Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-48940 State: PUBLISHED Published: 2023-12-06T00:00:00 Last Updated: 2024-08-02T21:46:28.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in /admin.php of DaiCuo v2.5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CVE Program Container: References: - http://daicuo.com - https://www.daicuo.net/ - https://gist.github.com/durian5201314/957af852a42dad9c07ceb3fb2f8359b2
CVE ID: CVE-2023-48945 State: PUBLISHED Published: 2023-11-29T00:00:00 Last Updated: 2024-10-10T20:20:33.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack overflow in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openlink/virtuoso-opensource/issues/1172
CVE ID: CVE-2023-48946 State: PUBLISHED Published: 2023-11-29T00:00:00 Last Updated: 2024-08-02T21:46:28.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the box_mpy function of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openlink/virtuoso-opensource/issues/1178
CVE ID: CVE-2023-48947 State: PUBLISHED Published: 2023-11-29T00:00:00 Last Updated: 2024-08-02T21:46:28.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the cha_cmp function of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openlink/virtuoso-opensource/issues/1179
CVE ID: CVE-2023-48948 State: PUBLISHED Published: 2023-11-29T00:00:00 Last Updated: 2024-08-02T21:46:28.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the box_div function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openlink/virtuoso-opensource/issues/1176
CVE ID: CVE-2023-48949 State: PUBLISHED Published: 2023-11-29T00:00:00 Last Updated: 2024-08-02T21:46:28.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the box_add function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openlink/virtuoso-opensource/issues/1173
CVE ID: CVE-2023-48950 State: PUBLISHED Published: 2023-11-29T00:00:00 Last Updated: 2024-08-02T21:46:29.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the box_col_len function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openlink/virtuoso-opensource/issues/1174
CVE ID: CVE-2023-48951 State: PUBLISHED Published: 2023-11-29T00:00:00.000Z Last Updated: 2025-06-05T13:44:52.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the box_equal function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openlink/virtuoso-opensource/issues/1177
CVE ID: CVE-2023-48952 State: PUBLISHED Published: 2023-11-29T00:00:00 Last Updated: 2024-10-17T15:28:12.309Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the box_deserialize_reusing function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openlink/virtuoso-opensource/issues/1175
CVE ID: CVE-2023-48957 State: PUBLISHED Published: 2024-08-25T00:00:00.000Z Last Updated: 2025-03-14T19:42:12.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: PureVPN Linux client 2.0.2-Productions fails to properly handle DNS queries, allowing them to bypass the VPN tunnel and be sent directly to the ISP or default DNS servers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rafaybaloch.com/2023/11/Multiple%20Critical-Vulnerabilities-in-PureVPN.html?m=1 - https://latesthackingnews.com/2023/11/13/multiple-vulnerabilities-found-in-purevpn-one-remains-unpatched/
CVE ID: CVE-2023-48958 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-10-09T13:59:40.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: gpac 2.3-DEV-rev617-g671976fcc-master contains memory leaks in gf_mpd_resolve_url media_tools/mpd.c:4589. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gpac/gpac/issues/2689 - https://gist.github.com/dr0v/1204f7a5f1e1497e7bca066638acfbf5
CVE ID: CVE-2023-48963 State: PUBLISHED Published: 2023-11-30T00:00:00 Last Updated: 2024-08-02T21:46:29.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda i6 V1.0.0.8(3856) is vulnerable to Buffer Overflow via /goform/wifiSSIDget. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/daodaoshao/vul_tenda_i6_1
CVE ID: CVE-2023-48964 State: PUBLISHED Published: 2023-11-30T00:00:00 Last Updated: 2024-08-02T21:46:28.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda i6 V1.0.0.8(3856) is vulnerable to Buffer Overflow via /goform/WifiMacFilterSet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/daodaoshao/vul_tenda_i6_2
CVE ID: CVE-2023-48965 State: PUBLISHED Published: 2023-12-04T00:00:00 Last Updated: 2024-11-26T19:08:43.081Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the component /admin/api.plugs/script of ThinkAdmin v6.1.53 allows attackers to getshell via providing a crafted URL to download a malicious PHP file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/1dreamGN/CVE/blob/main/ThinkAdmin%20Logical%20defect%20getshell.md
CVE ID: CVE-2023-48966 State: PUBLISHED Published: 2023-12-04T00:00:00 Last Updated: 2024-08-02T21:46:29.033Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53 allows attackers to execute arbitrary code via a crafted Zip file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/1dreamGN/CVE/blob/main/ThinkAdmin%20directory%20traversal%2Bfile%20upload%20getshell.md
CVE ID: CVE-2023-48967 State: PUBLISHED Published: 2023-12-04T00:00:00 Last Updated: 2024-08-02T21:46:28.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ssolon <= 2.6.0 and <=2.5.12 is vulnerable to Deserialization of Untrusted Data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/noear/solon/issues/226
CVE ID: CVE-2023-48974 State: PUBLISHED Published: 2024-02-08T00:00:00.000Z Last Updated: 2025-06-17T15:21:51.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverName_input parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.axigen.com/mail-server/download/ - https://www.axigen.com/updates/axigen-10.3.3.61
CVE ID: CVE-2023-48978 State: PUBLISHED Published: 2025-06-23T00:00:00.000Z Last Updated: 2025-06-24T15:55:31.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in NCR ITM Web terminal v.4.4.0 and v.4.4.4 allows a remote attacker to execute arbitrary code via a crafted script to the IP camera URL component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/13JrkDcVtcQFepeGoG8roBZ1xFy7iBx1R/view?usp=sharing - https://github.com/pwahba/cve-research/blob/main/CVE-2023-48978/CVE-2023-48978.md
CVE ID: CVE-2023-48985 State: PUBLISHED Published: 2024-02-14T00:00:00.000Z Last Updated: 2025-03-19T14:31:46.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in CU Solutions Group (CUSG) Content Management System (CMS) before v.7.75 allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted script to the login.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.lmgsecurity.com/news/critical-software-vulnerabilities-impacting-credit-unions-discovered-by-lmg-security-researcher-immediate-action-recommended/
CVE ID: CVE-2023-48986 State: PUBLISHED Published: 2024-02-14T00:00:00.000Z Last Updated: 2025-03-20T13:14:37.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in CU Solutions Group (CUSG) Content Management System (CMS) before v.7.75 allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted script to the users.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.lmgsecurity.com/news/critical-software-vulnerabilities-impacting-credit-unions-discovered-by-lmg-security-researcher-immediate-action-recommended/
CVE ID: CVE-2023-48987 State: PUBLISHED Published: 2024-02-14T00:00:00 Last Updated: 2024-08-29T14:48:40.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blind SQL Injection vulnerability in CU Solutions Group (CUSG) Content Management System (CMS) before v.7.75 allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted script to the pages.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.lmgsecurity.com/news/critical-software-vulnerabilities-impacting-credit-unions-discovered-by-lmg-security-researcher-immediate-action-recommended/
CVE ID: CVE-2023-49000 State: PUBLISHED Published: 2023-12-27T00:00:00 Last Updated: 2024-09-20T12:20:58.676271 Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in ArtistScope ArtisBrowser v.34.1.5 and before allows an attacker to bypass intended access restrictions via interaction with the com.artis.browser.IntentReceiverActivity component. NOTE: this is disputed by the vendor, who indicates that ArtisBrowser 34 does not support CSS3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/actuator/com.artis.browser/blob/main/CWE-94.md - https://github.com/actuator/cve/blob/main/CVE-2023-49000 - https://github.com/advisories/GHSA-866h-q63m-66xm
CVE ID: CVE-2023-49001 State: PUBLISHED Published: 2023-12-27T00:00:00 Last Updated: 2024-09-09T20:47:05.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Indi Browser (aka kvbrowser) v.12.11.23 allows an attacker to bypass intended access restrictions via interaction with the com.example.gurry.kvbrowswer.webview component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/actuator/com.gurry.kvbrowser/blob/main/CWE-94.md - https://github.com/actuator/cve/blob/main/CVE-2023-49001
CVE ID: CVE-2023-49002 State: PUBLISHED Published: 2023-12-27T00:00:00 Last Updated: 2024-08-27T18:28:23.769Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Xenom Technologies (sinous) Phone Dialer-voice Call Dialer v.1.2.5 allows an attacker to bypass intended access restrictions via interaction with com.funprime.calldialer.ui.activities.OutgoingActivity. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/actuator/com.sinous.voice.dialer/blob/main/CWE-928.md - https://github.com/actuator/cve/blob/main/CVE-2023-49002
CVE ID: CVE-2023-49003 State: PUBLISHED Published: 2023-12-27T00:00:00 Last Updated: 2024-08-02T21:46:28.709Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in simplemobiletools Simple Dialer 5.18.1 allows an attacker to bypass intended access restrictions via interaction with com.simplemobiletools.dialer.activities.DialerActivity. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/actuator/com.simplemobiletools.dialer/blob/main/CWE-928.md - https://github.com/actuator/cve/blob/main/CVE-2023-49003
CVE ID: CVE-2023-49004 State: PUBLISHED Published: 2023-12-19T00:00:00 Last Updated: 2024-08-02T21:46:28.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in D-Link DIR-850L v.B1_FW223WWb01 allows a remote attacker to execute arbitrary code via a crafted script to the en parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ef4tless/vuln/blob/master/iot/DIR-850L/bug1.md
CVE ID: CVE-2023-49006 State: PUBLISHED Published: 2023-12-19T00:00:00 Last Updated: 2024-08-02T21:46:29.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/ca6d669f-fd82-4188-aae2-69e08740d982/ - https://github.com/phpsysinfo/phpsysinfo/commit/4f2cee505e4f2e9b369a321063ff2c5e0c34ba45 - https://github.com/Hebing123/cve/issues/5
CVE ID: CVE-2023-49007 State: PUBLISHED Published: 2023-12-08T00:00:00 Last Updated: 2024-08-02T21:46:29.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netgear Orbi RBR750 firmware before V7.2.6.21, there is a stack-based buffer overflow in /usr/sbin/httpd. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/5erua/netgear_orbi_overflow_vulnerability/blob/main/README.md
CVE ID: CVE-2023-49028 State: PUBLISHED Published: 2023-11-27T00:00:00 Last Updated: 2024-08-02T21:46:28.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in smpn1smg absis v.2017-10-19 and before allows a remote attacker to execute arbitrary code via the user parameter in the lock/lock.php file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/smpn1smg/absis - https://github.com/Chiaki2333/vulnerability/blob/main/smpn1smg-absis-XSS-lock.php-user.md - https://gist.github.com/Chiaki2333/d132c4b169b55bd7cd50e73dbe20c410
CVE ID: CVE-2023-49029 State: PUBLISHED Published: 2023-11-27T00:00:00 Last Updated: 2024-08-02T21:46:29.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in smpn1smg absis v.2017-10-19 and before allows a remote attacker to execute arbitrary code via the nama parameter in the lock/lock.php file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/smpn1smg/absis - https://github.com/Chiaki2333/vulnerability/blob/main/smpn1smg-absis-XSS-lock.php-nama.md - https://gist.github.com/Chiaki2333/717b83b800180e1a4c3ee5f6e49f95c0
CVE ID: CVE-2023-49030 State: PUBLISHED Published: 2023-11-27T00:00:00 Last Updated: 2024-10-10T20:30:21.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in32ns KLive v.2019-1-19 and before allows a remote attacker to obtain sensitive information via a crafted script to the web/user.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Chiaki2333/vulnerability/blob/main/32ns-KLive-SQL-user.php.md - https://github.com/32ns/KLive - https://gist.github.com/Chiaki2333/f09b47a39e175932d8a2360e439194d5
CVE ID: CVE-2023-49031 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-03-05T18:36:58.072Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal (Local File Inclusion) vulnerability in Tikit (now Advanced) eMarketing platform 6.8.3.0 allows a remote attacker to read arbitrary files and obtain sensitive information via a crafted payload to the filename parameter to the OpenLogFile endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Yoshik0xF6/CVE-2023-49031
CVE ID: CVE-2023-49032 State: PUBLISHED Published: 2023-12-20T00:00:00.000Z Last Updated: 2025-04-24T14:58:58.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in LTB Self Service Password before v.1.5.4 allows a remote attacker to execute arbitrary code and obtain sensitive information via hijack of the SMS verification code function to arbitrary phone. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ltb-project/self-service-password/issues/816 - https://github.com/piuppi/Proof-of-Concepts/blob/main/ltb-project/README.md
CVE ID: CVE-2023-49034 State: PUBLISHED Published: 2024-02-20T00:00:00 Last Updated: 2024-08-29T15:11:44.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in ProjeQtOr 11.0.2 allows a remote attacker to execute arbitrary code via a crafted script to thecheckvalidHtmlText function in the ack.php and security.php files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/thedroidgeek/0a9b8189b74f968b5d7b84ec12b8f8f5
CVE ID: CVE-2023-49038 State: PUBLISHED Published: 2024-01-29T00:00:00.000Z Last Updated: 2025-06-02T19:19:01.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command injection in the ping utility on Buffalo LS210D 1.78-0.03 allows a remote authenticated attacker to inject arbitrary commands onto the NAS as root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/christopher-pace/CVE-2023-49038
CVE ID: CVE-2023-49040 State: PUBLISHED Published: 2023-11-27T00:00:00 Last Updated: 2024-10-10T20:32:54.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Tneda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the adslPwd parameter in the form_fast_setting_internet_set function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Anza2001/IOT_VULN/blob/main/Tenda/AX1803/form_fast_setting_internet_set.md
CVE ID: CVE-2023-49042 State: PUBLISHED Published: 2023-11-27T00:00:00 Last Updated: 2024-08-02T21:46:29.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the schedStartTime parameter or the schedEndTime parameter in the function setSchedWifi. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Anza2001/IOT_VULN/blob/main/Tenda/AX1803/setSchedWifi.md
CVE ID: CVE-2023-49043 State: PUBLISHED Published: 2023-11-27T00:00:00 Last Updated: 2024-08-02T21:46:29.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the wpapsk_crypto parameter in the function fromSetWirelessRepeat. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Anza2001/IOT_VULN/blob/main/Tenda/AX1803/fromSetWirelessRepeat.md
CVE ID: CVE-2023-49044 State: PUBLISHED Published: 2023-11-27T00:00:00 Last Updated: 2024-08-02T21:46:28.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the ssid parameter in the function form_fast_setting_wifi_set. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Anza2001/IOT_VULN/blob/main/Tenda/AX1803/form_fast_setting_wifi_set.md
CVE ID: CVE-2023-49046 State: PUBLISHED Published: 2023-11-27T00:00:00 Last Updated: 2024-11-26T19:31:37.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the devName parameter in the function formAddMacfilterRule. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Anza2001/IOT_VULN/blob/main/Tenda/AX1803/formAddMacfilterRule.md
CVE ID: CVE-2023-49047 State: PUBLISHED Published: 2023-11-27T00:00:00 Last Updated: 2024-08-02T21:46:28.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX1803 v1.0.0.1 contains a stack overflow via the devName parameter in the function formSetDeviceName. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Anza2001/IOT_VULN/blob/main/Tenda/AX1803/formSetDeviceName.md
CVE ID: CVE-2023-49052 State: PUBLISHED Published: 2023-11-30T00:00:00 Last Updated: 2024-08-02T21:46:28.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cyber-Wo0dy/report/blob/main/microweber/v2.0.4/microweber_unrestricted_upload - https://github.com/Cyber-Wo0dy/CVE-2023-49052
CVE ID: CVE-2023-49058 State: PUBLISHED Published: 2023-12-12T01:01:07.964Z Last Updated: 2024-08-02T21:46:29.250Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Master Data Governance Problem Types: CWE-22 Description: SAP Master Data Governance File Upload application allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing ‘traverse to parent directory’ are passed through to the file APIs. As a result, it has a low impact to the confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://me.sap.com/notes/3363690 - https://www.sap.com/documents
l Analyst Notes: - CVE Program Container: References: - https://me.sap.com/notes/3363690 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-49060 State: PUBLISHED Published: 2023-11-21T14:28:55.428Z Last Updated: 2024-08-02T21:46:28.962Z Vendors: Mozilla Products: Firefox for iOS Problem Types: Privilege escalation through in ReaderMode Description: An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the `referrerpolicy` attribute. This vulnerability affects Firefox for iOS < 120. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1861405 - https://www.mozilla.org/security/advisories/mfsa2023-51/
CVE ID: CVE-2023-49061 State: PUBLISHED Published: 2023-11-21T14:28:55.728Z Last Updated: 2024-08-02T21:46:29.100Z Vendors: Mozilla Products: Firefox for iOS Problem Types: HTML injection in %READER-BYLINE% of ReaderMode Description: An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. This vulnerability affects Firefox for iOS < 120. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1861420 - https://www.mozilla.org/security/advisories/mfsa2023-51/