Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-5539 State: PUBLISHED Published: 2023-11-09T19:11:06.859Z Last Updated: 2024-09-03T18:29:00.544Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Problem Types: CWE-94 Description: A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79408 - https://bugzilla.redhat.com/show_bug.cgi?id=2243352 - https://moodle.org/mod/forum/discuss.php?d=451580
CVE ID: CVE-2023-5540 State: PUBLISHED Published: 2023-11-09T19:15:53.821Z Last Updated: 2024-08-02T07:59:44.894Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Problem Types: CWE-94 Description: A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79409 - https://bugzilla.redhat.com/show_bug.cgi?id=2243432 - https://moodle.org/mod/forum/discuss.php?d=451581
CVE ID: CVE-2023-5541 State: PUBLISHED Published: 2023-11-09T19:18:22.119Z Last Updated: 2024-08-02T07:59:44.802Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Problem Types: CWE-79 Description: The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79426 - https://bugzilla.redhat.com/show_bug.cgi?id=2243437 - https://moodle.org/mod/forum/discuss.php?d=451582
CVE ID: CVE-2023-5542 State: PUBLISHED Published: 2023-11-09T19:27:38.733Z Last Updated: 2024-08-02T07:59:44.790Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Problem Types: CWE-284 Description: Students in "Only see own membership" groups could see other students in the group, which should be hidden. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79213 - https://bugzilla.redhat.com/show_bug.cgi?id=2243441 - https://moodle.org/mod/forum/discuss.php?d=451583
CVE ID: CVE-2023-5543 State: PUBLISHED Published: 2023-11-09T21:35:38.116Z Last Updated: 2024-08-02T07:59:44.863Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Problem Types: CWE-284 Description: When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This could provide unintended access to the original meeting. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-77795 - https://bugzilla.redhat.com/show_bug.cgi?id=2243442 - https://moodle.org/mod/forum/discuss.php?d=451584
CVE ID: CVE-2023-5544 State: PUBLISHED Published: 2023-11-09T19:32:16.862Z Last Updated: 2024-08-02T07:59:44.772Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Problem Types: CWE-79 Description: Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk. Additional Analyst Notes: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79509 - https://bugzilla.redhat.com/show_bug.cgi?id=2243443 - https://moodle.org/mod/forum/discuss.php?d=451585
CVE ID: CVE-2023-5545 State: PUBLISHED Published: 2023-11-09T19:33:18.127Z Last Updated: 2024-08-02T07:59:44.795Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Problem Types: CWE-200 Description: H5P metadata automatically populated the author with the user's username, which could be sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-78820 - https://bugzilla.redhat.com/show_bug.cgi?id=2243444 - https://moodle.org/mod/forum/discuss.php?d=451586
CVE ID: CVE-2023-5546 State: PUBLISHED Published: 2023-11-09T19:34:21.895Z Last Updated: 2024-08-02T07:59:44.768Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Problem Types: CWE-79 Description: ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-78971 - https://bugzilla.redhat.com/show_bug.cgi?id=2243445 - https://moodle.org/mod/forum/discuss.php?d=451587
CVE ID: CVE-2023-5547 State: PUBLISHED Published: 2023-11-09T19:35:24.575Z Last Updated: 2024-09-04T13:25:23.138Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Problem Types: CWE-79 Description: The course upload preview contained an XSS risk for users uploading unsafe data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79455 - https://bugzilla.redhat.com/show_bug.cgi?id=2243447 - https://moodle.org/mod/forum/discuss.php?d=451588
CVE ID: CVE-2023-5548 State: PUBLISHED Published: 2023-11-09T19:36:18.676Z Last Updated: 2024-08-02T07:59:44.808Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Problem Types: CWE-349 Description: Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection. Additional Analyst Notes: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-77846 - https://bugzilla.redhat.com/show_bug.cgi?id=2243449 - https://moodle.org/mod/forum/discuss.php?d=451589
CVE ID: CVE-2023-5549 State: PUBLISHED Published: 2023-11-09T19:37:15.856Z Last Updated: 2024-08-02T07:59:44.965Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Problem Types: CWE-284 Description: Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-66730 - https://bugzilla.redhat.com/show_bug.cgi?id=2243451 - https://moodle.org/mod/forum/discuss.php?d=451590
CVE ID: CVE-2023-5550 State: PUBLISHED Published: 2023-11-09T19:38:08.611Z Last Updated: 2024-08-02T07:59:44.743Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Problem Types: CWE-94 Description: In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72249 - https://bugzilla.redhat.com/show_bug.cgi?id=2243452
t.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72249 - https://bugzilla.redhat.com/show_bug.cgi?id=2243452 - https://moodle.org/mod/forum/discuss.php?d=451591
