Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
Problem Types: CWE-942 Description: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). When accessing the UMC Web-UI from affected products, UMC uses an overly
(TIA Portal) V18 (All versions < V18 Update 3). When accessing the UMC Web-UI from affected products, UMC uses an overly permissive CORS policy. This could allow an attacker to trick a legitimate user to trigger unwanted behavior. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf - https://cert-portal.siemens.com/productcert/html/ssa-999588.html
CVE ID: CVE-2023-46282 State: PUBLISHED Published: 2023-12-12T11:27:13.134Z Last Updated: 2025-01-14T10:29:51.618Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C) Vendors: Siemens Products: Opcenter Execution Foundation, Opcenter Quality, SIMATIC PCS neo, SINEC NMS, Totally Integrated Automation Portal (TIA Portal) V14, Totally Integrated Automation Portal (TIA Portal) V15.1, Totally Integrated Automation Portal (TIA Portal) V16, Totally Integrated Automation Portal (TIA Portal) V17, Totally Integrated Automation Portal (TIA Portal) V18 Problem Types: CWE-79 Description: A vulnerability has been identified in Opcenter Execution Foundation (All versions <
Problem Types: CWE-79 Description: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). A reflected cross-site scripting (XSS) vulnerability exists in the web in
TIA Portal) V18 (All versions < V18 Update 3). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected applications that could allow an attacker to inject arbitrary JavaScript code. The code could be potentially executed later by another (possibly privileged) user. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf - https://cert-portal.siemens.com/productcert/html/ssa-999588.html
CVE ID: CVE-2023-46283 State: PUBLISHED Published: 2023-12-12T11:27:14.437Z Last Updated: 2025-01-14T10:29:52.922Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Opcenter Execution Foundation, Opcenter Quality, SIMATIC PCS neo, SINEC NMS, Totally Integrated Automation Portal (TIA Portal) V14, Totally Integrated Automation Portal (TIA Portal) V15.1, Totally Integrated Automation Portal (TIA Portal) V16, Totally Integrated Automation Portal (TIA Portal) V17, Totally Integrated Automation Portal (TIA Portal) V18 Problem Types: CWE-120 Description: A vulnerability has been identified in Opcenter Execution Foundation (All versions <
Problem Types: CWE-120 Description: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). The affected application contains an out of bounds write past the end of
(TIA Portal) V18 (All versions < V18 Update 3). The affected application contains an out of bounds write past the end of an allocated buffer when handling specific requests on port 4002/tcp. This could allow an attacker to crash the application. The corresponding service is auto-restarted after the crash. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf - https://cert-portal.siemens.com/productcert/html/ssa-999588.html
CVE ID: CVE-2023-46284 State: PUBLISHED Published: 2023-12-12T11:27:15.737Z Last Updated: 2025-01-14T10:29:54.329Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Opcenter Execution Foundation, Opcenter Quality, SIMATIC PCS neo, SINEC NMS, Totally Integrated Automation Portal (TIA Portal) V14, Totally Integrated Automation Portal (TIA Portal) V15.1, Totally Integrated Automation Portal (TIA Portal) V16, Totally Integrated Automation Portal (TIA Portal) V17, Totally Integrated Automation Portal (TIA Portal) V18 Problem Types: CWE-120 Description: A vulnerability has been identified in Opcenter Execution Foundation (All versions <
(TIA Portal) V18 (All versions < V18 Update 3). The affected application contains an out of bounds write past the end of an allocated buffer when handling specific requests on port 4002/tcp and 4004/tcp. This could allow an attacker to crash the application. The corresponding service is auto-restarted after the crash. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf - https://cert-portal.siemens.com/productcert/html/ssa-999588.html
CVE ID: CVE-2023-46285 State: PUBLISHED Published: 2023-12-12T11:27:17.080Z Last Updated: 2025-05-24T10:24:30.154Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Opcenter Execution Foundation, Opcenter Quality, SIMATIC PCS neo, SINEC NMS, Totally Integrated Automation Portal (TIA Portal) V14, Totally Integrated Automation Portal (TIA Portal) V15.1, Totally Integrated Automation Portal (TIA Portal) V16, Totally Integrated Automation Portal (TIA Portal) V17, Totally Integrated Automation Portal (TIA Portal) V18 Problem Types: CWE-20 Description: A vulnerability has been identified in Opcenter Execution Foundation (All versions <
