - https://github.com/kenankkkkk/cve/blob/main/sql.md
CVE ID: CVE-2023-6053 State: PUBLISHED Published: 2023-11-09T19:00:06.589Z Last Updated: 2024-08-02T08:21:17.157Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Tongda Products: OA 2017 Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in Tongda OA 2017 up to 11.9. Affected by this issue is some unknown functionality of the file general/system/censor_words/manage/delete.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected compon
may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-244874 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.244874 - https://vuldb.com/?ctiid.244874 - https://github.com/Conan0313/cve/blob/main/sql.md
CVE ID: CVE-2023-6054 State: PUBLISHED Published: 2023-11-09T19:00:07.653Z Last Updated: 2024-08-02T08:21:17.168Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Tongda Products: OA 2017 Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file general/wiki/cp/manage/lock.php. The manipulation of the argument TERM_ID_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vul
s able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244875. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.244875 - https://vuldb.com/?ctiid.244875 - https://github.com/TinkAnet/cve/blob/main/sql2.md
CVE ID: CVE-2023-6055 State: PUBLISHED Published: 2024-10-18T07:17:02.731Z Last Updated: 2024-10-18T15:28:39.254Z Vendors: Bitdefender Products: Total Security Problem Types: CWE-295 Description: A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software fails to properly validate website certificates. Specifically, if a site certificate lacks the "Server Authentication" specification in the Extended Key Usage extension, the product does not verify the certificate's compliance with the site, deeming such certificates as valid. This flaw could allow an attacker to perform a Man-in-the-Middle (MITM) attack, intercepting and potentially alt
valid. This flaw could allow an attacker to perform a Man-in-the-Middle (MITM) attack, intercepting and potentially altering communications between the user and the website. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bitdefender.com/support/security-advisories/improper-certificate-validation-in-bitdefender-total-security-https-scanning-va-11158/
CVE ID: CVE-2023-6056 State: PUBLISHED Published: 2024-10-18T07:31:23.425Z Last Updated: 2024-10-18T15:27:35.942Z Vendors: BItdefender Products: Total Security Problem Types: CWE-295 Description: A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of self-signed certificates. The product is found to trust certificates signed with the RIPEMD-160 hashing algorithm without proper validation, allowing an attacker to establish MITM SSL connections to arbitrary sites. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.bitdefender.com/support/security-advisories/insecure-trust-of-self-signed-cert
P Vulnrichment: References: - https://www.bitdefender.com/support/security-advisories/insecure-trust-of-self-signed-certificates-in-bitdefender-total-security-https-scanning-va-11164/
CVE ID: CVE-2023-6057 State: PUBLISHED Published: 2024-10-18T07:38:23.788Z Last Updated: 2024-11-21T16:25:46.655Z Vendors: Bitdefender Products: Total Security Problem Types: CWE-295 Description: A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of certificates issued using the DSA signature algorithm. The product does not properly check the certificate chain, allowing an attacker to establish MITM SSL connections to arbitrary sites using a DSA-signed certificate. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.bitdefender.com/support/security-advisories/insecure-trust-of-dsa-signed-c
A ADP Vulnrichment: References: - https://www.bitdefender.com/support/security-advisories/insecure-trust-of-dsa-signed-certificates-in-bitdefender-total-security-https-scanning-va-11166/
CVE ID: CVE-2023-6058 State: PUBLISHED Published: 2024-10-18T07:52:08.678Z Last Updated: 2024-10-18T15:26:30.132Z Vendors: Bitdefender Products: Total Security Problem Types: CWE-295 Description: A vulnerability has been identified in Bitdefender Safepay's handling of HTTPS connections. The issue arises when the product blocks a connection due to an untrusted server certificate but allows the user to add the site to exceptions, resulting in the product trusting the certificate for subsequent HTTPS scans. This vulnerability allows an attacker to perform a Man-in-the-Middle (MITM) attack by using a self-signed certificate, which the product will trust after the site has been added to exception
MITM) attack by using a self-signed certificate, which the product will trust after the site has been added to exceptions. This can lead to the interception and potential alteration of secure communications. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.bitdefender.com/support/security-advisories/https-certificate-validation-issue-in-bitdefender-safepay-va-11167/
CVE ID: CVE-2023-6060 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:08.905Z Description: No description available.
CVE ID: CVE-2023-6061 State: REJECTED Published: 2023-12-07T23:21:22.755Z Last Updated: 2024-12-12T22:56:25.742Z Description: No description available.
