Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-28386 State: PUBLISHED Published: 2023-05-22T19:35:12.357Z Last Updated: 2025-01-16T21:33:35.168Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: Snap One Products: OvrC Cloud Problem Types: CWE-354 Description: Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. The device only calculates the MD5 hash of the firmware and does not check using a private-public key mechanism. The lack of complete PKI system firmware signature could allow attackers to upload arbitrary firmware updates, resulting in code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
sulting in code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01 - https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf
CVE ID: CVE-2023-28387 State: PUBLISHED Published: 2023-06-30T06:22:37.864Z Last Updated: 2024-12-04T15:58:06.395Z Vendors: NewsPicks, Inc. Products: "NewsPicks" App for Android, "NewsPicks" App for iOS Problem Types: Use of Hard-coded Credentials Description: "NewsPicks" App for Android versions 10.4.5 and earlier and "NewsPicks" App for iOS versions 10.4.2 and earlier use hard-coded credentials, which may allow a local attacker to analyze data in the app and to obtain API key for an external service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://play.google.com/store/apps/details?id=com.newspicks - https://apps.apple.com/us/app/%E3%83%8B%
nt: References: - https://play.google.com/store/apps/details?id=com.newspicks - https://apps.apple.com/us/app/%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%BA%E3%83%94%E3%83%83%E3%82%AF%E3%82%B9-%E3%83%93%E3%82%B8%E3%83%8D%E3%82%B9%E3%81%AB%E5%BD%B9%E7%AB%8B%E3%81%A4%E7%B5%8C%E6%B8%88%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%B9%E3%82%A2%E3%83%97%E3%83%AA/id640956497 - https://jvn.jp/en/jp/JVN32739265/
CVE ID: CVE-2023-28388 State: PUBLISHED Published: 2023-11-14T19:05:12.312Z Last Updated: 2025-06-11T14:20:36.937Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Chipset Device Software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path element in some Intel(R) Chipset Device Software before version 10.1.19444.8378 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00870.html
CVE ID: CVE-2023-28389 State: PUBLISHED Published: 2024-03-14T16:45:48.448Z Last Updated: 2025-11-04T16:10:04.595Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) CSME installer software Problem Types: escalation of privilege, CWE-276 Description: Incorrect default permissions in some Intel(R) CSME installer software before version 2328.5.5.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00923.html
CVE ID: CVE-2023-28390 State: PUBLISHED Published: 2023-05-23T00:00:00 Last Updated: 2025-01-17T18:19:45.140Z Vendors: ICOM INCORPORATED Products: SR-7100VN Problem Types: Privilege escalation Description: Privilege escalation vulnerability in SR-7100VN firmware Ver.1.38(N) and earlier and SR-7100VN #31 firmware Ver.1.21 and earlier allows a network-adjacent attacker with administrative privilege of the affected product to obtain an administrative privilege of the OS (Operating System). As a result, an arbitrary OS command may be executed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.icom.co.jp/news/7239/ - https://jvn.jp/en/jp/JVN8047
ogram Container: - CISA ADP Vulnrichment: References: - https://www.icom.co.jp/news/7239/ - https://jvn.jp/en/jp/JVN80476232/
CVE ID: CVE-2023-28391 State: PUBLISHED Published: 2023-11-14T09:14:53.018Z Last Updated: 2025-11-04T19:15:51.474Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Silicon Labs, Weston Embedded Products: Gecko Platform, Cesium NET, uC-HTTP Problem Types: CWE-119 Description: A memory corruption vulnerability exists in the HTTP Server header parsing functionality of Weston Embedded uC-HTTP v3.01.01. Specially crafted network packets can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerabilit
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1732
CVE ID: CVE-2023-28392 State: PUBLISHED Published: 2023-05-23T00:00:00 Last Updated: 2025-01-17T18:20:55.636Z Vendors: Inaba Denki Sangyo Co., Ltd. Products: Wi-Fi AP UNIT Problem Types: OS Command Injection Description: Wi-Fi AP UNIT AC-PD-WAPU v1.05_B04 and earlier, AC-PD-WAPUM v1.05_B04 and earlier, AC-PD-WAPU-P v1.05_B04P and earlier, AC-PD-WAPUM-P v1.05_B04P and earlier, AC-WAPU-300 v1.00_B07 and earlier, AC-WAPU-300-P v1.00_B08P and earlier, AC-WAPUM-300 v1.00_B07 and earlier, and AC-WAPUM-300-P v1.00_B08P and earlier allow an authenticated user with an administrative privilege to execute an arbitrary OS command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichmen
