Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-31181 State: PUBLISHED Published: 2023-05-08T00:00:00.000Z Last Updated: 2025-01-29T15:36:09.552Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: WJJ Software Products: InnoKB Server, InnoKB/Console Problem Types: CWE-22 Description: WJJ Software - InnoKB Server, InnoKB/Console 2.2.1 - CWE-22: Path Traversal Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2023-31182 State: PUBLISHED Published: 2023-05-08T00:00:00.000Z Last Updated: 2025-01-29T16:23:19.690Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: EasyTor Applications Products: EasyTor Applications Problem Types: CWE-639 Description: EasyTor Applications – Authorization Bypass - EasyTor Applications may allow authorization bypass via unspecified method. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2023-31183 State: PUBLISHED Published: 2023-05-08T00:00:00.000Z Last Updated: 2025-01-29T16:11:35.268Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Cybonet Products: PineApp Problem Types: CWE-79 Description: Cybonet PineApp Mail Secure A reflected cross-site scripting (XSS) vulnerability was identified in the product, using an unspecified endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2023-31184 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-13T19:53:19.153Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ROZCOM Products: client Problem Types: CWE-798 Description: ROZCOM client CWE-798: Use of Hard-coded Credentials Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2023-31185 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-10T21:16:49.961Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ROZCOM Products: server framework Problem Types: CWE-200 Description: ROZCOM server framework - Misconfiguration may allow information disclosure via an unspecified request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2023-31186 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-10T21:17:38.444Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Avaya Products: IX Workforce Engagement Problem Types: CWE-204 Description: Avaya IX Workforce Engagement v15.2.7.1195 - User Enumeration - Observable Response Discrepancy Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2023-31187 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-10T21:18:04.015Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Avaya Products: IX Workforce Engagement Problem Types: CWE-522 Description: Avaya IX Workforce Engagement v15.2.7.1195 - CWE-522: Insufficiently Protected Credentials Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2023-31188 State: PUBLISHED Published: 2023-09-06T09:28:18.168Z Last Updated: 2024-09-27T20:50:29.101Z Vendors: TP-LINK Products: Archer C50, Archer C55, Archer C20 Problem Types: OS command injection Description: Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer C50 firmware versions prior to 'Archer C50(JP)_V3_230505', Archer C55 firmware versions prior to 'Archer C55(JP)_V1_230506', and Archer C20 firmware versions prior to 'Archer C20(JP)_V1_230616'. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tp-link.com/jp/supp
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tp-link.com/jp/support/download/archer-c50/v3/#Firmware - https://www.tp-link.com/jp/support/download/archer-c55/#Firmware - https://www.tp-link.com/jp/support/download/archer-c20/v1/#Firmware - https://jvn.jp/en/vu/JVNVU99392903/
CVE ID: CVE-2023-31189 State: PUBLISHED Published: 2024-02-14T13:37:52.110Z Last Updated: 2024-08-14T19:22:35.437Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: n/a Products: Intel(R) Server Product OpenBMC firmware Problem Types: escalation of privilege, CWE-287 Description: Improper authentication in some Intel(R) Server Product OpenBMC firmware before version egs-1.09 may allow an authenticated user to enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00922.html
CVE ID: CVE-2023-31190 State: PUBLISHED Published: 2023-07-11T08:43:25.187Z Last Updated: 2024-11-12T16:21:44.644Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: bluemark Products: ds230 Problem Types: CWE-295 Description: DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an Improper Authentication vulnerability during the firmware update procedure. Specifically, the firmware update procedure ignores and does not check the validity of the TLS certificate of the HTTPS endpoint from which the firmware update package (.tar.bz2 file) is downloaded. An attacker with the ability to put himself in a Man-in-the-Middle situation (e.g., DNS p
