Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-23714 State: PUBLISHED Published: 2023-05-26T11:01:15.720Z Last Updated: 2025-01-08T21:56:44.471Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Uncanny Owl Products: Uncanny Toolkit for LearnDash Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash plugin <= 3.6.4.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/uncanny-learndash-toolkit/wordpress-uncanny-toolkit-for-learndash-plugin-3-6-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-23715 State: PUBLISHED Published: 2024-12-09T11:31:54.341Z Last Updated: 2024-12-09T18:40:20.267Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:H) Vendors: JobBoardWP Products: JobBoardWP – Job Board Listings and Submissions Problem Types: CWE-862 Description: Missing Authorization vulnerability in JobBoardWP JobBoardWP – Job Board Listings and Submissions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobBoardWP – Job Board Listings and Submissions: from n/a through 1.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jobboardwp/vulnerabili
st Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jobboardwp/vulnerability/wordpress-jobboardwp-job-board-listings-and-submissions-plugin-1-2-2-idor-leading-to-job-removal-vulnerability?_s_id=cve
CVE ID: CVE-2023-23716 State: PUBLISHED Published: 2024-12-09T11:31:53.543Z Last Updated: 2024-12-09T18:40:27.012Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Zendesk Products: Zendesk Support for WordPress Problem Types: CWE-862 Description: Missing Authorization vulnerability in Zendesk Zendesk Support for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zendesk Support for WordPress: from n/a through 1.8.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/zendesk/vulnerability/wordpress-zendesk-support-for-wordpress-plugin-1-8-4-cross-s
chstack.com/database/wordpress/plugin/zendesk/vulnerability/wordpress-zendesk-support-for-wordpress-plugin-1-8-4-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2023-23717 State: PUBLISHED Published: 2023-04-23T10:12:35.971Z Last Updated: 2025-01-10T18:45:54.046Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: George Gecewicz Products: Portfolio Slideshow Problem Types: CWE-79 Description: Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in George Gecewicz Portfolio Slideshow plugin <= 1.13.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/portfolio-slideshow/wordpress-portfolio-slideshow-plugin-1-13-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23718 State: PUBLISHED Published: 2023-03-20T11:22:23.557Z Last Updated: 2025-01-10T19:19:35.103Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Esstat17 Products: Page Loading Effects Problem Types: CWE-79 Description: Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Esstat17 Page Loading Effects plugin <= 2.0.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/page-loading-effects/wordpress-page-loading-effects-plugin-2-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23719 State: PUBLISHED Published: 2023-07-17T10:54:06.910Z Last Updated: 2024-08-02T14:48:45.648Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Premmerce Products: Premmerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Premmerce plugin <= 1.3.17 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/premmerce/wordpress-premmerce-plugin-1-3-17-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-23720 State: PUBLISHED Published: 2023-05-16T09:31:58.146Z Last Updated: 2025-01-09T15:15:06.222Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: NetReviews SAS Products: Verified Reviews (Avis Vérifiés) Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in NetReviews SAS Verified Reviews (Avis Vérifiés) plugin <= 2.3.13 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/netreviews/wordpress-verified-reviews-avis-verifies-plugin-2-3-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23721 State: PUBLISHED Published: 2023-03-20T11:27:26.352Z Last Updated: 2025-01-10T19:19:25.396Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: David Gwyer Products: Admin Log Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in David Gwyer Admin Log plugin <= 1.50 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/admin-log/wordpress-admin-log-plugin-1-50-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-23722 State: PUBLISHED Published: 2023-03-23T14:25:56.606Z Last Updated: 2025-02-19T21:38:16.018Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Winwar Media Products: WP eBay Product Feeds Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media WP eBay Product Feeds plugin <= 3.3.