privilege to execute an arbitrary OS command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.inaba.co.jp/abaniact/news/Wi-Fi%20AP%20UNIT%E3%80%8CAC-WAPU-300%E3%80%8D%E3%81%AB%E3%81%8A%E3%81%91%E3%82%8BOS%E3%82%B3%E3%83%9E%E3%83%B3%E3%83%89%E3%82%A4%E3%83%B3%E3%82%B8%E3%82%A7%E3%82%AF%E3%82%B7%E3%83%A7%E3%83%B3%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6.pdf - https://jvn.jp/en/vu/JVNVU98968780/ - https://jvn.jp/en/jp/JVN28412757/
CVE ID: CVE-2023-28393 State: PUBLISHED Published: 2023-09-25T15:22:35.451Z Last Updated: 2025-11-04T19:15:52.575Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Accusoft Products: ImageGear Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the tif_processing_dng_channel_count functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1742
CVE ID: CVE-2023-28394 State: PUBLISHED Published: 2023-05-23T00:00:00 Last Updated: 2025-01-17T18:22:57.938Z Vendors: Beekeeper Studio, Inc. Products: Beekeeper Studio Problem Types: Code injection Description: Beekeeper Studio versions prior to 3.9.9 allows a remote authenticated attacker to execute arbitrary JavaScript code with the privilege of the application on the PC where the affected product is installed. As a result, an arbitrary OS command may be executed as well. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.beekeeperstudio.io/ - https://github.com/beekeeper-studio/beekeeper-studio - https://jvn.jp/en/jp/JVN11705010/
CVE ID: CVE-2023-28395 State: PUBLISHED Published: 2023-03-28T19:59:29.953Z Last Updated: 2025-01-16T21:38:44.402Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: ProPump and Controls, Inc. Products: Osprey Pump Controller Problem Types: CWE-331 Insufficient Entropy Description: Osprey Pump Controller version 1.01 is vulnerable to a weak session token generation algorithm that can be predicted and can aid in authentication and authorization bypass. This may allow an attacker to hijack a session by predicting the session id and gain unauthorized access to the product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
ed access to the product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06
CVE ID: CVE-2023-28396 State: PUBLISHED Published: 2024-02-14T13:37:49.980Z Last Updated: 2024-08-14T17:47:30.697Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:H) Vendors: n/a Products: Intel(R) Thunderbol(TM) Controllers versions Problem Types: denial of service, CWE-284 Description: Improper access control in firmware for some Intel(R) Thunderbol(TM) Controllers versions before 41 may allow a privileged user to enable denial of service via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00895.html
CVE ID: CVE-2023-28397 State: PUBLISHED Published: 2023-11-14T19:04:42.517Z Last Updated: 2024-08-30T18:27:31.463Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Aptio* V UEFI Firmware Integrator Tools Problem Types: escalation of privilege, CWE-284 Description: Improper access control in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated to potentially enable escalation of privileges via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00908.html
CVE ID: CVE-2023-28398 State: PUBLISHED Published: 2023-03-28T20:08:09.624Z Last Updated: 2025-01-16T21:37:57.274Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ProPump and Controls, Inc. Products: Osprey Pump Controller Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: Osprey Pump Controller version 1.01 could allow an unauthenticated user to create an account and bypass authentication, thereby gaining unauthorized access to the system. A threat actor could exploit this vulnerability to create a user account without providing valid credentials. A threat actor who successfully exploits this vulnerability could g
a user account without providing valid credentials. A threat actor who successfully exploits this vulnerability could gain access to the pump controller and cause disruption in operation, modify data, or shut down the controller. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06