CVE ID: CVE-2023-6062 State: PUBLISHED Published: 2023-11-20T20:20:04.927Z Last Updated: 2024-12-02T20:52:31.935Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: Tenable Products: Nessus Description: An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges on the Nessus application could alter Nessus Rules variables to overwrite arbitrary files on the remote host, which could lead to a denial of service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/tns-2023-39 - https://www.tenable.com/security/tns-2023-40
CVE ID: CVE-2023-6063 State: PUBLISHED Published: 2023-12-04T21:29:41.536Z Last Updated: 2024-08-02T08:21:17.206Z Vendors: Unknown Products: WP Fastest Cache Problem Types: CWE-89 SQL Injection Description: The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/30a74105-8ade-4198-abe2-1c6f2967443e - https://wpscan.com/blog/unauthenticated-sql-injection-vulnerability-addressed-in-wp-fastest-cache-1-2-2/
CVE ID: CVE-2023-6064 State: PUBLISHED Published: 2024-01-01T14:18:52.756Z Last Updated: 2025-05-13T14:46:07.050Z Vendors: Unknown Products: PayHere Payment Gateway Problem Types: CWE-200 Information Exposure Description: The PayHere Payment Gateway WordPress plugin before 2.2.12 automatically creates publicly-accessible log files containing sensitive information when transactions occur. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/423c8881-628b-4380-9677-65b3f5165efe
CVE ID: CVE-2023-6065 State: PUBLISHED Published: 2023-12-18T20:07:56.766Z Last Updated: 2024-08-02T08:21:17.223Z Vendors: Unknown Products: Quttera Web Malware Scanner Problem Types: CWE-200 Information Exposure Description: The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious actor to discover local paths and portions of the site's code Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/64f2557f-c5e4-4779-9e28-911dfaf2dda5 - https://drive.google.com/file/d/1w83xWsVLS_gCpQy4LDwbjNK9JaB87EEf/view?usp=sharing
CVE ID: CVE-2023-6066 State: PUBLISHED Published: 2024-01-15T15:10:43.076Z Last Updated: 2025-05-12T14:51:23.228Z Vendors: Unknown Products: WP Custom Widget area Problem Types: CWE-862 Missing Authorization Description: The WP Custom Widget area WordPress plugin through 1.2.5 does not properly apply capability and nonce checks on any of its AJAX action callback functions, which could allow attackers with subscriber+ privilege to create, delete or modify menus on the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f8f84d47-49aa-4258-a8a6-3de8e7342623
CVE ID: CVE-2023-6067 State: PUBLISHED Published: 2024-04-15T05:00:01.200Z Last Updated: 2024-08-02T08:21:17.215Z Vendors: Unknown Products: WP User Profile Avatar Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP User Profile Avatar WordPress plugin through 1.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/ae8e225a-5273-4db1-9c72-060304cca658/
CVE ID: CVE-2023-6068 State: PUBLISHED Published: 2024-03-04T19:44:08.620Z Last Updated: 2024-08-02T08:21:17.180Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Arista Networks Products: MOS Problem Types: CWE-283 Description: On affected 7130 Series FPGA platforms running MOS and recent versions of the MultiAccess FPGA, application of ACL’s may result in incorrect operation of the configured ACL for a port resulting in some packets that should be denied being permitted and some Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/19023-security-advisory
Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/19023-security-advisory-0091
CVE ID: CVE-2023-6069 State: PUBLISHED Published: 2023-11-10T00:00:32.765Z Last Updated: 2024-08-02T08:21:17.449Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: froxlor Products: froxlor/froxlor Problem Types: CWE-59 Description: Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/aac0627e-e59d-476e-9385-edb7ff53758c - https://github.com/froxlor/froxlor/commit/9e8f32f1e86016733b603b50c31b97f472e8dabc
CVE ID: CVE-2023-6070 State: PUBLISHED Published: 2023-11-29T08:53:57.903Z Last Updated: 2024-10-11T17:56:19.677Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Trellix Products: Trellix Enterprise Security Manager (ESM) Problem Types: CWE-918 Description: A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary content, potentially altering configuration. This is possible through the certificate validation functionality where the API accepts uploaded content and doesn't parse for invalid data Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
and doesn't parse for invalid data Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kcm.trellix.com/corporate/index?page=content&id=SB10413