Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-2876 State: PUBLISHED Published: 2023-06-13T03:52:12.002Z Last Updated: 2025-01-03T02:00:22.732Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: ABB Products: REX640 PCL1, REX640 PCL2, REX640 PCL3 Problem Types: CWE-1004 Description: Sensitive Cookie Without 'HttpOnly' Flag vulnerability in ABB REX640 PCL1 (firmware modules), ABB REX640 PCL2 (Firmware modules), ABB REX640 PCL3 (firmware modules) allows Cross-Site Scripting (XSS).This issue affects REX640 PCL1: from 1.0;0 before 1.0.8; REX640 PCL2: from 1.0;0 before 1.1.4; REX640 PCL3: from 1.0;0 before 1.2.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
40 PCL3: from 1.0;0 before 1.2.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=2NGA001423&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2023-2877 State: PUBLISHED Published: 2023-06-27T13:17:12.873Z Last Updated: 2024-12-03T17:00:58.356Z Vendors: Unknown Products: Formidable Forms Problem Types: CWE-863 Incorrect Authorization Description: The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. This allows a user with a role as low as Subscriber to install and activate arbitrary plugins of arbitrary versions from the WordPress.org plugin repository onto the site, leading to Remote Code Execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulne
tion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/33765da5-c56e-42c1-83dd-fcaad976b402
CVE ID: CVE-2023-2878 State: PUBLISHED Published: 2023-06-07T14:35:10.295Z Last Updated: 2025-02-13T16:48:51.962Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Kubernetes Products: secrets-store-csi-driver Problem Types: CWE-532 Description: Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kubernetes/kubernetes/issues/118419 - https://groups.google.com/g/kubernetes-security-announce/c/5K8ghQHBDdQ/m/Udee6YUgAAAJ - https://security.netapp.com/advisory/ntap-20230814-0003/
CVE ID: CVE-2023-2879 State: PUBLISHED Published: 2023-05-26T00:00:00.000Z Last Updated: 2025-11-03T21:47:43.448Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Wireshark Foundation Products: Wireshark Problem Types: Loop with unreachable exit condition ('infinite loop') in Wireshark Description: GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wireshark.org/security/wnpa-sec-2023-14.html - https://gitlab.com/wireshark/wireshark/-/issues/19068 - https://gitlab.com/gitla
rk.org/security/wnpa-sec-2023-14.html - https://gitlab.com/wireshark/wireshark/-/issues/19068 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2879.json - https://lists.debian.org/debian-lts-announce/2023/06/msg00004.html - https://www.debian.org/security/2023/dsa-5429 - https://security.gentoo.org/glsa/202309-02
CVE ID: CVE-2023-2880 State: PUBLISHED Published: 2023-07-05T09:04:28.091Z Last Updated: 2024-11-20T21:26:10.093Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Frauscher Sensortechnik Products: Diagnostic System FDS101 for FAdC/FAdCi Problem Types: CWE-22 Description: Frauscher Sensortechnik GmbH FDS001 for FAdC/FAdCi v1.3.3 and all previous versions are vulnerable to a path traversal vulnerability of the web interface by a crafted URL without authentication. This enables an remote attacker to read all files on the filesystem of the FDS001 device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/e
device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2023-011/
CVE ID: CVE-2023-2881 State: PUBLISHED Published: 2023-05-25T00:00:00 Last Updated: 2025-01-16T15:15:04.522Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H) Vendors: pimcore Products: pimcore/customer-data-framework Problem Types: CWE-257 Description: Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/db6c32f4-742e-4262-8fd5-cefd0f133416 - https://github.com/pimcore/customer-data-framework/commit/d1d58c10313f080737dc1e71fab3beb12488a1e6
CVE ID: CVE-2023-2882 State: PUBLISHED Published: 2023-05-25T08:18:23.610Z Last Updated: 2025-01-15T20:58:37.074Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CBOT Products: Chatbot Problem Types: CWE-1270 Description: Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse.This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0293
CVE ID: CVE-2023-2883 State: PUBLISHED Published: 2023-05-25T08:20:44.289Z Last Updated: 2025-01-15T20:59:17.595Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: CBOT Products: Chatbot Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in CBOT Chatbot allows Authentication Abuse, Authentication Bypass.This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0293
CVE ID: CVE-2023-2884 State: PUBLISHED Published: 2023-05-25T08:26:39.535Z Last Updated: 2025-01-15T20:59:51.037Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CBOT Products: Chatbot Problem Types: CWE-338, CWE-330 Description: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Use of Insufficiently Random Values vulnerability in CBOT Chatbot allows Signature Spoofing by Key Recreation.This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0293
CVE ID: CVE-2023-2885 State: PUBLISHED Published: 2023-05-25T08:28:56.312Z Last Updated: 2025-01-15T21:00:40.712Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CBOT Products: Chatbot Problem Types: CWE-924 Description: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in CBOT Chatbot allows Adversary in the Middle (AiTM).This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0293
CVE ID: CVE-2023-2886 State: PUBLISHED Published: 2023-05-25T08:31:24.499Z Last Updated: 2025-01-15T21:11:30.965Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: CBOT Products: Chatbot Problem Types: CWE-1385 Description: Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation.This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0293
CVE ID: CVE-2023-2887 State: PUBLISHED Published: 2023-05-25T08:33:34.404Z Last Updated: 2025-01-16T19:24:18.873Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CBOT Products: Chatbot Problem Types: CWE-290 Description: Authentication Bypass by Spoofing vulnerability in CBOT Chatbot allows Authentication Bypass.This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0293
CVE ID: CVE-2023-2888 State: PUBLISHED Published: 2023-05-25T13:00:04.633Z Last Updated: 2025-01-16T19:23:31.840Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: PHPOK Problem Types: CWE-434 Description: A vulnerability, which was classified as problematic, was found in PHPOK 6.4.100. This affects an unknown part of the file /admin.php?c=upload&f=zip&_noCache=0.1683794968. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The identifier VDB-229953 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.229953 - https://vuldb.com/?
