Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6724 State: PUBLISHED Published: 2024-02-09T12:27:51.562Z Last Updated: 2025-05-15T19:39:21.796Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Software Engineering Consultancy Machine Equipment Limited Company Products: Hearing Tracking System Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Software Engineering Consultancy Machine Equipment Limited Company Hearing Tracking System allows Authentication Abuse.This issue affects Hearing Tracking System: before for IOS 7.0, for Android Latest release 1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
for Android Latest release 1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-0099
CVE ID: CVE-2023-6725 State: PUBLISHED Published: 2024-03-15T12:38:23.158Z Last Updated: 2025-11-20T18:06:13.728Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Red Hat Products: Red Hat OpenStack Platform 17.1 for RHEL 8, Red Hat OpenStack Platform 17.1 for RHEL 9, Red Hat OpenStack Platform 16.1, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0 Problem Types: CWE-1220 Description: An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly made world readable. A malicious attacker with access to any container cou
including access keys to BIND were improperly made world readable. A malicious attacker with access to any container could exploit this flaw to access sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:2736 - https://access.redhat.com/errata/RHSA-2024:2770 - https://access.redhat.com/security/cve/CVE-2023-6725 - https://bugzilla.redhat.com/show_bug.cgi?id=2249273
CVE ID: CVE-2023-6726 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:31.975Z Description: No description available.
CVE ID: CVE-2023-6727 State: PUBLISHED Published: 2023-12-12T10:53:02.127Z Last Updated: 2025-05-24T10:25:36.906Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-200 Description: Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook actions. If the playbook action created is to post a message in a channel based on specific keywords in a post, some playbook information, like the name, can be leaked. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/se
ked. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-6728 State: PUBLISHED Published: 2024-10-17T12:16:02.750Z Last Updated: 2024-11-05T19:32:18.366Z Vendors: Nokia Products: SR OS (7250 IXR, 7450 ESS, 7750 SR, 7950 IXR, VSR), 7705 SAR OS, 7210 SAS OS Description: Nokia SR OS bof.cfg file encryption is vulnerable to a brute force attack. This weakness allows an attacker in possession of the encrypted file to decrypt the bof.cfg file and obtain the BOF configuration content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-6728/
CVE ID: CVE-2023-6729 State: PUBLISHED Published: 2024-10-17T12:19:19.805Z Last Updated: 2024-10-17T14:59:12.920Z Vendors: Nokia Products: SR OS (7250 IXR, 7450 ESS, 7750 SR, 7950 IXR, VSR), 7705 SAR OS, 7210 SAS OS Description: Nokia SR OS routers allow read-write access to the entire file system via SFTP or SCP for users configured with "access console." Consequently, a low privilege authenticated user with "access console" can read or replace the router configuration file as well as other files stored in the Compact Flash or SD card without using CLI commands. This type of attack can lead to a compromise or denial of service of the router after the system is rebooted. Additional Analyst N
of attack can lead to a compromise or denial of service of the router after the system is rebooted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-6729/
CVE ID: CVE-2023-6730 State: PUBLISHED Published: 2023-12-19T12:11:20.729Z Last Updated: 2024-08-02T08:35:14.897Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: huggingface Products: huggingface/transformers Problem Types: CWE-502 Description: Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/423611ee-7a2a-442a-babb-3ed2f8385c16 - https://github.com/huggingface/transformers/commit/1d63b0ec361e7a38f1339385e8a5a855085532ce
CVE ID: CVE-2023-6731 State: PUBLISHED Published: 2024-05-02T16:52:47.793Z Last Updated: 2024-08-02T08:35:14.907Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: edge22 Products: WP Show Posts Problem Types: CWE-285 Improper Authorization Description: The WP Show Posts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with subscriber access and above, to view arbitrary post metadata, list posts, and view terms and taxonomies. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Progr
post metadata, list posts, and view terms and taxonomies. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e6bb3680-0623-4633-971e-3bc4a52dfad3?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3071911%40wp-show-posts%2Ftrunk&old=3041416%40wp-show-posts%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6732 State: PUBLISHED Published: 2024-01-16T15:57:02.536Z Last Updated: 2025-06-02T15:09:29.918Z Vendors: Unknown Products: Ultimate Maps by Supsystic Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ultimate Maps by Supsystic WordPress plugin before 1.2.16 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/aaf91707-f03b-4f25-bca9-9fac4945002a/
CVE ID: CVE-2023-6733 State: PUBLISHED Published: 2024-01-04T03:30:12.554Z Last Updated: 2025-06-17T20:29:11.223Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: cbutlerjr Products: WP-Members Membership Plugin Problem Types: CWE-284 Improper Access Control Description: The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.8 via the wpmem_field shortcode. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including user emails, password hashes, usernames, and more. Additional Analyst Notes: - CVE Program Cont
sensitive data including user emails, password hashes, usernames, and more. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/46c61f38-553e-43b2-a666-b160db40e66d?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3015224%40wp-members%2Ftrunk&old=2920897%40wp-members%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6734 State: REJECTED Published: N/A Last Updated: 2024-06-05T19:36:05.109Z Description: No description available.
