Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-46776 State: PUBLISHED Published: 2023-11-06T11:01:44.149Z Last Updated: 2024-09-05T15:40:25.846Z Vendors: Serena Villa Products: Auto Excerpt everywhere Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Serena Villa Auto Excerpt everywhere plugin <= 1.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/auto-excerpt-everywhere/wordpress-auto-excerpt-everywhere-plugin-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-46777 State: PUBLISHED Published: 2023-11-06T11:06:58.471Z Last Updated: 2024-09-05T15:40:49.657Z Products: Custom Login Page | Temporary Users | Rebrand Login | Login Captcha Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Custom Login Page | Temporary Users | Rebrand Login | Login Captcha plugin <= 1.1.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/feather-login-page/wordpress-feather-login-page-plugin-1-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-46778 State: PUBLISHED Published: 2023-11-06T11:09:48.475Z Last Updated: 2024-09-05T15:41:08.366Z Vendors: TheFreeWindows Products: Auto Limit Posts Reloaded Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in TheFreeWindows Auto Limit Posts Reloaded plugin <= 2.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/auto-limit-posts-reloaded/wordpress-auto-limit-posts-reloaded-plugin-2-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-46779 State: PUBLISHED Published: 2023-11-06T11:13:10.968Z Last Updated: 2024-09-05T13:59:36.078Z Vendors: EasyRecipe Products: EasyRecipe Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in EasyRecipe plugin <= 3.5.3251 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/easyrecipe/wordpress-easyrecipe-plugin-3-5-3251-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-46780 State: PUBLISHED Published: 2023-11-06T11:15:41.713Z Last Updated: 2024-09-05T13:57:14.672Z Vendors: Alter Products: Alter Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Alter plugin <= 1.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/alter/wordpress-alter-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-46781 State: PUBLISHED Published: 2023-11-06T11:19:15.106Z Last Updated: 2024-09-05T13:55:58.567Z Vendors: Roland Murg Products: Current Menu Item for Custom Post Types Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Roland Murg Current Menu Item for Custom Post Types plugin <= 1.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/current-menu-item-for-custom-post-types/wordpress-current-menu-item-for-custom-post-types-plugin-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-46782 State: PUBLISHED Published: 2023-11-06T09:20:12.383Z Last Updated: 2024-10-29T18:41:54.380Z Vendors: Chris Yee Products: MomentoPress for Momento360 Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Chris Yee MomentoPress for Momento360 plugin <= 1.0.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/cmyee-momentopress/wordpress-momentopress-for-momento360-plugin-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-46783 State: PUBLISHED Published: 2023-11-06T09:26:18.101Z Last Updated: 2024-10-29T18:46:04.742Z Vendors: Bright Plugins Products: Pre-Orders for WooCommerce Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Bright Plugins Pre-Orders for WooCommerce plugin <= 1.2.13 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/pre-orders-for-woocommerce/wordpress-pre-orders-for-woocommerce-plugin-1-2-13-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-46784 State: PUBLISHED Published: 2024-05-17T08:34:45.996Z Last Updated: 2024-08-02T20:53:21.399Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Room 34 Creative Services, LLC Products: ICS Calendar Problem Types: CWE-22, CWE-918 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Server-Side Request Forgery (SSRF) vulnerability in Room 34 Creative Services, LLC ICS Calendar ics-calendar allows Absolute Path Traversal, : Server Side Request Forgery.This issue affects ICS Calendar: from n/a through 10.12.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https
m n/a through 10.12.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ics-calendar/wordpress-ics-calendar-plugin-10-12-0-2-ssrf-and-arbitrary-file-read-vulnerability?_s_id=cve
CVE ID: CVE-2023-46785 State: PUBLISHED Published: 2023-11-07T20:57:55.764Z Last Updated: 2024-09-17T13:31:25.770Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Matrimonial Project Problem Types: CWE-89 Description: Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the partner_preference.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/ros - https://projectworl
Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/ros - https://projectworlds.in
CVE ID: CVE-2023-46786 State: REJECTED Published: 2023-11-07T20:58:52.616Z Last Updated: 2024-01-02T21:19:29.846Z Description: No description available.
CVE ID: CVE-2023-46787 State: PUBLISHED Published: 2023-11-07T20:59:34.528Z Last Updated: 2024-09-17T13:30:48.913Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Matrimonial Project Problem Types: CWE-89 Description: Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the auth/auth.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/ros - https://projectworlds.
ogram Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/ros - https://projectworlds.in
CVE ID: CVE-2023-46788 State: PUBLISHED Published: 2023-11-07T21:01:11.340Z Last Updated: 2024-09-17T13:06:16.599Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Matrimonial Project Problem Types: CWE-89 Description: Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter in the 'uploadphoto()' function of the functions.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/ro
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/ros - https://projectworlds.in
CVE ID: CVE-2023-46789 State: PUBLISHED Published: 2023-11-07T21:02:14.461Z Last Updated: 2024-09-17T13:05:41.498Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Matrimonial Project Problem Types: CWE-89 Description: Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'filename' attribute of the 'pic1' multipart parameter of the functions.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advis
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/ros - https://projectworlds.in
CVE ID: CVE-2023-46790 State: REJECTED Published: 2023-11-07T21:07:13.183Z Last Updated: 2024-01-02T21:20:55.370Z Description: No description available.
