Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-5705 State: PUBLISHED Published: 2023-10-27T11:28:44.082Z Last Updated: 2025-02-05T18:57:19.366Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: vektor-inc Products: VK Filter Search Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The VK Filter Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk_filter_search' shortcode in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and abo
escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/012946d4-82ce-48b9-9b9a-1fc49846dca6?source=cve - https://plugins.trac.wordpress.org/browser/vk-filter-search/tags/2.3.1/inc/filter-search/package/class-vk-filter-search-shortcode.php#L40 - https://plugins.trac.wordpress.org/changeset/2983339/vk-filter-search#file1
CVE ID: CVE-2023-5706 State: PUBLISHED Published: 2023-11-22T15:33:18.579Z Last Updated: 2025-06-10T13:36:09.903Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: vektor-inc Products: VK Blocks Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk-blocks/ancestor-page-list' block in all versions up to, and including, 1.63.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above
caping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/05dd7c96-7880-44a8-a06f-037bc627fd8d?source=cve - https://plugins.trac.wordpress.org/browser/vk-blocks/tags/1.63.0.1/inc/vk-blocks/build/blocks/ancestor-page-list/index.php#L50 - https://plugins.trac.wordpress.org/browser/vk-blocks/tags/1.63.0.1/inc/vk-blocks/build/blocks/ancestor-page-list/index.php#L54 - https://pl
c.wordpress.org/browser/vk-blocks/tags/1.63.0.1/inc/vk-blocks/build/blocks/ancestor-page-list/index.php#L54 - https://plugins.trac.wordpress.org/browser/vk-blocks/tags/1.63.0.1/inc/vk-blocks/build/blocks/ancestor-page-list/index.php#L57 - https://plugins.trac.wordpress.org/changeset/2983202/vk-blocks/trunk/inc/vk-blocks/build/blocks/ancestor-page-list/index.php
CVE ID: CVE-2023-5707 State: PUBLISHED Published: 2023-11-03T12:31:28.345Z Last Updated: 2025-02-05T18:51:52.412Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: seothemes Products: SEO Slider Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The SEO Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slider' shortcode and post meta in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permis
on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/32bc88a7-93ed-4d67-9383-b6d935a0df4d?source=cve - https://plugins.trac.wordpress.org/browser/seo-slider/trunk/includes/shortcode.php?rev=2367856#L68 - https://plugins.trac.wordpress.org/browser/seo-slider/trunk/includes/shortcode.php?rev=2367856#L71 - https://plugins.trac.wordpress.org/changeset/2987802/seo-slider#file3
CVE ID: CVE-2023-5708 State: PUBLISHED Published: 2023-11-22T15:33:35.847Z Last Updated: 2024-08-02T08:07:32.574Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sammyb Products: WP Post Columns Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Post Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'column' shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to
supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d96e5986-8c89-4e7e-aa63-f41aa13eeff4?source=cve - https://plugins.trac.wordpress.org/browser/wp-post-columns/trunk/wp_post_columns.php?rev=112013#L59
CVE ID: CVE-2023-5709 State: PUBLISHED Published: 2023-11-07T11:31:07.421Z Last Updated: 2025-02-05T18:50:11.914Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: 10web Products: WD WidgetTwitter Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The WD WidgetTwitter plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 1.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level and above permiss
n on the existing SQL query. This makes it possible for authenticated attackers with contributor-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/86cdbfec-b1af-48ec-ae70-f97768694e44?source=cve - https://plugins.trac.wordpress.org/browser/widget-twitter/trunk/twitter.php?rev=2212825#L161
CVE ID: CVE-2023-5710 State: PUBLISHED Published: 2023-12-07T02:00:07.820Z Last Updated: 2024-08-02T08:07:32.573Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: qriouslad Products: System Dashboard Problem Types: CWE-862 Missing Authorization Description: The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_constants() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive information such as database credentials. Additional Analyst Notes: - CV
r-level access and above, to retrieve sensitive information such as database credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f170379e-e833-42e0-96fd-1e1722a8331c?source=cve - https://plugins.trac.wordpress.org/browser/system-dashboard/tags/2.8.7/admin/class-system-dashboard-admin.php#L7930 - https://plugins.trac.wordpress.org/browser/system-dashboard/tags/2.8.8/admin/class-system-dashboard-admin.php#L7951
CVE ID: CVE-2023-5711 State: PUBLISHED Published: 2023-12-07T02:00:04.709Z Last Updated: 2024-08-02T08:07:32.625Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: qriouslad Products: System Dashboard Problem Types: CWE-862 Missing Authorization Description: The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_php_info() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive information provided by PHP info. Additional Analyst Notes: - CVE Program