CVE ID: CVE-2023-6735 State: PUBLISHED Published: 2024-01-12T07:50:05.450Z Last Updated: 2025-06-03T14:05:30.852Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-95 Description: Privilege escalation in mk_tsm agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/16273
CVE ID: CVE-2023-6736 State: PUBLISHED Published: 2024-02-07T22:02:30.947Z Last Updated: 2025-11-20T04:11:38.344Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-1333 Description: An issue has been discovered in GitLab EE affecting all versions starting from 11.3 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted content in the CODEOWNERS file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/g
dditional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/435036 - https://hackerone.com/reports/2269023
CVE ID: CVE-2023-6737 State: PUBLISHED Published: 2024-01-11T08:32:57.215Z Last Updated: 2025-06-17T21:09:13.924Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: shortpixel Products: Enable Media Replace Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXEL_DEBUG parameter in all versions up to, and including, 4.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if
escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploiting this vulnerability requires the attacker to know the ID of an attachment uploaded by the user they are attacking. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c37d8218-6059-46f2-a5d9-d7c22486211e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3010103%40enable-media-replace%2Ftrunk&old=2990561%40enable-media-replace%2Ftrunk&sfp_
p_email=&sfph_mail=&reponame=&new=3010103%40enable-media-replace%2Ftrunk&old=2990561%40enable-media-replace%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6738 State: PUBLISHED Published: 2024-01-04T03:30:13.051Z Last Updated: 2025-06-17T20:29:11.346Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: softaculous Products: Page Builder: Pagelayer – Drag and Drop website builder Problem Types: CWE-20 Improper Input Validation Description: The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pagelayer_header_code', 'pagelayer_body_open_code', and 'pagelayer_footer_code' meta fields in all versions up to, and including, 1.7.8 due to insufficient input sanitization and output escaping on user supplied attributes. This m
to, and including, 1.7.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This appears to be a reintroduction of a vulnerability patched in version 1.7.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d14c8890-482c-4d43-a68f-0d04c4feca8f?source=cve - https://plugins.trac.wordpress.org/browser/pagelayer/trunk/main/post_metas.php#L527 - https://plugins.trac.wo
urce=cve - https://plugins.trac.wordpress.org/browser/pagelayer/trunk/main/post_metas.php#L527 - https://plugins.trac.wordpress.org/changeset?old_path=/pagelayer/tags/1.7.8&old=3016486&new_path=/pagelayer/tags/1.7.9&new=3016486&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6740 State: PUBLISHED Published: 2024-01-12T07:50:20.076Z Last Updated: 2025-06-03T14:05:24.299Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-427 Description: Privilege escalation in jar_signature agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/16163
CVE ID: CVE-2023-6741 State: PUBLISHED Published: 2024-01-16T15:56:59.595Z Last Updated: 2025-06-20T17:22:43.549Z Vendors: Unknown Products: WP Customer Area Problem Types: CWE-284 Improper Access Control Description: The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9debe1ea-18ad-44c4-8078-68eb66d36c4a/
CVE ID: CVE-2023-6742 State: PUBLISHED Published: 2024-01-11T08:32:32.827Z Last Updated: 2025-06-17T20:00:16.325Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: smub Products: Gallery Plugin for WordPress – Envira Photo Gallery Problem Types: CWE-862 Missing Authorization Description: The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'envira_gallery_insert_images' function in all versions up to, and including, 1.8.7.1. This makes it possible for authenticated attackers, with contributor access and above, to modify galleries on other users
his makes it possible for authenticated attackers, with contributor access and above, to modify galleries on other users' posts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/40655278-6915-4a76-ac2d-bb161d3cee92?source=cve - https://plugins.trac.wordpress.org/browser/envira-gallery-lite/trunk/includes/admin/ajax.php - https://plugins.trac.wordpress.org/changeset/3017115/envira-gallery-lite/tags/1.8.7.3/includes/admin/ajax.php
CVE ID: CVE-2023-6743 State: PUBLISHED Published: 2024-05-29T04:30:13.621Z Last Updated: 2024-08-08T18:03:42.162Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: unitecms Products: Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Problem Types: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine Description: The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.89 via the template import functionality. This makes it possible for authenticated attackers, with contributor access and above, to execute