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.229953 - https://vuldb.com/?ctiid.229953 - https://gitee.com/phpok/phpok/issues/I72D24
CVE ID: CVE-2023-2889 State: PUBLISHED Published: 2023-11-22T13:30:44.973Z Last Updated: 2024-08-02T06:41:02.446Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Veon Computer Products: Service Tracking Software Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veon Computer Service Tracking Software allows SQL Injection.This issue affects Service Tracking Software: before crm 2.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-23-0653
CVE ID: CVE-2023-2891 State: PUBLISHED Published: 2023-06-09T05:33:31.106Z Last Updated: 2024-12-20T23:35:54.315Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: levelfourstorefront Products: Shopping Cart & eCommerce Store Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the process_delete_product function. This makes it possible for unauthenticated attackers to delete products via a forged request granted they can trick a site administrator into performing an a
cated attackers to delete products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bcca7ade-8b35-4ba1-a8b4-b1e815b025e3?source=cve - https://plugins.trac.wordpress.org/changeset/2917958/wp-easycart
CVE ID: CVE-2023-2892 State: PUBLISHED Published: 2023-06-09T06:48:50.216Z Last Updated: 2024-12-20T23:32:55.382Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: levelfourstorefront Products: Shopping Cart & eCommerce Store Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the process_bulk_delete_product function. This makes it possible for unauthenticated attackers to bulk delete products via a forged request granted they can trick a site administrator into perfo
henticated attackers to bulk delete products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b36e94e4-b1e8-4803-9377-c4d710b029de?source=cve - https://plugins.trac.wordpress.org/changeset/2917958/wp-easycart
CVE ID: CVE-2023-2893 State: PUBLISHED Published: 2023-06-09T06:48:40.891Z Last Updated: 2024-12-20T23:33:35.782Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: levelfourstorefront Products: Shopping Cart & eCommerce Store Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the process_deactivate_product function. This makes it possible for unauthenticated attackers to deactivate products via a forged request granted they can trick a site administrator into perform
enticated attackers to deactivate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1268604c-08eb-4d86-8e97-9cdaa3e19c1f?source=cve - https://plugins.trac.wordpress.org/changeset/2917958/wp-easycart
CVE ID: CVE-2023-2894 State: PUBLISHED Published: 2023-06-09T06:48:48.886Z Last Updated: 2024-12-20T23:33:26.271Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: levelfourstorefront Products: Shopping Cart & eCommerce Store Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the process_bulk_deactivate_product function. This makes it possible for unauthenticated attackers to bulk deactivate products via a forged request granted they can trick a site administrator in
nauthenticated attackers to bulk deactivate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a68b8df9-9b50-4617-9308-76a2a9036d7a?source=cve - https://plugins.trac.wordpress.org/changeset/2917958/wp-easycart
CVE ID: CVE-2023-2895 State: PUBLISHED Published: 2023-06-09T06:48:38.488Z Last Updated: 2024-12-20T23:34:04.758Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: levelfourstorefront Products: Shopping Cart & eCommerce Store Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the process_bulk_activate_product function. This makes it possible for unauthenticated attackers to bulk activate products via a forged request granted they can trick a site administrator into p
uthenticated attackers to bulk activate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/02fd8469-cd99-42dc-9a28-c0ea08512bb0?source=cve - https://plugins.trac.wordpress.org/changeset/2917958/wp-easycart
CVE ID: CVE-2023-2896 State: PUBLISHED Published: 2023-06-09T06:48:38.994Z Last Updated: 2024-12-20T23:33:54.786Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: levelfourstorefront Products: Shopping Cart & eCommerce Store Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the process_duplicate_product function. This makes it possible for unauthenticated attackers to duplicate products via a forged request granted they can trick a site administrator into performin
nticated attackers to duplicate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/041830b8-f059-46f5-961b-3ba908d161f9?source=cve - https://plugins.trac.wordpress.org/changeset/2917958/wp-easycart
CVE ID: CVE-2023-2897 State: PUBLISHED Published: 2023-06-09T06:48:49.496Z Last Updated: 2024-12-20T23:33:07.460Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: themefusecom Products: Brizy – Page Builder Problem Types: CWE-348 Use of Less Trusted Source Description: The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an implicit trust of user-supplied IP addresses in an 'X-Forwarded-For' HTTP header for the purpose of validating allowed IP addresses against a Maintenance Mode whitelist. Supplying a whitelisted IP address within the 'X-Forwarded-For' header allows maintenance