(.tar.bz2 file) is downloaded. An attacker with the ability to put himself in a Man-in-the-Middle situation (e.g., DNS poisoning, ARP poisoning, control of a node on the route to the endpoint, etc.) can trick the DroneScout ds230 to install a crafted malicious firmware update containing arbitrary files (e.g., executable and configuration) and gain administrative (root) privileges on the underlying Linux operating system. This issue affects DroneScout ds230 firmware from version 20211210-1627 through 20230329-1042. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-31190/ - https://dow
P Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-31190/ - https://download.bluemark.io/dronescout/firmware/history.txt
CVE ID: CVE-2023-31191 State: PUBLISHED Published: 2023-07-11T08:45:14.541Z Last Updated: 2024-11-06T19:37:56.369Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) Vendors: bluemark Products: ds230 Problem Types: CWE-223 Description: DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection. An attacker can exploit this vulnerability by injecting, on carefully selected channels, high power spoofed Open Drone ID (ODID) messages which force the DroneScout ds230 Remote ID receiver to drop real Remote ID (RID) information and, instead, generate and transmit JSON encoded MQTT messages containi
eceiver to drop real Remote ID (RID) information and, instead, generate and transmit JSON encoded MQTT messages containing crafted RID information. Consequently, the MQTT broker, typically operated by a system integrator, will have no access to the drones’ real RID information. This issue affects the adjacent channel suppression algorithm present in DroneScout ds230 firmware from version 20211210-1627 through 20230329-1042. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-31191/ - https://download.bluemark.io/dronescout/firmware/history.txt
CVE ID: CVE-2023-31192 State: PUBLISHED Published: 2023-10-12T15:27:51.300Z Last Updated: 2025-11-04T19:15:58.051Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SoftEther VPN Products: SoftEther VPN Problem Types: CWE-457 Description: An information disclosure vulnerability exists in the ClientConnect() functionality of SoftEther VPN 5.01.9674. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2
VE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1768 - https://www.softether.org/9-about/News/904-SEVPN202301
CVE ID: CVE-2023-31193 State: PUBLISHED Published: 2023-05-22T19:28:43.975Z Last Updated: 2025-01-16T21:33:41.957Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Snap One Products: OvrC Cloud Problem Types: CWE-319 Description: Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. Because they do not use HTTPS, OvrC Pro devices are susceptible to exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01 - https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-
isories/icsa-23-136-01 - https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf
CVE ID: CVE-2023-31194 State: PUBLISHED Published: 2023-07-05T15:51:50.540Z Last Updated: 2025-11-04T19:15:59.169Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Diagon Products: Diagon Problem Types: CWE-119 Description: An improper array index validation vulnerability exists in the GraphPlanar::Write functionality of Diagon v1.0.139. A specially crafted markdown file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1745
CVE ID: CVE-2023-31195 State: PUBLISHED Published: 2023-06-13T00:00:00 Last Updated: 2025-01-03T19:39:32.883Z Vendors: ASUSTeK COMPUTER INC. Products: ASUS Router RT-AX3000 Problem Types: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute Description: ASUS Router RT-AX3000 Firmware versions prior to 3.0.0.4.388.23403 uses sensitive cookies without 'Secure' attribute. When an attacker is in a position to be able to mount a man-in-the-middle attack, and a user is tricked to log into the affected device through an unencrypted ('http') connection, the user's session may be hijacked. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.as
ay be hijacked. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.asus.com/networking-iot-servers/wifi-routers/asus-wifi-routers/rt-ax3000/helpdesk_bios/?model2Name=RT-AX3000 - https://jvn.jp/en/jp/JVN34232595/
CVE ID: CVE-2023-31196 State: PUBLISHED Published: 2023-06-13T00:00:00 Last Updated: 2025-01-03T19:37:10.541Z Vendors: Inaba Denki Sangyo Co., Ltd. Products: Wi-Fi AP UNIT Problem Types: Missing authentication for critical function Description: Missing authentication for critical function in Wi-Fi AP UNIT allows a remote unauthenticated attacker to obtain sensitive information of the affected products. Affected products and versions are as follows: AC-PD-WAPU v1.05_B04 and earlier, AC-PD-WAPUM v1.05_B04 and earlier, AC-PD-WAPU-P v1.05_B04P and earlier, AC-PD-WAPUM-P v1.05_B04P and earlier, AC-WAPU-300 v1.00_B07 and earlier, AC-WAPUM-300 v1.00_B07 and earlier, AC-WAPU-300-P v1.00_B07 and earl