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ebay-feeds-for-wordpress/wordpress-wp-ebay-product-feeds-plugin-3-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23723 State: PUBLISHED Published: 2023-05-02T11:02:26.551Z Last Updated: 2025-01-09T15:32:55.780Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Winwar Media Products: WP Email Capture Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media WP Email Capture plugin <= 3.9.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-email-capture/wordpress-wordpress-email-marketing-plugin-wp-email-capture-plugin-3-9-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23724 State: PUBLISHED Published: 2023-05-23T12:46:45.106Z Last Updated: 2025-01-08T22:05:49.351Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Winwar Media Products: WP Email Capture Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Winwar Media WP Email Capture plugin <= 3.9.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-email-capture/wordpress-wordpress-email-marketing-plugin-wp-email-capture-plugin-3-9-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-23725 State: PUBLISHED Published: 2024-12-09T11:31:52.720Z Last Updated: 2024-12-09T18:40:34.904Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Chris Baldelomar Products: Shortcodes Problem Types: CWE-862 Description: Missing Authorization vulnerability in Chris Baldelomar Shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes: from n/a through 3.46. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wc-shortcodes/vulnerability/wordpress-shortcodes-by-angie-makes-plugin-3-46-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-23726 State: PUBLISHED Published: 2024-12-09T11:31:51.827Z Last Updated: 2024-12-09T18:40:41.268Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Tickera.com Products: Tickera Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Tickera.com Tickera allows Cross Site Request Forgery.This issue affects Tickera: from n/a through 3.5.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/tickera-event-ticketing-system/vulnerability/wordpress-tickera-wordpress-event-ticketing-plugin-3-5-1-0-csrf-leading-to-post-status-change-vulnerability?_s_id=cve
CVE ID: CVE-2023-23727 State: PUBLISHED Published: 2023-05-16T08:43:27.472Z Last Updated: 2025-01-09T15:15:15.976Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Formilla Products: Live Chat by Formilla Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Formilla Live Chat by Formilla plugin <= 1.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/formilla-live-chat/wordpress-live-chat-by-formilla-real-time-chat-chatbots-plugin-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23728 State: PUBLISHED Published: 2023-03-23T14:18:24.089Z Last Updated: 2025-02-19T21:38:26.954Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Winwar Media Products: WP Flipclock Problem Types: CWE-79 Description: Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Winwar Media WP Flipclock plugin <= 1.7.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-flipclock/wordpress-wp-flipclock-plugin-1-7-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23730 State: PUBLISHED Published: 2024-06-03T21:24:35.797Z Last Updated: 2024-08-02T10:42:25.769Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Brainstorm Force Products: Spectra Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Brainstorm Force Spectra allows Functionality Bypass.This issue affects Spectra: from n/a through 2.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ultimate-addons-for-gutenberg/wordpress-spectra-wordpress-gutenberg-blocks-plugin-2-3-0-captcha-bypass-vulnerability
ity/ultimate-addons-for-gutenberg/wordpress-spectra-wordpress-gutenberg-blocks-plugin-2-3-0-captcha-bypass-vulnerability?_s_id=cve
CVE ID: CVE-2023-23731 State: PUBLISHED Published: 2023-07-11T07:01:37.410Z Last Updated: 2024-10-08T13:36:16.443Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: HasTheme Products: WishSuite Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in HasTheme WishSuite plugin <= 1.3.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wishsuite/wordpress-wishsuite-wishlist-for-woocommerce-plugin-1-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-23732 State: PUBLISHED Published: 2023-05-09T10:29:18.343Z Last Updated: 2024-08-02T13:41:23.214Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Joel James Products: Disqus Conditional Load Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joel James Disqus Conditional Load plugin <= 11.0.