CVE ID: CVE-2023-5551 State: PUBLISHED Published: 2023-11-09T19:39:11.940Z Last Updated: 2024-09-04T13:24:24.392Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Problem Types: CWE-200 Description: Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79310 - https://bugzilla.redhat.com/show_bug.cgi?id=2243453 - https://moodle.org/mod/forum/discuss.php?d=451592
CVE ID: CVE-2023-5552 State: PUBLISHED Published: 2023-10-17T23:29:12.601Z Last Updated: 2024-09-13T16:21:10.363Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Sophos Products: Sophos Firewall Problem Types: CWE-200 Description: A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version 19.5 MR3 (19.5.3) and older, if the password type is set to “Specified by sender”. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20231017-spx-password
CVE ID: CVE-2023-5553 State: PUBLISHED Published: 2023-11-21T06:59:42.711Z Last Updated: 2025-06-10T14:00:37.202Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-863 Description: During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot) in AXIS OS making it vulnerable to a sophisticated attack to bypass this protection. To Axis' knowledge, there are no known exploits of the vulnerability at this time. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis securi
ility at this time. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/0a/66/25/cve-2023-5553-en-US-417789.pdf
CVE ID: CVE-2023-5554 State: PUBLISHED Published: 2023-10-12T09:34:01.586Z Last Updated: 2024-09-18T17:50:42.920Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: LINE Corporation Products: LINE Client for iOS Problem Types: na Description: Lack of TLS certificate verification in log transmission of a financial module within LINE Client for iOS prior to 13.16.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/2106827
CVE ID: CVE-2023-5555 State: PUBLISHED Published: 2023-10-12T10:32:05.674Z Last Updated: 2024-09-17T13:48:50.712Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: frappe Products: frappe/lms Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/f6d688ee-b049-4f85-ac3e-f4d3e29e7b9f - https://github.com/frappe/lms/commit/5614a6203fb7d438be8e2b1e3030e4528d170ec4
CVE ID: CVE-2023-5556 State: PUBLISHED Published: 2023-10-12T10:32:21.114Z Last Updated: 2024-09-18T15:58:47.804Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: structurizr Products: structurizr/onpremises Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository structurizr/onpremises prior to 3194. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/a3ee0f98-6898-41ae-b1bd-242a03a73d1b - https://github.com/structurizr/onpremises/commit/6cff4f792b010dfb1ff6a0b4ae1c6e398f8f8a18
CVE ID: CVE-2023-5557 State: PUBLISHED Published: 2023-10-13T01:41:45.366Z Last Updated: 2025-11-20T07:07:46.531Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux
x 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 7 Problem Types: CWE-693 Description: A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:7712 - https:
dditional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:7712 - https://access.redhat.com/errata/RHSA-2023:7713 - https://access.redhat.com/errata/RHSA-2023:7730 - https://access.redhat.com/errata/RHSA-2023:7731 - https://access.redhat.com/errata/RHSA-2023:7732 - https://access.redhat.com/errata/RHSA-2023:7733 - https://access.redhat.com/errata/RHSA-2023:7739 - https://access.redhat.com/errata/RHSA-2023:7744 - https://access.redhat.com/security/cve/CVE-2023-5557 - https://bugzilla.redhat.com/show_bug.cgi?id=2243096
CVE ID: CVE-2023-5558 State: PUBLISHED Published: 2024-01-16T15:54:33.473Z Last Updated: 2024-08-30T19:01:08.597Z Vendors: Unknown Products: LearnPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4efd2a4d-89bd-472f-ba5a-f9944fd4dd16/
CVE ID: CVE-2023-5559 State: PUBLISHED Published: 2023-11-27T16:22:06.218Z Last Updated: 2024-08-02T07:59:44.808Z Vendors: Unknown Products: 10Web Booster Problem Types: CWE-862 Missing Authorization Description: The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/eba46f7d-e4db-400c-8032-015f21087bbf
CVE ID: CVE-2023-5560 State: PUBLISHED Published: 2023-11-27T16:22:00.142Z Last Updated: 2024-11-21T19:17:14.770Z Vendors: Unknown Products: WP-UserOnline Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP-UserOnline WordPress plugin before 2.88.3 does not sanitise and escape the X-Forwarded-For header before outputting its content on the page, which allows unauthenticated users to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/55d23184-fc5a-4090-b079-142407b59b05
CVE ID: CVE-2023-5561 State: PUBLISHED Published: 2023-10-16T19:39:10.424Z Last Updated: 2025-04-23T16:12:25.833Z Vendors: WordPress Products: WordPress Problem Types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Description: WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/19380917-4c27-4095-abf1-eba6f913b441 - https://wpscan.com/blog/email-leak-oracle-vul
- https://wpscan.com/vulnerability/19380917-4c27-4095-abf1-eba6f913b441 - https://wpscan.com/blog/email-leak-oracle-vulnerability-addressed-in-wordpress-6-3-2/ - https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html