a Maintenance Mode whitelist. Supplying a whitelisted IP address within the 'X-Forwarded-For' header allows maintenance mode to be bypassed and may result in the disclosure of potentially sensitive information or allow access to restricted functionality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ae342dd9-2f5f-4356-8fb4-9a3e5f4f8316?source=cve - https://plugins.trac.wordpress.org/changeset/2919443/brizy
CVE ID: CVE-2023-2898 State: PUBLISHED Published: 2023-05-26T00:00:00 Last Updated: 2024-10-15T17:12:06.888Z Vendors: n/a Products: Kernel Problem Types: CWE-476 Description: There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a denial of service problem. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lore.kernel.org/linux-f2fs-devel/20230522124203.3838360-1-chao%40kernel.org/ - https://www.debian.org/security/2023/dsa-5480 - https://www.debian.org/security/2023/dsa-5492 - https://security.netapp.com/advisory/ntap-20230929-0002/ - https:/
480 - https://www.debian.org/security/2023/dsa-5492 - https://security.netapp.com/advisory/ntap-20230929-0002/ - https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
CVE ID: CVE-2023-2899 State: PUBLISHED Published: 2023-06-19T10:52:45.489Z Last Updated: 2024-12-12T16:51:25.211Z Vendors: Unknown Products: Google Map Shortcode Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Google Map Shortcode WordPress plugin through 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/92dcbeb3-17db-4d10-8ae7-c9
VE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/92dcbeb3-17db-4d10-8ae7-c99acdb48c78
CVE ID: CVE-2023-2900 State: PUBLISHED Published: 2023-05-25T21:00:03.450Z Last Updated: 2024-08-02T06:41:02.459Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: NFine Products: Rapid Development Platform Problem Types: CWE-328 Description: A vulnerability was found in NFine Rapid Development Platform 20230511. It has been classified as problematic. Affected is an unknown function of the file /Login/CheckLogin. The manipulation leads to use of weak hash. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. VDB-229974 is
The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. VDB-229974 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.229974 - https://vuldb.com/?ctiid.229974 - https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/NFine-Rapid-development-platform-has-weak-password-vulnerability.md
CVE ID: CVE-2023-2901 State: PUBLISHED Published: 2023-05-25T21:31:03.597Z Last Updated: 2025-01-14T16:41:37.876Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: NFine Products: Rapid Development Platform Problem Types: CWE-284 Description: A vulnerability was found in NFine Rapid Development Platform 20230511. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /SystemManage/User/GetGridJson?_search=false&nd=1680855479750&rows=50&page=1&sidx=F_CreatorTime+desc&sord=asc. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public
on leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229975. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.229975 - https://vuldb.com/?ctiid.229975 - https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/NFine%20rapid%20development%20platform%20User-GetGridJson%20has%20unauthorized%20access%20vulnerability.md
CVE ID: CVE-2023-2902 State: PUBLISHED Published: 2023-05-25T22:00:04.902Z Last Updated: 2024-08-02T06:41:02.439Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: NFine Products: Rapid Development Platform Problem Types: CWE-284 Description: A vulnerability was found in NFine Rapid Development Platform 20230511. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /SystemManage/Organize/GetTreeGridJson?_search=false&nd=1681813520783&rows=10000&page=1&sidx=&sord=asc. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
oper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229976. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.229976 - https://vuldb.com/?ctiid.229976 - https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/The%20NFine%20rapid%20development%20platform%20Organize-GetTreeGridJson%20has%20unauthorized%20access%20vulnerability.md
CVE ID: CVE-2023-2903 State: PUBLISHED Published: 2023-05-25T22:31:03.689Z Last Updated: 2024-08-02T06:41:04.031Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: NFine Products: Rapid Development Platform Problem Types: CWE-284 Description: A vulnerability classified as problematic has been found in NFine Rapid Development Platform 20230511. This affects an unknown part of the file /SystemManage/Role/GetGridJson?keyword=&page=1&rows=20. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-229977 was assigned to this vulnerability. N