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/disqus-conditional-load/wordpress-disqus-conditional-load-plugin-11-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23733 State: PUBLISHED Published: 2023-05-09T10:35:13.537Z Last Updated: 2025-01-09T15:23:15.422Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Joel James Products: Lazy Social Comments Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joel James Lazy Social Comments plugin <= 2.0.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/lazy-facebook-comments/wordpress-lazy-social-comments-plugin-2-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23734 State: PUBLISHED Published: 2023-05-09T10:40:15.393Z Last Updated: 2024-08-02T10:42:25.664Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: David Voswinkel Products: Userlike – WordPress Live Chat plugin Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in David Voswinkel Userlike – WordPress Live Chat plugin <= 2.2 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/userlike/wordpress-userlike-wordpress-live-chat-plugin-plugin-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23735 State: PUBLISHED Published: 2024-06-03T21:26:09.020Z Last Updated: 2024-08-02T10:42:26.819Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Brainstorm Force Products: Spectra Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force Spectra allows Code Injection.This issue affects Spectra: from n/a through 2.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ultimate-addons-for-gutenberg/wordpress-spectra-wordpress-gutenberg-blocks-plugin-2-3-0-unauthenticated
se/vulnerability/ultimate-addons-for-gutenberg/wordpress-spectra-wordpress-gutenberg-blocks-plugin-2-3-0-unauthenticated-email-html-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-23737 State: PUBLISHED Published: 2023-10-12T11:31:50.864Z Last Updated: 2024-09-18T16:32:29.195Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: MainWP Products: MainWP Broken Links Checker Extension Problem Types: CWE-89 Description: Unauth. SQL Injection (SQLi) vulnerability in MainWP MainWP Broken Links Checker Extension plugin <= 4.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mainwp-broken-links-checker-extension/wordpress-mainwp-broken-links-checker-extension-plugin-4-0-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-23738 State: PUBLISHED Published: 2024-06-03T21:33:35.646Z Last Updated: 2024-08-02T10:42:25.651Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Brainstorm Force Products: Spectra Problem Types: CWE-74 Description: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Brainstorm Force Spectra allows Content Spoofing, Phishing.This issue affects Spectra: from n/a through 2.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ultimate-addons-for-gutenberg/wordpress-spectra-wordpress-gutenberg-bl
: - https://patchstack.com/database/vulnerability/ultimate-addons-for-gutenberg/wordpress-spectra-wordpress-gutenberg-blocks-plugin-2-3-0-unauthenticated-email-spoofing-vulnerability?_s_id=cve
CVE ID: CVE-2023-23749 State: PUBLISHED Published: 2023-01-17T19:38:22.103Z Last Updated: 2025-04-04T04:36:21.675Z Vendors: miniorange Products: LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login Problem Types: LDAP injection Description: The 'LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login' extension is vulnerable to LDAP Injection since is not properly sanitizing the 'username' POST parameter. An attacker can manipulate this paramter to dump arbitrary contents form the LDAP Database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://extensions.joomla.org/vulnerable-extensions/resolved/ldap-
ram Container: - CISA ADP Vulnrichment: References: - https://extensions.joomla.org/vulnerable-extensions/resolved/ldap-integration-with-active-directory-and-openldap-ntlm-kerberos-login-5-0-2-other/
CVE ID: CVE-2023-23750 State: PUBLISHED Published: 2023-02-01T21:12:36.067Z Last Updated: 2025-03-29T04:35:17.502Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: CSRF Description: An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.joomla.org/security-centre/890-20230101-core-csrf-within-post-installation-messages.html
CVE ID: CVE-2023-23751 State: PUBLISHED Published: 2023-02-01T21:12:42.378Z Last Updated: 2025-03-29T04:35:12.508Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: Incorrect Access Control Description: An issue was discovered in Joomla! 4.0.0 through 4.2.4. A missing ACL check allows non super-admin users to access com_actionlogs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.joomla.org/security-centre/891-20230102-core-missing-acl-checks-for-com-actionlogs.html