import functionality. This makes it possible for authenticated attackers, with contributor access and above, to execute code on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/25f71a19-85b1-4bc9-b193-d9de2eba81ee?source=cve - https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_output.class.php#L1765 - https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/core/plugins/unlimited_elements/elementor/elementor_widget.class.php#L3948 - https://plugins.trac.wordpress.org/changeset/3010986/unlimited-ele
elements/elementor/elementor_widget.class.php#L3948 - https://plugins.trac.wordpress.org/changeset/3010986/unlimited-elements-for-elementor#file6 - https://plugins.trac.wordpress.org/changeset/3015166/unlimited-elements-for-elementor
CVE ID: CVE-2023-6744 State: PUBLISHED Published: 2023-12-23T09:35:54.946Z Last Updated: 2024-08-02T08:42:07.395Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Elegant Themes Products: Divi Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'et_pb_text' shortcode in all versions up to, and including, 4.23.1 due to insufficient input sanitization and output escaping on user supplied custom field data. This makes it possible for authenticated attackers, with contributor-level access and above, to inje
custom field data. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/999475c5-5f17-47fa-a0d0-47cb5a8a0eb4?source=cve - https://www.elegantthemes.com/api/changelog/divi.txt
CVE ID: CVE-2023-6745 State: PUBLISHED Published: 2024-06-11T02:01:52.454Z Last Updated: 2024-08-02T08:42:07.315Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: hiroaki-miyashita Products: Custom Field Template Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cpt' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied post meta. This makes it possible for authenticated attackers with contributor-level and
tput escaping on user supplied post meta. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/25d07a99-d425-4e1a-8adf-d12071552882?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3069937%40custom-field-template&new=3069937%40custom-field-template&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6746 State: PUBLISHED Published: 2023-12-21T20:45:23.261Z Last Updated: 2025-04-23T16:22:17.760Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: GitHub Products: Enterprise Server Problem Types: CWE-532 Description: An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server back-end service that could permit an `adversary in the middle attack` when combined with other phishing techniques. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server appliance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a ser
he GitHub Enterprise Server appliance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19 - https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 - https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 - https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.
prise-server@3.9/admin/release-notes#3.9.7 - https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 - https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1
CVE ID: CVE-2023-6747 State: PUBLISHED Published: 2024-01-03T08:29:48.789Z Last Updated: 2025-06-17T20:29:08.610Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: https://fooplugins.com, bradvin Products: FooGallery Premium, Best WordPress Gallery Plugin – FooGallery Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom attributes in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for contribut
o, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for contributors and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dce8ac32-cab8-4e05-bf6f-cc348d0c9472?source=cve - https://fooplugins.com/foogallery-wordpress-gallery-plugin/pricing/ - https://plugins.trac.wordpress.org/browser/foogallery/tags/2.4.9/includes/functions.php#L1609 - https://plugins.trac.wordpress.org/browser/foogallery/tags/2.4.9/includes/class-gallery-advanced-set
nctions.php#L1609 - https://plugins.trac.wordpress.org/browser/foogallery/tags/2.4.9/includes/class-gallery-advanced-settings.php?rev=3027668#L149
CVE ID: CVE-2023-6748 State: PUBLISHED Published: 2024-06-11T02:01:56.986Z Last Updated: 2024-08-02T08:42:07.349Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: hiroaki-miyashita Products: Custom Field Template Problem Types: CWE-862 Missing Authorization Description: The Custom Field Template plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the 'cft' shortcode. This makes it possible for authenticated attackers with contributor access and above, to extract sensitive data including arbitrary post metadata. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Reference
including arbitrary post metadata. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7fcd0410-9423-4349-8d1c-3551de38a7c7?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3069937%40custom-field-template&new=3069937%40custom-field-template&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6749 State: PUBLISHED Published: 2024-02-18T07:04:36.321Z Last Updated: 2024-08-02T08:42:07.169Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-121 Description: Unchecked length coming from user input in settings shell Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-757h-rw37-66hw