CVE ID: CVE-2023-28399 State: PUBLISHED Published: 2023-06-01T00:00:00 Last Updated: 2025-01-09T20:53:21.940Z Vendors: Contec Co., Ltd. Products: CONPROSYS HMI System (CHS) Problem Types: Incorrect permission assignment for critical resource Description: Incorrect permission assignment for critical resource exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. ACL (Access Control List) is not appropriately set to the local folder where the affected product is installed, therefore a wide range of privileges is permitted to a user of the PC where the affected product is installed. As a result, the user may be able to destroy the system and/or execute a malicious program. Additional Ana
is installed. As a result, the user may be able to destroy the system and/or execute a malicious program. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_en.pdf - https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_jp.pdf - https://jvn.jp/en/vu/JVNVU93372935/
CVE ID: CVE-2023-28400 State: PUBLISHED Published: 2023-04-27T22:18:43.429Z Last Updated: 2025-01-17T17:04:22.225Z Vendors: mySCADA Technologies Products: mySCADA myPRO Problem Types: CWE-78 OS Command Injection Description: mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-096-06
CVE ID: CVE-2023-28401 State: PUBLISHED Published: 2023-11-14T19:04:23.883Z Last Updated: 2024-08-02T12:38:25.111Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: n/a Products: Intel(R) Arc(TM) & Iris(R) Xe Graphics - WHQL - Windows drivers Problem Types: escalation of privilege, CWE-787 Description: Out-of-bounds write in some Intel(R) Arc(TM) & Iris(R) Xe Graphics - WHQL - Windows drivers before version 31.0.101.4255 may allow authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00864.html
CVE ID: CVE-2023-28402 State: PUBLISHED Published: 2024-05-16T20:47:47.702Z Last Updated: 2024-08-21T16:31:36.266Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: n/a Products: Intel(R) BIOS Guard firmware Problem Types: escalation of privilege, CWE-20 Description: Improper input validation in some Intel(R) BIOS Guard firmware may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00814.html
CVE ID: CVE-2023-28404 State: PUBLISHED Published: 2023-11-14T19:04:24.382Z Last Updated: 2024-08-02T12:38:25.188Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: n/a Products: Intel(R) Arc(TM) & Iris(R) Xe Graphics - WHQL - Windows drivers Problem Types: information disclosure, CWE-125 Description: Out-of-bounds read in the Intel(R) Arc(TM) & Iris(R) Xe Graphics - WHQL - Windows drivers before version 31.0.101.4255 may allow an authenticated user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00864.html
CVE ID: CVE-2023-28405 State: PUBLISHED Published: 2023-08-11T02:37:09.227Z Last Updated: 2024-10-10T15:27:17.465Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Distribution of OpenVINO(TM) Toolkit Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path in the Intel(R) Distribution of OpenVINO(TM) Toolkit before version 2022.3.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00842.html
CVE ID: CVE-2023-28406 State: PUBLISHED Published: 2023-05-03T14:34:00.796Z Last Updated: 2025-01-29T21:02:37.724Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: F5 Products: BIG-IP Problem Types: CWE-22 Description: A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files with .xml extension. Access to restricted information is limited and the attacker does not control what information is obtained. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
d End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000132768
CVE ID: CVE-2023-28407 State: PUBLISHED Published: 2024-02-14T13:38:04.964Z Last Updated: 2024-08-14T17:59:45.207Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) XTU software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path in some Intel(R) XTU software before version 7.12.0.29 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00955.html
CVE ID: CVE-2023-28408 State: PUBLISHED Published: 2023-05-23T00:00:00 Last Updated: 2025-01-17T18:25:13.529Z Vendors: Monkey Wrench Inc. Products: MW WP Form Problem Types: Directory traversal Description: Directory traversal vulnerability in MW WP Form versions v4.4.2 and earlier allows a remote unauthenticated attacker to alter the website or cause a denial-of-service (DoS) condition, and obtain sensitive information depending on settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.2inc.org/mw-wp-form/blog/2023/05/08/752/ - https://jvn.jp/en/jp/JVN01093915/
CVE ID: CVE-2023-28409 State: PUBLISHED Published: 2023-05-23T00:00:00.000Z Last Updated: 2025-01-31T14:00:44.884Z Vendors: Monkey Wrench Inc. Products: MW WP Form Problem Types: Unrestricted upload of file with dangerous type Description: Unrestricted upload of file with dangerous type exists in MW WP Form versions v4.4.2 and earlier, which may allow a remote unauthenticated attacker to upload an arbitrary file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.2inc.org/mw-wp-form/blog/2023/05/08/752/ - https://jvn.jp/en/jp/JVN01093915/
CVE ID: CVE-2023-28410 State: PUBLISHED Published: 2023-05-10T13:16:37.359Z Last Updated: 2025-03-18T19:11:40.318Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) i915 Graphics drivers for linux Problem Types: escalation of privilege, CWE-119 Description: Improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics drivers for linux before kernel version 6.2.10 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-cent
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00886.html - https://security.netapp.com/advisory/ntap-20230622-0004/
CVE ID: CVE-2023-28411 State: PUBLISHED Published: 2023-05-10T13:17:06.167Z Last Updated: 2025-01-27T18:02:44.772Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N) Vendors: n/a Products: Intel(R) Server Board BMC firmware Problem Types: information disclosure, CWE-415 Description: Double free in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00839.html
CVE ID: CVE-2023-28412 State: PUBLISHED Published: 2023-05-22T19:24:06.082Z Last Updated: 2025-01-16T21:33:55.805Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Snap One Products: OvrC Cloud Problem Types: CWE-204 Description: When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC address of devices can be enumerated in an attack and the OvrC cloud will disclose their information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01 - https://www.control4.com/docs/product/ovrc-software/release-n
//www.cisa.gov/news-events/ics-advisories/icsa-23-136-01 - https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-r.pdf
CVE ID: CVE-2023-28413 State: PUBLISHED Published: 2023-05-23T00:00:00.000Z Last Updated: 2025-01-31T13:59:40.683Z Vendors: Monkey Wrench Inc. Products: Snow Monkey Forms Problem Types: Directory traversal Description: Directory traversal vulnerability in Snow Monkey Forms versions v5.0.6 and earlier allows a remote unauthenticated attacker to obtain sensitive information, alter the website, or cause a denial-of-service (DoS) condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/jp/JVN01093915/ - https://snow-monkey.2inc.org/2023/04/28/snow-monkey-forms-v5-0-7/
CVE ID: CVE-2023-28414 State: PUBLISHED Published: 2023-05-12T15:10:27.666Z Last Updated: 2025-01-09T15:17:14.109Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: ApexChat Products: ApexChat Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ApexChat plugin <= 1.3.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/apexchat/wordpress-apexchat-plugin-1-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28415 State: PUBLISHED Published: 2023-08-30T15:31:01.028Z Last Updated: 2024-08-02T13:39:20.329Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: XootiX Products: Side Cart Woocommerce (Ajax) Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in XootiX Side Cart Woocommerce (Ajax) plugin <= 2.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/side-cart-woocommerce/wordpress-side-cart-woocommerce-plugin-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28416 State: PUBLISHED Published: 2024-12-09T11:31:18.685Z Last Updated: 2024-12-09T18:44:29.332Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Sparkle Themes Products: Chankhe Problem Types: CWE-862 Description: Missing Authorization vulnerability in Sparkle Themes Chankhe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chankhe: from n/a through 1.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/chankhe/vulnerability/wordpress-chankhe-theme-1-0-5-authenticated-arbitrary-plugin-activation?_s_id=cve
CVE ID: CVE-2023-28417 State: PUBLISHED Published: 2024-12-09T11:31:17.827Z Last Updated: 2024-12-09T18:44:39.219Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: AlexaCRM Products: Dynamics 365 Integration Problem Types: CWE-862 Description: Missing Authorization vulnerability in AlexaCRM Dynamics 365 Integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamics 365 Integration: from n/a through 1.3.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/integration-dynamics/vulnerability/wordpress-dynamics-365-integration-plugin-1-3-12-broken-acc
database/wordpress/plugin/integration-dynamics/vulnerability/wordpress-dynamics-365-integration-plugin-1-3-12-broken-access-control?_s_id=cve