CVE ID: CVE-2023-23752 State: PUBLISHED Published: 2023-02-16T16:25:21.003Z Last Updated: 2025-10-22T04:35:40.356Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: ACL Description: An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://developer.joomla.org/security-centre/894-20230201-core-improper-access-check-in-webservice-endpoints.html
CVE ID: CVE-2023-23753 State: PUBLISHED Published: 2023-04-23T20:33:51.958Z Last Updated: 2025-02-06T10:48:25.140Z Vendors: vi-solutions Products: Visforms Base Package for Joomla 3 Problem Types: SQL Injection Description: The 'Visforms Base Package for Joomla 3' extension is vulnerable to SQL Injection as concatenation is used to construct an SQL Query. An attacker can interact with the database and could be able to read, modify and delete data on it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vi-solutions.de/en/announcements/867-security-announcement-cve-2023-23754 - https://blog.asturhackers.es/sql-injection-en-visforms-base-package-
ncements/867-security-announcement-cve-2023-23754 - https://blog.asturhackers.es/sql-injection-en-visforms-base-package-for-joomla-3-0-5-cve-2023-23753
CVE ID: CVE-2023-23754 State: PUBLISHED Published: 2023-05-30T16:12:44.475Z Last Updated: 2025-01-10T04:33:39.676Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: XSS Description: An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.joomla.org/security-centre/899-20230501-core-open-redirects-and-xss-within-the-mfa-selection.html
CVE ID: CVE-2023-23755 State: PUBLISHED Published: 2023-05-30T16:12:32.399Z Last Updated: 2025-01-10T04:33:30.752Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: Lack of rate limiting Description: An issue was discovered in Joomla! 4.2.0 through 4.3.1. The lack of rate limiting allowed brute force attacks against MFA methods. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.joomla.org/security-centre/900-20230502-core-bruteforce-prevention-within-the-mfa-screen.html
CVE ID: CVE-2023-23756 State: PUBLISHED Published: 2023-07-11T19:35:26.922Z Last Updated: 2024-11-26T04:35:05.228Z Vendors: advcomsys.com Products: oneVote component for Joomla Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for Joomla. It allows XSS Targeting Non-Script Elements. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://extensions.joomla.org/vulnerable-extensions/vulnerable/one-vote-1-7-xss-cross-site-scripting/
CVE ID: CVE-2023-23757 State: PUBLISHED Published: 2023-08-07T16:51:01.510Z Last Updated: 2024-10-20T04:33:20.013Z Vendors: bestaddon.com Products: BA Gallery component for Joomla Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://extensions.joomla.org/extension/ba-gallery/
CVE ID: CVE-2023-23758 State: PUBLISHED Published: 2023-08-07T16:51:06.357Z Last Updated: 2024-10-20T04:33:24.490Z Vendors: creative-solutions.net Products: Creative Gallery component for Joomla Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://extensions.joomla.org/extension/creative-gallery/
CVE ID: CVE-2023-23759 State: PUBLISHED Published: 2023-05-18T21:21:02.735Z Last Updated: 2025-01-21T20:49:35.562Z Vendors: Facebook Products: fizz Problem Types: CWE-617: Reachable Assertion Description: There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. This behavior requires the client supported cipher advertisement changing between the original ClientHello and the second ClientHello, crashing the process (impact is limited to denial of service). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.facebook.com/security/advisories/cve-2023-23759 - https://github.com/facebook
DP Vulnrichment: References: - https://www.facebook.com/security/advisories/cve-2023-23759 - https://github.com/facebookincubator/fizz/commit/8d3649841597bedfb6986c30431ebad0eb215265
CVE ID: CVE-2023-23760 State: PUBLISHED Published: 2023-03-08T18:43:51.187Z Last Updated: 2025-02-28T19:48:30.725Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: GitHub Products: Enterprise Server Problem Types: CWE-22 Description: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to versions 3.8 and was fixed in versions 3.7.7, 3.6.10, 3.5.14, an
ected all versions of GitHub Enterprise Server prior to versions 3.8 and was fixed in versions 3.7.7, 3.6.10, 3.5.14, and 3.4.17. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.7 - https://docs.github.com/en/enterprise-server@3.6/admin/release-notes#3.6.10 - https://docs.github.com/en/enterprise-server@3.5/admin/release-notes#3.5.14 - https://docs.github.com/en/enterprise-server@3.4/admin/release-notes#3.4.17