Problem Types: CWE-20 Description: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). The affected application contains an improper input validation vulnerabil
TIA Portal) V18 (All versions < V18 Update 3). The affected application contains an improper input validation vulnerability that could allow an attacker to bring the service into a Denial-of-Service state by sending a specifically crafted message to 4004/tcp. The corresponding service is auto-restarted after the crash is detected by a watchdog. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf - https://cert-portal.siemens.com/productcert/html/ssa-999588.html
CVE ID: CVE-2023-46287 State: PUBLISHED Published: 2023-10-20T00:00:00.000Z Last Updated: 2025-11-03T19:28:30.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in NagVis before 1.9.38 via the select function in share/server/core/functions/html.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/NagVis/nagvis/pull/356 - https://github.com/NagVis/nagvis/pull/356/commits/d660591b23e5cfea4d1be2d3fb8f3855aa6020fb - https://github.com/NagVis/nagvis/compare/nagvis-1.9.37...nagvis-1.9.38
CVE ID: CVE-2023-46288 State: PUBLISHED Published: 2023-10-23T18:13:04.412Z Last Updated: 2025-02-13T17:14:24.702Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2.7.0. Sensitive configuration information has been exposed to authenticated users with the ability to read configuration via Airflow REST API for configuration even when the expose_config option is set to non-sensitive-only. The expose_config option is False by default. It is recommended to upgrade to a version that is not affected if you set exp
expose_config option is False by default. It is recommended to upgrade to a version that is not affected if you set expose_config to non-sensitive-only configuration. This is a different error than CVE-2023-45348 which allows authenticated user to retrieve individual configuration values in 2.7.* by specially crafting their request (solved in 2.7.2). Users are recommended to upgrade to version 2.7.2, which fixes the issue and additionally fixes CVE-2023-45348. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/32261 - https://lists.apache.org/thread/yw4vzm0c5lqkwm0bxv6qy03yfd1od4nw - http://www.openwall.com/lists/
e/airflow/pull/32261 - https://lists.apache.org/thread/yw4vzm0c5lqkwm0bxv6qy03yfd1od4nw - http://www.openwall.com/lists/oss-security/2024/04/17/10
CVE ID: CVE-2023-46289 State: PUBLISHED Published: 2023-10-27T18:28:40.936Z Last Updated: 2025-02-27T20:39:04.320Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Rockwell Automation Products: FactoryTalk® View Site Edition Problem Types: CWE-20 Description: Rockwell Automation FactoryTalk View Site Edition insufficiently validates user input, which could potentially allow threat actors to send malicious data bringing the product offline. If exploited, the product would become unavailable and require a restart to recover resulting in a denial-of-service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
-of-service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141167
CVE ID: CVE-2023-46290 State: PUBLISHED Published: 2023-10-27T18:10:50.923Z Last Updated: 2025-02-27T20:39:11.981Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Rockwell Automation Products: FactoryTalk® Services Platform Problem Types: CWE-287 Description: Due to inadequate code logic, a previously unauthenticated threat actor could potentially obtain a local Windows OS user token through the FactoryTalk® Services Platform web service and then use the token to log in into FactoryTalk® Services Platform . This vulnerability can only be exploited if the authorized user did not previously log in into the FactoryTalk® Services Platform web service. Additional A
oited if the authorized user did not previously log in into the FactoryTalk® Services Platform web service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141165