-level access and above, to retrieve sensitive information provided by PHP info. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/17bc3a9f-2bf9-44e3-81ef-bfa932085da9?source=cve - https://plugins.trac.wordpress.org/browser/system-dashboard/tags/2.8.7/admin/class-system-dashboard-admin.php#L1925 - https://plugins.trac.wordpress.org/browser/system-dashboard/tags/2.8.8/admin/class-system-dashboard-admin.php#L1932
CVE ID: CVE-2023-5712 State: PUBLISHED Published: 2023-12-07T02:00:06.535Z Last Updated: 2024-08-02T08:07:32.670Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: qriouslad Products: System Dashboard Problem Types: CWE-862 Missing Authorization Description: The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_global_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive global value information. Additional Analyst Notes: - CVE Program Con
iber-level access and above, to retrieve sensitive global value information. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/70f14d9d-6ed6-4bcb-944d-f9c5aa6a17a6?source=cve - https://plugins.trac.wordpress.org/browser/system-dashboard/tags/2.8.7/admin/class-system-dashboard-admin.php#L7382 - https://plugins.trac.wordpress.org/browser/system-dashboard/tags/2.8.8/admin/class-system-dashboard-admin.php#L7403
CVE ID: CVE-2023-5713 State: PUBLISHED Published: 2023-12-07T02:00:07.318Z Last Updated: 2025-05-28T14:39:41.544Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: qriouslad Products: System Dashboard Problem Types: CWE-862 Missing Authorization Description: The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_option_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve potentially sensitive option values, and deserialize the content of those value
iber-level access and above, to retrieve potentially sensitive option values, and deserialize the content of those values. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e9d1a33b-2518-48f7-90b6-a94a34473d1e?source=cve - https://plugins.trac.wordpress.org/browser/system-dashboard/tags/2.8.7/admin/class-system-dashboard-admin.php#L6341 - https://plugins.trac.wordpress.org/browser/system-dashboard/tags/2.8.8/admin/class-system-dashboard-admin.php#L6357
CVE ID: CVE-2023-5714 State: PUBLISHED Published: 2023-12-07T02:00:06.032Z Last Updated: 2024-08-02T08:07:32.551Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: qriouslad Products: System Dashboard Problem Types: CWE-862 Missing Authorization Description: The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_db_specs() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve data key specs. Additional Analyst Notes: - CVE Program Container: References: - ht
-level access and above, to retrieve data key specs. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/53b3ac83-847d-4bd0-a79b-531af266e1b4?source=cve - https://plugins.trac.wordpress.org/browser/system-dashboard/tags/2.8.7/admin/class-system-dashboard-admin.php#L2942 - https://plugins.trac.wordpress.org/browser/system-dashboard/tags/2.8.8/admin/class-system-dashboard-admin.php#L2949
CVE ID: CVE-2023-5715 State: PUBLISHED Published: 2023-11-22T15:33:36.340Z Last Updated: 2024-08-02T08:07:32.610Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: plerdy Products: Website Optimization – Plerdy Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Website Optimization – Plerdy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tracking code settings in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to injec
ation and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/db18ac07-2e7a-466d-b00c-a598401f8633?source=cve - https://plugins.trac.wordpress.org/browser/plerdy-heatmap/trunk/plerdy_heatmap_tracking.php#L132 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2989840%40plerdy-heatmap&new=29
#L132 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2989840%40plerdy-heatmap&new=2989840%40plerdy-heatmap&sfp_email=&sfph_mail=
CVE ID: CVE-2023-5716 State: PUBLISHED Published: 2024-01-19T03:07:46.663Z Last Updated: 2025-06-17T21:19:24.261Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ASUS Products: Armoury Crate Problem Types: CWE-306 Description: ASUS Armoury Crate has a vulnerability in arbitrary file write and allows remote attackers to access or modify arbitrary files by sending specific HTTP requests without permission. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7666-fffce-1.html
CVE ID: CVE-2023-5717 State: PUBLISHED Published: 2023-10-25T12:55:06.871Z Last Updated: 2025-02-13T17:25:43.494Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Kernel Problem Types: CWE-787 Description: A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer. We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06. Additional Analyst N
the allocated buffer. We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/events?id=32671e3799ca2e4590773fd0e63aaa4229e50c06 - https://kernel.dance/32671e3799ca2e4590773fd0e63aaa4229e50c06 - https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html - https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html
CVE ID: CVE-2023-5718 State: PUBLISHED Published: 2023-10-23T14:02:43.544Z Last Updated: 2024-09-11T15:26:35.997Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Vue.js Products: Vue.js devtools Problem Types: CWE-200 Description: The Vue.js Devtools extension was found to leak screenshot data back to a malicious web page via the standard `postMessage()` API. By creating a malicious web page with an iFrame targeting a sensitive resource (i.e. a locally accessible file or sensitive website), and registering a listener on the web page, the extension sent messages back to the listener, containing the base64 encoded screenshot data of the sensitive resource. Add