CVE ID: CVE-2023-46791 State: REJECTED Published: 2023-12-21T20:05:29.034Z Last Updated: 2024-01-02T21:22:01.034Z Description: No description available.
CVE ID: CVE-2023-46792 State: REJECTED Published: 2023-11-07T21:09:27.814Z Last Updated: 2024-01-02T21:22:51.742Z Description: No description available.
CVE ID: CVE-2023-46793 State: PUBLISHED Published: 2023-11-07T21:10:20.104Z Last Updated: 2024-09-17T13:04:39.293Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Matrimonial Project Problem Types: CWE-89 Description: Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'day' parameter in the 'register()' function of the functions.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/ros
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/ros - https://projectworlds.in
CVE ID: CVE-2023-46794 State: REJECTED Published: 2023-11-07T21:13:26.794Z Last Updated: 2024-01-02T21:29:34.175Z Description: No description available.
CVE ID: CVE-2023-46795 State: REJECTED Published: 2023-11-07T21:14:14.700Z Last Updated: 2024-01-02T21:30:55.489Z Description: No description available.
CVE ID: CVE-2023-46796 State: REJECTED Published: 2023-11-07T21:15:22.837Z Last Updated: 2024-01-02T21:31:57.915Z Description: No description available.
CVE ID: CVE-2023-46797 State: REJECTED Published: 2023-11-07T21:16:02.669Z Last Updated: 2024-01-02T21:32:53.481Z Description: No description available.
CVE ID: CVE-2023-46798 State: REJECTED Published: 2023-11-07T21:17:05.602Z Last Updated: 2024-01-02T21:33:46.389Z Description: No description available.
CVE ID: CVE-2023-46799 State: REJECTED Published: 2023-11-07T21:17:47.748Z Last Updated: 2024-01-02T21:34:47.944Z Description: No description available.
CVE ID: CVE-2023-46800 State: PUBLISHED Published: 2023-11-07T21:19:21.672Z Last Updated: 2024-09-04T15:37:42.963Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Matrimonial Project Problem Types: CWE-89 Description: Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the view_profile.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/ros - https://projectworlds.in
CVE ID: CVE-2023-46801 State: PUBLISHED Published: 2024-07-15T07:55:29.702Z Last Updated: 2024-09-13T17:03:56.293Z Vendors: Apache Software Foundation Products: Apache Linkis DataSource Problem Types: CWE-502 Description: In Apache Linkis <= 1.5.0, data source management module, when adding Mysql data source, exists remote code execution vulnerability for java version < 1.8.0_241. The deserialization vulnerability exploited through jrmp can inject malicious files into the server and execute them. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. We recommend that users upgrade the java version to >= 1.8.0_241. Or users upgrade Linkis
before it can be carried out. We recommend that users upgrade the java version to >= 1.8.0_241. Or users upgrade Linkis to version 1.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/0dnzh64xy1n7qo3rgo2loz9zn7m9xgdx
CVE ID: CVE-2023-46802 State: PUBLISHED Published: 2023-11-06T01:25:12.005Z Last Updated: 2024-10-29T19:03:40.085Z Vendors: National Tax Agency Products: e-Tax software Problem Types: XML external entities (XXE) Description: e-Tax software Version3.0.10 and earlier improperly restricts XML external entity references (XXE) due to the configuration of the embedded XML parser. By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.e-tax.nta.go.jp/topics/topics_20231102.htm - https://jvn.jp/en/jp/JVN14762986/
CVE ID: CVE-2023-46803 State: PUBLISHED Published: 2023-12-19T15:43:26.341Z Last Updated: 2024-08-02T20:53:21.704Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Avalanche Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS). Additional Analyst Notes: - CVE Program Container: References: - https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE ID: CVE-2023-46804 State: PUBLISHED Published: 2023-12-19T15:43:26.303Z Last Updated: 2024-08-02T20:53:21.877Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Avalanche Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS). Additional Analyst Notes: - CVE Program Container: References: - https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE ID: CVE-2023-46805 State: PUBLISHED Published: 2024-01-12T17:02:16.452Z Last Updated: 2025-10-21T23:05:28.857Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Ivanti Products: ICS, IPS Description: An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US -
ion-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US - http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html
CVE ID: CVE-2023-46806 State: PUBLISHED Published: 2024-05-22T22:55:11.232Z Last Updated: 2024-08-02T20:53:21.862Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: Ivanti Products: EPMM Description: An SQL Injection vulnerability in a web component of EPMM versions before 12.1.0.0 allows an authenticated user with appropriate privilege to access or modify data in the underlying database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPMM-May-2024?language=en_US
CVE ID: CVE-2023-46807 State: PUBLISHED Published: 2024-05-22T22:55:11.221Z Last Updated: 2024-08-02T20:53:21.866Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: Ivanti Products: EPMM Description: An SQL Injection vulnerability in web component of EPMM before 12.1.0.0 allows an authenticated user with appropriate privilege to access or modify data in the underlying database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPMM-May-2024?language=en_US
CVE ID: CVE-2023-46808 State: PUBLISHED Published: 2024-03-31T01:45:43.264Z Last Updated: 2024-08-02T20:53:21.657Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: ITSM Description: An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Successful exploitation may lead to execution of commands in the context of non-root user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/SA-CVE-2023-46808-Authenticated-Remote-File-Write-for-Ivanti-Neurons-for-ITSM
CVE ID: CVE-2023-46809 State: PUBLISHED Published: 2024-09-07T16:03:32.996Z Last Updated: 2025-11-04T18:18:49.086Z Vendors: NodeJS Products: Node Description: Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/february-2024-security-releases
CVE ID: CVE-2023-46810 State: PUBLISHED Published: 2024-05-31T17:38:31.425Z Last Updated: 2025-03-13T21:14:08.463Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Secure Access Linux Description: A local privilege escalation vulnerability in Ivanti Secure Access Client for Linux before 22.7R1, allows a low privileged user to execute code as root. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Advisory-May-2024
CVE ID: CVE-2023-46813 State: PUBLISHED Published: 2023-10-27T00:00:00 Last Updated: 2024-08-02T20:53:21.700Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.co
fore the #VC handler reads it. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1212649 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=63e44bc52047f182601e7817da969a105aa1f721 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b9cb9c45583b911e0db71d09caa6b56469eb2bdf - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a37cd2a59d0cb270b1bba568fd3a3b8668b9d3ba - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.9 - https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html
CVE ID: CVE-2023-46814 State: PUBLISHED Published: 2023-11-22T00:00:00 Last Updated: 2024-08-29T19:59:01.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: A binary hijacking vulnerability exists within the VideoLAN VLC media player before 3.0.19 on Windows. The uninstaller attempts to execute code with elevated privileges out of a standard user writable location. Standard users may use this to gain arbitrary code execution as SYSTEM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.videolan.org/security/sb-vlc3019.html
CVE ID: CVE-2023-46815 State: PUBLISHED Published: 2023-10-27T00:00:00 Last Updated: 2024-09-09T16:04:44.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. An Unrestricted File Upload vulnerability has been identified in the Notes module. By using a crafted request, custom PHP code can be injected via the Notes module because of missing input validation. An attacker with regular user privileges can exploit this. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-011/
CVE ID: CVE-2023-46816 State: PUBLISHED Published: 2023-10-27T00:00:00 Last Updated: 2024-09-09T16:01:32.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulnerability has been identified in the GecControl action. By using a crafted request, custom PHP code can be injected via the GetControl action because of missing input validation. An attacker with regular user privileges can exploit this. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-010/
CVE ID: CVE-2023-46817 State: PUBLISHED Published: 2023-11-03T00:00:00 Last Updated: 2024-09-06T13:48:48.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in phpFox before 4.8.14. The url request parameter passed to the /core/redirect route is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by remote, unauthenticated attackers to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as executing arbitrary PHP code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.phpfox.com/blog/ - http://
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.phpfox.com/blog/ - http://seclists.org/fulldisclosure/2023/Oct/30 - https://karmainsecurity.com/pocs/CVE-2023-46817.php - https://karmainsecurity.com/KIS-2023-12 - https://docs.phpfox.com/display/FOX4MAN/phpFox+4.8.14
CVE ID: CVE-2023-46818 State: PUBLISHED Published: 2023-10-27T00:00:00 Last Updated: 2024-10-11T17:06:17.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ispconfig.org/blog/ispconfig-3-2-11p1-released/ - http://packetstormsecurity.com/files/176126/ISPConfig-3.2.11-PHP-Code-Injection.html - http://seclists.org/fulldisclosure/2023/Dec/2
CVE ID: CVE-2023-46819 State: PUBLISHED Published: 2023-11-07T11:02:03.305Z Last Updated: 2024-09-04T19:09:30.869Z Vendors: Apache Software Foundation Products: Apache OFBiz Problem Types: CWE-306 Description: Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This issue affects Apache OFBiz: before 18.12.09. Users are recommended to upgrade to version 18.12.09 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ofbiz.apache.org/download.html - https://ofbiz.apache.org/security.html - https://ofbiz.apache.org/release-notes-18.12.09.html - https://lists.apache.org/thread/mm5j0rsbl22q7yb0nmb6h2swbfjbwv99