CVE ID: CVE-2023-46294 State: PUBLISHED Published: 2024-05-01T00:00:00 Last Updated: 2024-11-04T17:09:19.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Teledyne FLIR M300 2.00-19. User account passwords are encrypted locally, and can be decrypted to cleartext passwords using the utility umSetup. This utility requires root permissions to execute. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://Loudmouth.io - https://gitlab.com/loudmouth-security/vulnerability-disclosures/cve-2023-46294
CVE ID: CVE-2023-46295 State: PUBLISHED Published: 2024-05-01T00:00:00 Last Updated: 2024-08-02T20:45:40.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Teledyne FLIR M300 2.00-19. Unauthenticated remote code execution can occur in the web server. An attacker can exploit this by sending a POST request to the vulnerable PHP page. An attacker can elevate to root permissions with Sudo. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/loudmouth-security/vulnerability-disclosures/cve-2023-46295
CVE ID: CVE-2023-46297 State: PUBLISHED Published: 2024-05-29T15:35:10.266Z Last Updated: 2025-02-13T15:46:54.813Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Mercusys MW325R EU V3 MW325R(EU)_V3_1.11.0 221019 devices. A WAN attacker can make the admin interface unreachable/invisible via an unauthenticated HTTP request. Verification of the data sent by the user does not occur. The web server does not crash, but the admin interface becomes invisible, because the files necessary to display the content are no longer available. A reboot of the router is typically required to restore the correct behavior. Additional Analyst Notes: - CVE Program Container:
of the router is typically required to restore the correct behavior. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://k4m1ll0.com/cve-2023-46297.html
CVE ID: CVE-2023-46298 State: PUBLISHED Published: 2023-10-22T00:00:00 Last Updated: 2024-09-12T17:50:34.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vercel/next.js/pull/54732 - https://github.com/vercel/next.js/issues/45301 - https://github.com/vercel/next.js/compare/v13.4.20-canary.12...v13.4.20-canary.13
CVE ID: CVE-2023-46300 State: PUBLISHED Published: 2023-10-22T00:00:00 Last Updated: 2024-09-12T17:49:38.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to tmux integration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gnachman/iTerm2/commit/ae8192522661c34d1cbe57f6f9ef2ff0a337c2a5 - https://github.com/gnachman/iTerm2/commit/b2268b03b5f3d4cd8ca275eaef5d16d0fac20009 - https://blog.solidsnail.com/posts/2023-08-28-iterm2-rce - https://iterm2.com/news.html
CVE ID: CVE-2023-46301 State: PUBLISHED Published: 2023-10-22T00:00:00 Last Updated: 2024-09-12T17:48:57.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to upload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gnachman/iTerm2/commit/b2268b03b5f3d4cd8ca275eaef5d16d0fac20009 - https://blog.solidsnail.com/posts/2023-08-28-iterm2-rce - https://iterm2.com/news.html - https://github.com/gnachman/iTerm2/commit/85cbf5ebda472c9ec295887e99c2b6f1b5867f1b
CVE ID: CVE-2023-46302 State: PUBLISHED Published: 2023-11-20T08:46:56.197Z Last Updated: 2024-08-02T20:45:40.909Z Vendors: Apache Software Foundation Products: Apache Submarine Problem Types: CWE-502 Description: Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-1471 . Apache Submarine uses JAXRS to define REST endpoints. In order to handle YAML requests (using application/yaml content-type), it defines a YamlEntityProvider entity provider that will process all incoming YAML requests. In order to unmarshal the request, the readFrom method is invoked, passing the entityStream containin
ing YAML requests. In order to unmarshal the request, the readFrom method is invoked, passing the entityStream containing the user-supplied data in `submarine-server/server-core/src/main/java/org/apache/submarine/server/utils/YamlUtils.java`. We have now fixed this issue in the new version by replacing to `jackson-dataformat-yaml`. This issue affects Apache Submarine: from 0.7.0 before 0.8.0. Users are recommended to upgrade to version 0.8.0, which fixes this issue. If using the version smaller than 0.8.0 and not want to upgrade, you can try cherry-pick PR https://github.com/apache/submarine/pull/1054 and rebuild the submart-server image to fix this. Additional Analyst Notes: - CVE Program C
m/apache/submarine/pull/1054 and rebuild the submart-server image to fix this. Additional Analyst Notes: - CVE Program Container: References: - https://issues.apache.org/jira/browse/SUBMARINE-1371 - https://github.com/apache/submarine/pull/1054 - https://lists.apache.org/thread/zf0wppzh239j4h131hm1dbswfnztxrr5