tension sent messages back to the listener, containing the base64 encoded screenshot data of the sensitive resource. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/CalumHutton/bdb97077a66021ed455f87823cd7c7cb
CVE ID: CVE-2023-5719 State: PUBLISHED Published: 2023-11-06T19:33:20.369Z Last Updated: 2025-01-16T21:26:43.011Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Red Lion Products: Crimson Problem Types: CWE-158 Description: The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download the resulting security configuration to a device. If such a password contains the percent (%) character, invalid values will be included, potentially truncating the string if a NUL is encountered. If the simplified password is not detected by the administrator, the device might be left in a vulnerable s
encountered. If the simplified password is not detected by the administrator, the device might be left in a vulnerable state as a result of more-easily compromised credentials. Note that passwords entered via the Crimson system web server do not suffer from this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-01 - https://support.redlion.net/hc/en-us/categories/360002087671-Security-Advisories
CVE ID: CVE-2023-5720 State: PUBLISHED Published: 2023-11-15T13:57:52.295Z Last Updated: 2024-08-02T08:07:32.620Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: n/a Products: gradle-plugin Problem Types: CWE-526 Description: A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-5720 - https://bugzilla.redhat.com/show_bug.cgi?i
ntainer: References: - https://access.redhat.com/security/cve/CVE-2023-5720 - https://bugzilla.redhat.com/show_bug.cgi?id=2245700
CVE ID: CVE-2023-5721 State: PUBLISHED Published: 2023-10-24T12:47:08.306Z Last Updated: 2025-02-13T17:25:44.089Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Queued up rendering could have allowed websites to clickjack Description: It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1830820 - https://www.mozilla.org/security/advisories/mfs
nt: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1830820 - https://www.mozilla.org/security/advisories/mfsa2023-45/ - https://www.mozilla.org/security/advisories/mfsa2023-46/ - https://www.mozilla.org/security/advisories/mfsa2023-47/ - https://www.debian.org/security/2023/dsa-5535 - https://lists.debian.org/debian-lts-announce/2023/10/msg00037.html - https://www.debian.org/security/2023/dsa-5538 - https://lists.debian.org/debian-lts-announce/2023/10/msg00042.html
CVE ID: CVE-2023-5722 State: PUBLISHED Published: 2023-10-24T12:47:09.118Z Last Updated: 2025-02-13T17:25:44.622Z Vendors: Mozilla Products: Firefox Problem Types: Cross-Origin size and header leakage Description: Using iterative requests an attacker was able to learn the size of an opaque response, as well as the contents of a server-supplied Vary header. This vulnerability affects Firefox < 119. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1738426 - https://www.mozilla.org/security/advisories/mfsa2023-45/ - https://security.gentoo.org/glsa/202401-10
CVE ID: CVE-2023-5723 State: PUBLISHED Published: 2023-10-24T12:47:09.951Z Last Updated: 2025-02-13T17:25:45.151Z Vendors: Mozilla Products: Firefox Problem Types: Invalid cookie characters could have led to unexpected errors Description: An attacker with temporary script access to a site could have set a cookie containing invalid characters using `document.cookie` that could have led to unknown errors. This vulnerability affects Firefox < 119. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1802057 - https://www.mozilla.org/security/advisories/mfsa2023-45/ - https://security.gentoo.org/glsa/202401-10
CVE ID: CVE-2023-5724 State: PUBLISHED Published: 2023-10-24T12:47:10.797Z Last Updated: 2025-02-13T17:25:45.697Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Large WebGL draw could have led to a crash Description: Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1836705 - https://www.mozilla.org/security/advisories/mfsa2023-45/ - https://www.mozilla.org/security/advisori
ug.cgi?id=1836705 - https://www.mozilla.org/security/advisories/mfsa2023-45/ - https://www.mozilla.org/security/advisories/mfsa2023-46/ - https://www.mozilla.org/security/advisories/mfsa2023-47/ - https://www.debian.org/security/2023/dsa-5535 - https://lists.debian.org/debian-lts-announce/2023/10/msg00037.html - https://www.debian.org/security/2023/dsa-5538 - https://lists.debian.org/debian-lts-announce/2023/10/msg00042.html
CVE ID: CVE-2023-5725 State: PUBLISHED Published: 2023-10-24T12:47:11.631Z Last Updated: 2025-02-13T17:25:46.242Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: WebExtensions could open arbitrary URLs Description: A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1845739 - https://www.mozilla.org/security/advisories/mfsa2023-45/ - https://www.moz
ugzilla.mozilla.org/show_bug.cgi?id=1845739 - https://www.mozilla.org/security/advisories/mfsa2023-45/ - https://www.mozilla.org/security/advisories/mfsa2023-46/ - https://www.mozilla.org/security/advisories/mfsa2023-47/ - https://www.debian.org/security/2023/dsa-5535 - https://lists.debian.org/debian-lts-announce/2023/10/msg00037.html - https://www.debian.org/security/2023/dsa-5538 - https://lists.debian.org/debian-lts-announce/2023/10/msg00042.html