04P and earlier, AC-WAPU-300 v1.00_B07 and earlier, AC-WAPUM-300 v1.00_B07 and earlier, AC-WAPU-300-P v1.00_B07 and earlier, and AC-WAPUM-300-P v1.00_B07 and earlier Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/jp/JVN28412757/ - https://www.inaba.co.jp/abaniact/news/Wi-Fi_AP_UNIT%E3%81%AB%E3%81%8A%E3%81%91%E3%82%8B%E8%A4%87%E6%95%B0%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6.pdf
CVE ID: CVE-2023-31197 State: PUBLISHED Published: 2023-05-12T14:01:46.385Z Last Updated: 2025-01-24T16:46:07.912Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Trace Analyzer and Collector Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path in the Intel(R) Trace Analyzer and Collector before version 2020 update 3 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00475.html
CVE ID: CVE-2023-31198 State: PUBLISHED Published: 2023-06-13T00:00:00 Last Updated: 2025-01-03T19:34:21.883Z Vendors: Inaba Denki Sangyo Co., Ltd. Products: Wi-Fi AP UNIT Problem Types: OS Command Injection Description: OS command injection vulnerability exists in Wi-Fi AP UNIT allows. If this vulnerability is exploited, a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command. Affected products and versions are as follows: AC-PD-WAPU v1.05_B04 and earlier, AC-PD-WAPUM v1.05_B04 and earlier, AC-PD-WAPU-P v1.05_B04P and earlier, AC-PD-WAPUM-P v1.05_B04P and earlier, AC-WAPU-300 v1.00_B07 and earlier, AC-WAPUM-300 v1.00_B07 and earlier, AC-WAPU-300-P
-PD-WAPUM-P v1.05_B04P and earlier, AC-WAPU-300 v1.00_B07 and earlier, AC-WAPUM-300 v1.00_B07 and earlier, AC-WAPU-300-P v1.00_B07 and earlier, and AC-WAPUM-300-P v1.00_B07 and earlier Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/jp/JVN28412757/ - https://www.inaba.co.jp/abaniact/news/Wi-Fi_AP_UNIT%E3%81%AB%E3%81%8A%E3%81%91%E3%82%8B%E8%A4%87%E6%95%B0%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6.pdf
CVE ID: CVE-2023-31199 State: PUBLISHED Published: 2023-05-12T14:01:48.147Z Last Updated: 2025-01-24T16:44:36.673Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Solid State Drive Toolbox(TM) Problem Types: escalation of privilege, CWE-284 Description: Improper access control in the Intel(R) Solid State Drive Toolbox(TM) before version 3.4.5 may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00074.html
CVE ID: CVE-2023-31200 State: PUBLISHED Published: 2023-06-07T21:52:29.300Z Last Updated: 2025-01-06T20:57:59.055Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: PTC Products: Vuforia Studio Problem Types: CWE-352 Description: PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13
CVE ID: CVE-2023-31203 State: PUBLISHED Published: 2023-11-14T19:04:59.771Z Last Updated: 2024-08-14T20:08:49.658Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: n/a Products: OpenVINO Model Server software Problem Types: denial of service, CWE-20 Description: Improper input validation in some OpenVINO Model Server software before version 2022.3 for Intel Distribution of OpenVINO toolkit may allow an unauthenticated user to potentially enable denial of service via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00901.html
CVE ID: CVE-2023-31206 State: PUBLISHED Published: 2023-05-22T13:58:19.083Z Last Updated: 2024-10-11T13:50:02.517Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-668 Description: Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers can change the immutable name and type of nodes of InLong. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick [1] to solve it. [1] https://cveprocess.apache.org/cve5/[1]%C2%A0https://github.com/apache/inlong/pull/7891 https://github.com/apache/inlong/pull/7891 https://github.com/apache/inlong/pull/7891 Ad
hub.com/apache/inlong/pull/7891 https://github.com/apache/inlong/pull/7891 https://github.com/apache/inlong/pull/7891 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/qb7zffo785wzpmsobjqcypodngw6kg6x
CVE ID: CVE-2023-31207 State: PUBLISHED Published: 2023-05-02T08:52:31.629Z Last Updated: 2025-01-30T14:18:33.648Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Tribe29 Products: Checkmk Problem Types: CWE-532 Description: Transmission of credentials within query parameters in Checkmk <= 2.1.0p26, <= 2.0.0p35, and <= 2.2.0b6 (beta) may cause the automation user's secret to be written to the site Apache access log. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/15189