CVE ID: CVE-2023-46303 State: PUBLISHED Published: 2023-10-22T00:00:00.000Z Last Updated: 2025-11-04T16:10:39.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/0x1717/ssrf-via-img - https://github.com/kovidgoyal/calibre/compare/v6.18.1...v6.19.0
CVE ID: CVE-2023-46304 State: PUBLISHED Published: 2024-04-30T00:00:00 Last Updated: 2024-08-02T20:45:40.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file (executed on every page load). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.vtiger.com/ - https://code.vtiger.com/vtiger/vtigercrm/-/blob/master/modules/Users/models/Module.php - https://github.com/jselliott/CVE-2023-46304 - https://code.vtiger.com/vtiger/vtigercrm/-
dules/Users/models/Module.php - https://github.com/jselliott/CVE-2023-46304 - https://code.vtiger.com/vtiger/vtigercrm/-/commit/317f9ca88b6bbded11058f20a1d232717c360d43
CVE ID: CVE-2023-46306 State: PUBLISHED Published: 2023-10-22T00:00:00 Last Updated: 2024-09-12T18:22:55.873Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The web administration interface in NetModule Router Software (NRSW) 4.6 before 4.6.0.106 and 4.8 before 4.8.0.101 executes an OS command constructed with unsanitized user input: shell metacharacters in the /admin/gnssAutoAlign.php device_id parameter. This occurs because another thread can be started before the trap that triggers the cleanup function. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privil
anup function. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges. NOTE: this is different from CVE-2023-0861 and CVE-2023-0862, which were fixed in version 4.6.0.105. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://share.netmodule.com/public/system-software/4.8/4.8.0.101/NRSW-RN-4.8.0.101.pdf - https://share.netmodule.com/public/system-software/4.6/4.6.0.106/NRSW-RN-4.6.0.106.pdf - https://pentest.blog/advisory-netmodule-router-software-race-condition-leads-to-remote-code-execution/
CVE ID: CVE-2023-46307 State: PUBLISHED Published: 2023-12-07T00:00:00.000Z Last Updated: 2025-05-28T15:42:04.928Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in server.js in etcd-browser 87ae63d75260. By supplying a /../../../ Directory Traversal input to the URL's GET request while connecting to the remote server port specified during setup, an attacker can retrieve local operating system files from the remote system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hub.docker.com/r/buddho/etcd-browser - https://hub.docker.com/r/buddho/etcd-browser/tags - http://seclists.org/fulldisclosure/2023/Nov/9 -
ddho/etcd-browser - https://hub.docker.com/r/buddho/etcd-browser/tags - http://seclists.org/fulldisclosure/2023/Nov/9 - http://seclists.org/fulldisclosure/2023/Nov/11
CVE ID: CVE-2023-46308 State: PUBLISHED Published: 2024-01-03T00:00:00.000Z Last Updated: 2025-06-03T14:45:04.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plotly.com/javascript/ - https://github.com/plotly/plotly.js/releases/tag/v2.25.2
CVE ID: CVE-2023-46309 State: PUBLISHED Published: 2025-01-02T12:00:17.479Z Last Updated: 2025-01-03T19:08:58.257Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: gVectors Team Products: wpDiscuz Problem Types: CWE-862 Description: Missing Authorization vulnerability in gVectors Team wpDiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through 7.6.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpdiscuz/vulnerability/wordpress-wpdiscuz-plugin-7-6-10-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-46310 State: PUBLISHED Published: 2024-06-04T09:19:41.867Z Last Updated: 2024-08-02T20:45:40.799Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: gVectors Team Products: wpDiscuz Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpDiscuz allows Code Injection.This issue affects wpDiscuz: from n/a through 7.6.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wpdiscuz/wordpress-wpdiscuz-plugin-7-6-10-content-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-46311 State: PUBLISHED Published: 2023-12-20T13:32:29.041Z Last Updated: 2024-11-20T19:54:40.369Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: gVectors Team Products: Comments – wpDiscuz Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team Comments – wpDiscuz.This issue affects Comments – wpDiscuz: from n/a through 7.6.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wpdiscuz/wordpress-wpdiscuz-plugin-7-6-3-insecure-direct-object-references-idor-vulnerability?_s_id=cve