Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ons up to, and including, 3.8.2. This makes it possible for authenticated attackers with subscriber privileges or above, to delete plugin settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5fa2ec9e-2859-4a96-9e33-9e22d37e544f?source=cve - https://plugins.trac.wordpress.org/browser/embedpress/tags/3.8.2/EmbedPress/ThirdParty/Googlecalendar/Embedpress_Google_Helper.php#L807 - https://plugins.trac.wordpress.org/browser/embedpress/tags/3.8.2/EmbedPress/ThirdParty/Googlecalendar/Embedpress_Google_Helper.php#L801 - https://plugins.trac.wordpress.org/changeset/2950211/embedpress#file18
CVE ID: CVE-2023-4283 State: PUBLISHED Published: 2023-08-10T11:05:43.454Z Last Updated: 2025-02-05T19:36:18.146Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The EmbedPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embedpress_calendar' shortcode in versions up to, and including, 3.8.2 due to insufficient input sanitization and output escaping on user supplied attri
n versions up to, and including, 3.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b340eda1-e9d2-40b6-89f9-41d995ce3555?source=cve - https://plugins.trac.wordpress.org/browser/embedpress/tags/3.8.2/EmbedPress/ThirdParty/Googlecalendar/Embedpress_Google_Helper.php#L522 - https://plugins.trac.wordpress.org/chan
s/3.8.2/EmbedPress/ThirdParty/Googlecalendar/Embedpress_Google_Helper.php#L522 - https://plugins.trac.wordpress.org/changeset/2950211/embedpress#file18
CVE ID: CVE-2023-4284 State: PUBLISHED Published: 2023-09-04T11:26:59.291Z Last Updated: 2025-03-06T16:04:28.427Z Vendors: Unknown Products: Post Timeline Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Post Timeline WordPress plugin before 2.2.6 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1c126869-0afa-456f-94cc-10334964e5f9
CVE ID: CVE-2023-4289 State: PUBLISHED Published: 2023-10-16T19:39:24.537Z Last Updated: 2025-04-23T16:11:08.186Z Vendors: Unknown Products: WP Matterport Shortcode Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Matterport Shortcode WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/38c337c6-048f-4009-aef8-29c18afa6fdc
CVE ID: CVE-2023-4290 State: PUBLISHED Published: 2023-10-16T19:22:43.516Z Last Updated: 2025-04-23T16:15:02.884Z Vendors: Unknown Products: WP Matterport Shortcode Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHP_SELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5fad5245-a089-4ba3-9958-1e2c3d066eea
CVE ID: CVE-2023-4291 State: PUBLISHED Published: 2023-09-21T06:17:57.646Z Last Updated: 2024-09-24T16:16:55.237Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Frauscher Products: FDS101 for FAdC/FAdCi Problem Types: CWE-94 Description: Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a remote code execution (RCE) vulnerability via manipulated parameters of the web interface without authentication. This could lead to a full compromise of the FDS101 device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2023-038
CVE ID: CVE-2023-4292 State: PUBLISHED Published: 2023-09-21T06:18:43.430Z Last Updated: 2024-09-24T18:18:27.494Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Frauscher Products: FDS101 for FAdC/FAdCi Problem Types: CWE-89 Description: Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a SQL injection vulnerability via manipulated parameters of the web interface without authentication. The database contains limited, non-critical log information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://https://cert.vde.com/en/advisories/VDE-2023-038
CVE ID: CVE-2023-4293 State: PUBLISHED Published: 2023-08-12T07:42:51.694Z Last Updated: 2025-02-05T19:36:11.383Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: codename065 Products: Premium Packages – Sell Digital Products Securely Problem Types: CWE-269 Improper Privilege Management Description: The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.4 due to insufficient restriction on the 'wpdmpp_update_profile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the
for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'profile[role]' parameter during a profile update. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/82137302-60ca-44d5-b087-dc96e2815fca?source=cve - https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/5.7.4/wpdm-premium-packages.php#L1158 - https://plugins.trac.wordpress.org/changeset/2951917/wpdm-premium-packages#file5
CVE ID: CVE-2023-4294 State: PUBLISHED Published: 2023-09-11T19:46:09.500Z Last Updated: 2025-05-02T17:40:10.398Z Vendors: Unknown Products: URL Shortify Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1fc71fc7-861a-46cc-a147-1c7ece9a7776
CVE ID: CVE-2023-4295 State: PUBLISHED Published: 2023-11-07T15:42:15.584Z Last Updated: 2025-03-24T15:15:33.259Z Vendors: Arm Ltd Products: Valhall GPU Kernel Driver, Arm 5th Gen GPU Architecture Kernel Driver Problem Types: CWE-190, CWE-416 Description: A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities - http://packetstormsecurity.com/files/176109/Arm-Mali-CSF-Overflow-Use-After-Free.html
CVE ID: CVE-2023-4296 State: PUBLISHED Published: 2023-08-29T21:42:48.880Z Last Updated: 2025-02-13T17:13:13.160Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: PTC Products: Codebeamer Problem Types: CWE-79 Description: ​If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-241-01 - https://codebeamer.com/cb/wiki/31346480 - http://seclists.org/fulldisclosure/2023/Sep/10 - http://
ries/icsa-23-241-01 - https://codebeamer.com/cb/wiki/31346480 - http://seclists.org/fulldisclosure/2023/Sep/10 - http://packetstormsecurity.com/files/174703/PTC-Codebeamer-Cross-Site-Scripting.html
CVE ID: CVE-2023-4297 State: PUBLISHED Published: 2023-11-27T16:22:01.657Z Last Updated: 2025-06-05T14:01:19.686Z Vendors: Unknown Products: Mmm Simple File List Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Mmm Simple File List WordPress plugin through 2.3 does not validate the generated path to list files from, allowing any authenticated users, such as subscribers, to list the content of arbitrary directories. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/9ff85b06-819c-459e-90a9-6151bfd70978
CVE ID: CVE-2023-4298 State: PUBLISHED Published: 2023-09-04T11:27:04.835Z Last Updated: 2025-04-23T16:17:34.839Z Vendors: Unknown Products: 123.chat Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The 123.chat WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/36285052-8464-4fd6-b4b1-c175e730edad
CVE ID: CVE-2023-4299 State: PUBLISHED Published: 2023-08-31T20:45:43.866Z Last Updated: 2025-01-16T21:30:37.810Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Digi International Products: Digi RealPort, Digi ConnectPort TS 8/16, Digi Passport Console Server, Digi ConnectPort LTS 8/16/32, Digi CM Console Server, Digi PortServer TS, Digi PortServer TS MEI, Digi PortServer TS MEI Hardened, Digi PortServer TS M MEI, Digi PortServer TS P MEI, Digi One IAP Family, Digi One IA, Digi One SP IA, ​Digi One SP, Digi WR31, Digi WR11 XT, Digi WR44 R, Digi WR21, Digi Connect ES, Digi Connect SP, Digi 6350-SR, Digi ConnectCore 8X products Problem Types: CWE-836 Descript
Digi WR21, Digi Connect ES, Digi Connect SP, Digi 6350-SR, Digi ConnectCore 8X products Problem Types: CWE-836 Description: Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-04 - https://www.digi.com/getattachment/resources/security/alerts/realport-cves/Dragos-Disclosure-Statement.pdf
CVE ID: CVE-2023-4300 State: PUBLISHED Published: 2023-09-25T15:56:51.782Z Last Updated: 2025-04-23T16:16:07.209Z Vendors: Unknown Products: Import XML and RSS Feeds Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The Import XML and RSS Feeds WordPress plugin before 2.1.4 does not filter file extensions for uploaded files, allowing an attacker to upload a malicious PHP file, leading to Remote Code Execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d4220025-2272-4d5f-9703-4b2ac4a51c42
CVE ID: CVE-2023-4301 State: PUBLISHED Published: 2023-08-21T22:34:37.786Z Last Updated: 2024-10-01T17:51:15.079Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Jenkins Project Products: Jenkins Fortify Plugin Problem Types: CWE-352 Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY
Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3115
CVE ID: CVE-2023-4302 State: PUBLISHED Published: 2023-08-21T22:34:30.865Z Last Updated: 2024-10-01T17:51:46.341Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Jenkins Project Products: Jenkins Fortify Plugin Problem Types: CWE-862 Description: A missing permission check in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-08-16/#SE
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3115
CVE ID: CVE-2023-4303 State: PUBLISHED Published: 2023-08-21T22:34:20.563Z Last Updated: 2024-10-01T17:52:02.060Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Jenkins Project Products: Jenkins Fortify Plugin Problem Types: CWE-79 Description: Jenkins Fortify Plugin 22.1.38 and earlier does not escape the error message for a form validation method, resulting in an HTML injection vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3140
CVE ID: CVE-2023-4304 State: PUBLISHED Published: 2023-08-11T00:00:20.247Z Last Updated: 2024-10-04T13:06:39.118Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: froxlor Products: froxlor/froxlor Problem Types: CWE-840 Description: Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/59fe5037-b253-4b0f-be69-1d2e4af8b4a9 - https://github.com/froxlor/froxlor/commit/ce9a5f97a3edb30c7d33878765d3c014a6583597
CVE ID: CVE-2023-4307 State: PUBLISHED Published: 2023-09-11T19:46:04.810Z Last Updated: 2025-04-23T16:17:14.149Z Vendors: Unknown Products: Lock User Account Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Lock User Account WordPress plugin through 1.0.3 does not have CSRF check when bulk locking and unlocking accounts, which could allow attackers to make logged in admins lock and unlock arbitrary users via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/06f7aa45-b5d0-4afb-95cc-8f1c82f6f8b3
CVE ID: CVE-2023-4308 State: PUBLISHED Published: 2023-08-15T07:32:37.094Z Last Updated: 2025-03-04T19:39:54.976Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: specialk Products: User Submitted Posts – Enable Users to Submit Posts from the Front End Problem Types: CWE-79 Description: The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user-submitted-content’ parameter in versions up to, and including, 20230809 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an inje
or unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3bb4d37c-c4c2-4523-9b4e-73ffb7be81ea?source=cve - https://plugins.trac.wordpress.org/changeset/2952471/user-submitted-posts
CVE ID: CVE-2023-4309 State: PUBLISHED Published: 2023-10-10T17:27:25.515Z Last Updated: 2024-09-18T18:52:15.809Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Election Services Co. (ESC) Products: Internet Election Service Problem Types: CWE-89 Description: Election Services Co. (ESC) Internet Election Service is vulnerable to SQL injection in multiple pages and parameters. These vulnerabilities allow an unauthenticated, remote attacker to read or modify data for any elections that share the same backend database. ESC deactivated older and unused elections and enabled web application firewall (WAF) protection for current and future elections on or around
and unused elections and enabled web application firewall (WAF) protection for current and future elections on or around 2023-08-12. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://schemasecurity.co/private-elections.pdf - https://www.youtube.com/watch?v=yeG1xZkHc64 - https://www.electionservicesco.com/pages/services_internet.php
CVE ID: CVE-2023-4310 State: PUBLISHED Published: 2023-09-05T20:15:57.824Z Last Updated: 2024-10-01T14:58:14.818Z Vendors: BeyondTrust Products: Privileged Remote Access (PRA), Remote Support (RS) Problem Types: CWE-77 Description: BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions 23.2.1 and 23.2.2 contain a command injection vulnerability which can be exploited through a malicious HTTP request. Successful exploitation of this vulnerability can allow an unauthenticated remote attacker to execute underlying operating system commands within the context of the site user. This issue is fixed in version 23.2.3. Additional Analyst Notes: - CVE Program Container: - CISA AD
xt of the site user. This issue is fixed in version 23.2.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.beyondtrust.com/blog/entry/security-update-for-remote-support-and-privileged-remote-access - https://beyondtrustcorp.service-now.com/csm?id=kb_article_view&sysparm_article=KB0020207
CVE ID: CVE-2023-4311 State: PUBLISHED Published: 2023-12-18T20:07:58.353Z Last Updated: 2024-08-02T07:24:04.887Z Vendors: Unknown Products: Vrm 360 3D Model Viewer Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 is vulnerable to arbitrary file upload due to insufficient checks in a plugin shortcode. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/21950116-1a69-4848-9da0-e912096c0fce
CVE ID: CVE-2023-4314 State: PUBLISHED Published: 2023-09-11T19:46:06.952Z Last Updated: 2025-04-23T16:16:49.088Z Vendors: Unknown Products: wpDataTables Problem Types: CWE-502 Deserialization of Untrusted Data Description: The wpDataTables WordPress plugin before 2.1.66 does not validate the "Serialized PHP array" input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable gadget chain is present on the server. This is impactful in environments where admin users should not be allowed to execute arbitrary code, such as multisite. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Ref
ecute arbitrary code, such as multisite. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1ab192d7-72ac-4f12-8a51-f28ee4db91bc
CVE ID: CVE-2023-4315 State: PUBLISHED Published: 2023-08-31T05:33:09.002Z Last Updated: 2025-02-05T19:33:31.138Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: mehulkaklotar Products: Woo Custom Emails Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Woo Custom Emails for WordPress is vulnerable to Reflected Cross-Site Scripting via the wcemails_edit parameter in versions up to, and including, 2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfu
es it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6782d8b3-32f9-42e1-874c-35a1e93ffde0?source=cve - https://plugins.trac.wordpress.org/browser/woo-custom-emails/trunk/admin/class-wcemails-admin.php#L335
CVE ID: CVE-2023-4316 State: PUBLISHED Published: 2023-09-28T20:34:09.161Z Last Updated: 2025-06-18T14:07:41.023Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Zod Products: Zod Problem Types: CWE-1333 Description: Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/swift - https://www.npmjs.com/package/zod
CVE ID: CVE-2023-4317 State: PUBLISHED Published: 2023-12-01T07:02:03.130Z Last Updated: 2025-11-20T04:09:33.265Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in GitLab affecting all versions starting from 9.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a user with the Developer role to update a pipeline schedule from an unprotected branch to a protected branch. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/421846 - http
tional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/421846 - https://hackerone.com/reports/2089517
CVE ID: CVE-2023-4318 State: PUBLISHED Published: 2023-09-11T19:46:05.630Z Last Updated: 2025-04-23T16:17:07.296Z Vendors: Unknown Products: Herd Effects Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Herd Effects WordPress plugin before 5.2.4 does not have CSRF when deleting its items, which could allow attackers to make logged in admins delete arbitrary effects via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/93b40030-3706-4063-bf59-4ec983afdbb6
CVE ID: CVE-2023-4319 State: REJECTED Published: N/A Last Updated: 2025-01-16T17:06:00.588Z Description: No description available.
CVE ID: CVE-2023-4320 State: PUBLISHED Published: 2023-12-18T13:43:07.747Z Last Updated: 2025-11-20T18:27:27.972Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: Red Hat Products: Red Hat Satellite 6.15 for RHEL 8 Problem Types: CWE-613 Description: An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage to the system's integrity. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:2010 - https://acce