CVE ID: CVE-2023-5562 State: PUBLISHED Published: 2023-10-12T19:00:54.732Z Last Updated: 2024-09-18T15:02:03.398Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: KNIME Products: KNIME Analytics Platform Problem Types: CWE-79 Description: An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack. When KNIME Analytics Platform is used as an executor for either KNIME Server or KNIME Business Hub several JavaScript-based view nodes do not sanitize the data that is displayed by default. If the data to be displayed contains JavaScript this code is executed in the browser and can perform any operations that th
the data to be displayed contains JavaScript this code is executed in the browser and can perform any operations that the current user is allowed to perform silently. KNIME Analytics Platform already has configuration options with which sanitization of data can be actived, see https://docs.knime.com/latest/webportal_admin_guide/index.html#html-sanitization-webportal https://docs.knime.com/latest/webportal_admin_guide/index.html#html-sanitization-webportal . However, these are off by default which allows for cross-site scripting attacks. KNIME Analytics Platform 5.2.0 will enable sanitization by default. For all previous releases we recommend users to add the corresponding settings to the exe
nable sanitization by default. For all previous releases we recommend users to add the corresponding settings to the executor's knime.ini. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.knime.com/security/advisories#CVE-2023-5562
CVE ID: CVE-2023-5563 State: PUBLISHED Published: 2023-10-12T23:11:18.074Z Last Updated: 2024-09-17T17:08:43.494Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-703 Description: The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This results in calling k_sleep() in IRQ context, causing a fatal exception. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-98mc-rj7w-7rpv
CVE ID: CVE-2023-5564 State: PUBLISHED Published: 2023-10-13T00:00:19.626Z Last Updated: 2024-09-17T17:08:03.569Z Severity: MEDIUM (CVSS 5.2 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: froxlor Products: froxlor/froxlor Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/9254d8f3-a847-4ae8-8477-d2ce027cff5c - https://github.com/froxlor/froxlor/commit/e8ed43056c1665522a586e3485da67f2bdf073aa
CVE ID: CVE-2023-5565 State: PUBLISHED Published: 2023-10-30T13:48:57.188Z Last Updated: 2025-02-05T18:56:00.280Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: amitsukapure Products: Shortcode Menu Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Shortcode Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shortmenu' shortcode in versions up to, and including, 3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arb
ttributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/438b9c13-4059-4671-ab4a-07a8cf6f6122?source=cve - https://plugins.trac.wordpress.org/browser/shortcode-menu/tags/3.2/shortcode-menu.php#L183
CVE ID: CVE-2023-5566 State: PUBLISHED Published: 2023-10-30T13:48:59.219Z Last Updated: 2025-02-05T18:55:26.279Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: simplethemes Products: Simple Shortcodes Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Simple Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbit
ributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a153d6b2-e3fd-42db-90ba-d899a07d60c1?source=cve - https://plugins.trac.wordpress.org/browser/smpl-shortcodes/tags/1.0.20/includes/shortcodes.php#L386 - https://plugins.trac.wordpress.org/browser/smpl-shortcodes/tags/1.0.20/includes/shortcodes.php#L292 - https://plugins.trac.wordpress.org/browser/smpl-shortcodes/tags/1.0.20/includes/shortcodes.
cludes/shortcodes.php#L292 - https://plugins.trac.wordpress.org/browser/smpl-shortcodes/tags/1.0.20/includes/shortcodes.php#L257
CVE ID: CVE-2023-5567 State: PUBLISHED Published: 2023-11-07T11:31:08.826Z Last Updated: 2025-02-05T18:49:07.584Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: dspreen Products: QR Code Tag Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The QR Code Tag plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'qrcodetag' shortcode in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web
This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/be004002-a3ac-46e9-b0c1-258f05f97b2a?source=cve - https://plugins.trac.wordpress.org/browser/qr-code-tag/trunk/lib/qrct/QrctWp.php?rev=1705525#L369
CVE ID: CVE-2023-5568 State: PUBLISHED Published: 2023-10-24T21:56:41.633Z Last Updated: 2025-09-02T15:43:02.714Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Storage 3 Problem Types: CWE-122 Description: A heap-based Buffer Overflow flaw was discovered in Samba. It could allow a remote, authenticated attacker to exploit this vulnerability to cause a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-5568 - https://
rogram Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-5568 - https://bugzilla.redhat.com/show_bug.cgi?id=2245174 - https://bugzilla.samba.org/show_bug.cgi?id=15491 - https://www.samba.org/samba/history/samba-4.19.2.html