Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-2541 State: PUBLISHED Published: 2023-06-07T08:08:50.258Z Last Updated: 2024-09-04T07:00:10.689Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: KNIME Products: KNIME Business Hub Problem Types: CWE-497 Description: The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about the application such as versions, host names, or IP addresses. No personal information or application data was exposed. Additional Analyst Notes: - CVE Program Container: References: - https://www.knime.com/security/advisories#CVE-2023-2541 - https://zigrin.com/advisories/knime-business-hub-sensitive-information
www.knime.com/security/advisories#CVE-2023-2541 - https://zigrin.com/advisories/knime-business-hub-sensitive-information-disclosure/
CVE ID: CVE-2023-2544 State: PUBLISHED Published: 2023-10-03T13:03:13.218Z Last Updated: 2024-09-19T19:50:13.267Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Universitat Politècnica de València (UPV) Products: UPV PEIX Problem Types: CWE-639 Description: Authorization bypass vulnerability in UPV PEIX, affecting the component "pdf_curri_new.php". Through a POST request, an authenticated user could change the ID parameter to retrieve all the stored information of other registered users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/authorization-bypass-upv-peix
CVE ID: CVE-2023-2545 State: PUBLISHED Published: 2023-05-31T02:40:21.280Z Last Updated: 2025-01-13T16:31:30.066Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: featherplugins Products: Custom Login Page | Temporary Users | Rebrand Login | Login Captcha Problem Types: CWE-862 Missing Authorization Description: The Feather Login Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getListOfUsers' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to access the login links, which can be u
ible for authenticated attackers, with subscriber-level permissions and above, to access the login links, which can be used for privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ab2178-7438-43ef-961e-b54d0d230f4a?source=cve - https://plugins.trac.wordpress.org/browser/feather-login-page/trunk/features/inc/admin/expirable-login-link.php?rev=2612332#L85
CVE ID: CVE-2023-2546 State: PUBLISHED Published: 2023-06-06T01:55:07.908Z Last Updated: 2024-12-23T16:22:57.691Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: iqbalrony Products: WP User Switch Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: The WP User Switch plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.2. This is due to incorrect authentication checking in the 'wpus_allow_user_to_admin_bar_menu' function with the 'wpus_who_switch' cookie value. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any ex
ue. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator, if they have access to the username. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e89d912d-fa7a-4fb1-8872-95fa861c21ca?source=cve - https://plugins.trac.wordpress.org/browser/wp-user-switch/trunk/inc/functions.php?rev=2237142#L33 - https://plugins.trac.wordpress.org/changeset/2921182/wp-user-switch/trunk/inc/functions.php - https://lana.codes/lanavdb/0cfdc5fa-d219-46bb-b8cc-693ac28a9e92/
CVE ID: CVE-2023-2547 State: PUBLISHED Published: 2023-05-31T02:40:20.445Z Last Updated: 2025-01-13T16:31:49.290Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: featherplugins Products: Custom Login Page | Temporary Users | Rebrand Login | Login Captcha Problem Types: CWE-862 Missing Authorization Description: The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete the temp user generated by the plug
for authenticated attackers, with subscriber-level permissions and above, to delete the temp user generated by the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5d58a6a4-de2c-485f-a8b0-7a7d144fbf3c?source=cve - https://plugins.trac.wordpress.org/browser/feather-login-page/trunk/features/inc/admin/expirable-login-link.php?rev=2612332#L71
CVE ID: CVE-2023-2548 State: PUBLISHED Published: 2023-05-16T08:40:01.773Z Last Updated: 2025-01-13T16:49:53.951Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: metagauss Products: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The RegistrationMagic plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 5.2.0.5. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authentic
access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers, with administrator-level permissions and above, to change user passwords and potentially take over super-administrator accounts in multisite setup. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bfbc406b-49af-419e-adeb-0510794b7e3f?source=cve - https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/5.2.0.5/includes/class_rm_utilities.php#L3044
CVE ID: CVE-2023-2549 State: PUBLISHED Published: 2023-05-31T02:40:19.517Z Last Updated: 2025-01-13T16:32:05.929Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: featherplugins Products: Custom Login Page | Temporary Users | Rebrand Login | Login Captcha Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Feather Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions starting from 1.0.7 up to, and including, 1.1.1. This is due to missing nonce validation in the 'createTempAccountLink' function. This makes it possible for unauthenticated attackers to create a new user with administrator role via a forged re
ction. This makes it possible for unauthenticated attackers to create a new user with administrator role via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can leverage CVE-2023-2545 to get the login link or request a password reset to the new user's email address. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/12560b8e-9c47-4f7f-ac9c-d86f17914ba3?source=cve - https://plugins.trac.wordpress.org/browser/feather-login-page/trunk/features/inc/admin/expirable-login-link.php?rev=2612332#L206
CVE ID: CVE-2023-2550 State: PUBLISHED Published: 2023-05-05T00:00:00.000Z Last Updated: 2025-02-12T16:30:39.940Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/840c8d91-c97e-4116-a9f8-4ab1a38d239b - https://github.com/thorsten/phpmyfaq/commit/20ac51594db11604a4518aacc28a51f67d4f11bf
CVE ID: CVE-2023-2551 State: PUBLISHED Published: 2023-05-05T00:00:00.000Z Last Updated: 2025-02-12T16:30:55.084Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: unilogies Products: unilogies/bumsys Problem Types: CWE-98 Description: PHP Remote File Inclusion in GitHub repository unilogies/bumsys prior to 2.1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/unilogies/bumsys/commit/86e29dd23df348ec6075f0c0de8e06b8d9fb0a9a - https://huntr.dev/bounties/5723613c-55c6-4f18-9ed3-61ad44f5de9c
CVE ID: CVE-2023-2552 State: PUBLISHED Published: 2023-05-05T00:00:00.000Z Last Updated: 2025-02-12T16:31:11.618Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: unilogies Products: unilogies/bumsys Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository unilogies/bumsys prior to 2.1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/ab0b4655-f57a-4113-849b-2237eeb75b32 - https://github.com/unilogies/bumsys/commit/86e29dd23df348ec6075f0c0de8e06b8d9fb0a9a
CVE ID: CVE-2023-2553 State: PUBLISHED Published: 2023-05-05T00:00:00.000Z Last Updated: 2025-02-12T16:31:36.766Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: unilogies Products: unilogies/bumsys Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository unilogies/bumsys prior to 2.2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/unilogies/bumsys/commit/1b426f58a513194206d0ea8ab58baf1461e54978 - https://huntr.dev/bounties/4e1f5b56-e846-40d8-a83c-533efd56aacf
CVE ID: CVE-2023-2554 State: PUBLISHED Published: 2023-05-05T00:00:00.000Z Last Updated: 2025-02-12T16:31:57.026Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: unilogies Products: unilogies/bumsys Problem Types: CWE-73 Description: External Control of File Name or Path in GitHub repository unilogies/bumsys prior to 2.2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/396785a0-7bb6-4db4-b4cb-607b0fd4ab4b - https://github.com/unilogies/bumsys/commit/1b426f58a513194206d0ea8ab58baf1461e54978
CVE ID: CVE-2023-2555 State: PUBLISHED Published: 2023-06-09T05:33:36.478Z Last Updated: 2024-12-20T23:34:33.668Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: realmag777 Products: WPCS – WordPress Currency Switcher Professional Problem Types: CWE-862 Missing Authorization Description: The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to create a custom drop-down currency switcher. Additional
cated attackers, with subscriber-level permissions and above, to create a custom drop-down currency switcher. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dd6b5d6d-5f5b-4b38-a25a-02cc1c041d37?source=cve - https://plugins.trac.wordpress.org/changeset/2911049/currency-switcher
CVE ID: CVE-2023-2556 State: PUBLISHED Published: 2023-06-09T05:33:30.695Z Last Updated: 2024-12-20T23:36:06.513Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: realmag777 Products: WPCS – WordPress Currency Switcher Professional Problem Types: CWE-862 Missing Authorization Description: The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the anonymous function for the wpcs_sd_delete action in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete an arbitrary cu
is makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete an arbitrary custom drop-down currency switcher. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bc44c95e-9ca0-46d0-8315-72612ef3f855?source=cve - https://plugins.trac.wordpress.org/changeset/2911049/currency-switcher
CVE ID: CVE-2023-2557 State: PUBLISHED Published: 2023-06-09T05:33:35.241Z Last Updated: 2024-12-20T23:34:49.713Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: realmag777 Products: WPCS – WordPress Currency Switcher Professional Problem Types: CWE-862 Missing Authorization Description: The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to edit an arbitrary custom drop-down currency switcher. Add
ted attackers, with subscriber-level permissions and above, to edit an arbitrary custom drop-down currency switcher. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d4c79242-5c89-40c0-abcc-c112f7a64a74?source=cve - https://plugins.trac.wordpress.org/changeset/2911049/currency-switcher
CVE ID: CVE-2023-2558 State: PUBLISHED Published: 2023-06-09T05:33:31.519Z Last Updated: 2024-11-23T13:18:21.799Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: realmag777 Products: WPCS – WordPress Currency Switcher Professional Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcs_current_currency shortcode in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib
ding, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/be054481-89b4-47d8-ad06-8622edea367f?source=cve - https://plugins.trac.wordpress.org/changeset/2911049/currency-switcher
CVE ID: CVE-2023-2560 State: PUBLISHED Published: 2023-05-06T10:00:08.485Z Last Updated: 2025-01-29T15:41:14.349Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: jja8 Products: NewBingGoGo Problem Types: CWE-79 Description: A vulnerability was found in jja8 NewBingGoGo up to 2023.5.5.2. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-228167. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.
228167. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.228167 - https://vuldb.com/?ctiid.228167 - https://gitee.com/jja8/NewBingGoGo/issues/I6WH2E
CVE ID: CVE-2023-2561 State: PUBLISHED Published: 2023-07-12T04:38:52.528Z Last Updated: 2024-10-22T19:09:17.235Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: billerickson Products: Gallery Metabox Problem Types: CWE-862 Missing Authorization Description: The Gallery Metabox for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gallery_remove function in versions up to, and including, 1.5. This makes it possible for subscriber-level attackers to modify galleries attached to posts and pages with this plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://
ges with this plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/faad339f-96d6-4937-a1f3-9d2d19bc6395?source=cve - https://plugins.trac.wordpress.org/browser/gallery-metabox/trunk/gallery-metabox.php?rev=611664#L233
CVE ID: CVE-2023-2562 State: PUBLISHED Published: 2023-07-12T04:38:47.479Z Last Updated: 2024-10-22T19:33:59.861Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: billerickson Products: Gallery Metabox Problem Types: CWE-862 Missing Authorization Description: The Gallery Metabox for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the refresh_metabox function in versions up to, and including, 1.5. This makes it possible for subscriber-level attackers to obtain a list of images attached to a post. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/951e4651-56d6-474d-84b3-5a7cfc357b9f?source=cve - https://plugins.trac.wordpress.org/browser/gallery-metabox/trunk/gallery-metabox.php?rev=611664#L203
CVE ID: CVE-2023-2563 State: PUBLISHED Published: 2023-06-13T01:48:07.662Z Last Updated: 2024-12-03T16:33:44.172Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: cimatti Products: WordPress Contact Forms by Cimatti Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.7. This is due to missing or incorrect nonce validation on the function _accua_forms_form_edit_action. This makes it possible for unauthenticated attackers to delete forms created with this plugin via a forged request granted they can tric
ssible for unauthenticated attackers to delete forms created with this plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f80a1f13-c1b9-4259-8d96-71a3cbcaf4ca?source=cve - https://plugins.trac.wordpress.org/browser/contact-forms/trunk/accua-forms.php#L738 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2924628%40contact-forms&new=2924628%40contact-forms&sfp_email=&sfph_mail=
CVE ID: CVE-2023-2564 State: PUBLISHED Published: 2023-05-07T00:00:00.000Z Last Updated: 2025-01-29T15:37:39.011Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: sbs20 Products: sbs20/scanservjs Problem Types: CWE-78 Description: OS Command Injection in GitHub repository sbs20/scanservjs prior to v2.27.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/d13113ad-a107-416b-acc1-01e4c16ec461 - https://github.com/sbs20/scanservjs/pull/606/commits/d51fd52c1569813990b8f74e64ae6979c665dca1
CVE ID: CVE-2023-2565 State: PUBLISHED Published: 2023-05-07T15:00:04.944Z Last Updated: 2024-08-02T06:26:09.839Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Multi Language Hotel Management Software Problem Types: CWE-79 Description: A vulnerability has been found in SourceCodester Multi Language Hotel Management Software 1.0 and classified as problematic. This vulnerability affects unknown code of the file ajax.php of the component POST Parameter Handler. The manipulation of the argument complaint_type with the input <script>alert(document.cookie)</script> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclo
cument.cookie)</script> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228172. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.228172 - https://vuldb.com/?ctiid.228172 - https://github.com/admin-passwd/bug_report/blob/main/XSS-1.md
CVE ID: CVE-2023-2566 State: PUBLISHED Published: 2023-05-08T00:00:00.000Z Last Updated: 2025-01-29T17:10:05.338Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L) Vendors: openemr Products: openemr/openemr Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/47d6fc2a-989a-44eb-9cb7-ab4f8bd44496 - https://github.com/openemr/openemr/commit/a2adac7320dfc631b1da688c3b04f54b8240fc7b
CVE ID: CVE-2023-2567 State: PUBLISHED Published: 2023-09-19T10:03:04.013Z Last Updated: 2025-02-27T20:49:49.077Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Nozomi Networks Products: Guardian, CMC Problem Types: CWE-89 Description: A SQL Injection vulnerability has been found in Nozomi Networks Guardian and CMC, due to improper input validation in certain parameters used in the Query functionality. Authenticated users may be able to execute arbitrary SQL statements on the DBMS used by the web application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.nozominetworks.com/NN-2023:9-01
CVE ID: CVE-2023-2568 State: PUBLISHED Published: 2023-06-12T17:28:23.093Z Last Updated: 2025-01-03T14:48:52.092Z Vendors: Unknown Products: Photo Gallery by Ays Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Photo Gallery by Ays WordPress plugin before 5.1.7 does not escape some parameters before outputting it back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b1704a12-459b-4f5d-aa2d-a96646ddaf3e
CVE ID: CVE-2023-2569 State: PUBLISHED Published: 2023-06-14T07:50:11.254Z Last Updated: 2025-01-02T20:41:44.275Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure Foxboro DCS Control Core Services Problem Types: CWE-787 Description: A CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, elevation of privilege, and potentially kernel execution when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.c
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-164-04.pdf