CVE ID: CVE-2023-31208 State: PUBLISHED Published: 2023-05-17T08:24:59.173Z Last Updated: 2025-01-21T21:07:58.592Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-140 Description: Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8 (beta) allows arbitrary livestatus command execution for authorized users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/15191
CVE ID: CVE-2023-31209 State: PUBLISHED Published: 2023-08-10T08:14:12.067Z Last Updated: 2024-08-28T20:24:16.728Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-78 Description: Improper neutralization of active check command arguments in Checkmk < 2.1.0p32, < 2.0.0p38, < 2.2.0p4 leads to arbitrary command execution for authenticated users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/15194
CVE ID: CVE-2023-31210 State: PUBLISHED Published: 2023-12-13T08:26:46.452Z Last Updated: 2024-12-02T14:29:06.806Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-427 Description: Usage of user controlled LD_LIBRARY_PATH in agent in Checkmk 2.2.0p10 up to 2.2.0p16 allows malicious Checkmk site user to escalate rights via injection of malicious libraries Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/16226
CVE ID: CVE-2023-31211 State: PUBLISHED Published: 2024-01-12T07:49:45.294Z Last Updated: 2025-06-17T21:09:17.486Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-303 Description: Insufficient authentication flow in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows attacker to use locked credentials Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/16227
CVE ID: CVE-2023-31212 State: PUBLISHED Published: 2023-10-31T14:04:43.692Z Last Updated: 2024-09-06T17:59:14.599Z Vendors: CRM Perks Products: Database for Contact Form 7, WPforms, Elementor forms Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Database for Contact Form 7, WPforms, Elementor forms contact-form-entries allows SQL Injection.This issue affects Database for Contact Form 7, WPforms, Elementor forms: from n/a through 1.3.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/contact-form-entries/word
ontainer: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/contact-form-entries/wordpress-contact-form-entries-plugin-1-3-0-auth-sql-injection-sqli-vulnerability?_s_id=cve
CVE ID: CVE-2023-31213 State: PUBLISHED Published: 2023-06-22T10:05:58.652Z Last Updated: 2024-10-10T17:25:00.426Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPBakery Products: WPBakery Page Builder Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WPBakery Page Builder plugin <= 6.13.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/js_composer/wordpress-wpbakery-page-builder-plugin-6-13-0-contributor-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-31214 State: PUBLISHED Published: 2024-12-09T11:30:59.379Z Last Updated: 2024-12-09T13:49:56.336Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Arul Prasad J Products: WP Quick Post Duplicator Problem Types: CWE-862 Description: Missing Authorization vulnerability in Arul Prasad J WP Quick Post Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Quick Post Duplicator: from n/a through 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-quick-post-duplicator/vulnerability/wordpress-wp-quick-post-duplicator-plugin-1-0-br
ck.com/database/wordpress/plugin/wp-quick-post-duplicator/vulnerability/wordpress-wp-quick-post-duplicator-plugin-1-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-31215 State: PUBLISHED Published: 2023-12-20T18:59:55.326Z Last Updated: 2024-11-20T20:20:51.967Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: AmaderCode Lab Products: Dropshipping & Affiliation with Amazon Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in AmaderCode Lab Dropshipping & Affiliation with Amazon.This issue affects Dropshipping & Affiliation with Amazon: from n/a through 2.1.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-amazon-shop/wordpress-dropshipping-affiliation-with-amazon-p
erences: - https://patchstack.com/database/vulnerability/wp-amazon-shop/wordpress-dropshipping-affiliation-with-amazon-plugin-2-1-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2023-31216 State: PUBLISHED Published: 2023-07-17T13:50:07.650Z Last Updated: 2024-09-30T14:39:24.706Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Ultimate Member Products: Ultimate Member Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Ultimate Member plugin <= 2.6.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ultimate-member/wordpress-ultimate-member-plugin-2-6-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve