Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-38034 State: PUBLISHED Published: 2023-08-10T18:58:07.647Z Last Updated: 2024-12-04T16:30:27.937Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Ubiquiti Inc Products: UniFi Access Points, UniFi Switches Description: A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, could allow a Remote Code Execution (RCE). Affected Products: All UniFi Access Points (Version 6.5.53 and earlier) All UniFi Switches (Version 6.5.32 and earlier) -USW Flex Mini excluded. Mitigation: Update UniFi Access Points to Version 6.5.62 or later. Update UniFi Switches to Version 6.5.59 or
excluded. Mitigation: Update UniFi Access Points to Version 6.5.62 or later. Update UniFi Switches to Version 6.5.59 or later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-035-035/91107858-9884-44df-b1c6-63c6499f6e56
CVE ID: CVE-2023-38035 State: PUBLISHED Published: 2023-08-21T16:51:20.678Z Last Updated: 2025-10-21T23:05:40.307Z Vendors: Ivanti Products: MobileIron Sentry Description: A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface - http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authent
hentication-Bypass-on-Sentry-Administrator-Interface - http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html
CVE ID: CVE-2023-38036 State: PUBLISHED Published: 2025-07-12T03:30:40.265Z Last Updated: 2025-07-15T03:55:10.274Z Vendors: Ivanti Products: Avalanche Description: A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to create a buffer overflow that could result in service disruption or arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Avalanche-CVE-2023-38036
CVE ID: CVE-2023-38037 State: PUBLISHED Published: 2025-01-09T00:33:47.704Z Last Updated: 2025-02-15T00:10:27.790Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: Rails Products: ActiveSupport Description: ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted to the user's current `umask` settings, meaning that it's possible for other users on the same system to read the contents of the temporary file. Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it. All users running an affected release should eit
ly read the contents of this temporary file while a user is editing it. All users running an affected release should either upgrade or use one of the workarounds immediately. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://discuss.rubyonrails.org/t/cve-2023-38037-possible-file-disclosure-of-locally-encrypted-files/83544
CVE ID: CVE-2023-38039 State: PUBLISHED Published: 2023-09-15T03:21:54.348Z Last Updated: 2025-02-13T17:01:44.367Z Vendors: curl Products: curl Description: When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/2072338 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org
//hackerone.com/reports/2072338 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEAWTYHC3RT6ZRS5OZRHLAIENVN6CCIS/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DCZMYODALBLVOXVJEN2LF2MLANEYL4F/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6KGKB2JNZVT276JYSKI6FV2VFJUGDOJ/ - https://security.gentoo.org/glsa/202310-12 - https://security.netapp.com/advisory/ntap-20231013-0005/ - http://seclists.org/fulldisclosure/2023/Oct/17 - https://support.apple.com/kb/HT214036 - https://www.insyde.com/security-pledge/SA-2023064 - https://support.apple.com/kb
https://support.apple.com/kb/HT214036 - https://www.insyde.com/security-pledge/SA-2023064 - https://support.apple.com/kb/HT214063 - https://support.apple.com/kb/HT214057 - https://support.apple.com/kb/HT214058 - http://seclists.org/fulldisclosure/2024/Jan/34 - http://seclists.org/fulldisclosure/2024/Jan/37 - http://seclists.org/fulldisclosure/2024/Jan/38
CVE ID: CVE-2023-38040 State: PUBLISHED Published: 2023-09-17T04:41:38.080Z Last Updated: 2024-09-25T13:54:24.631Z Vendors: Revive Products: Revive Adserver Description: A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions.. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1694171
CVE ID: CVE-2023-38041 State: PUBLISHED Published: 2023-10-25T00:24:34.090Z Last Updated: 2025-03-07T18:23:51.147Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Secure Access Client Description: A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a particular process flow is initiated, an attacker can exploit this condition to gain unauthorized elevated privileges on the affected system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/CVE-2023-38041-New-client-side-release-to-address-a-privilege-escal
t: References: - https://forums.ivanti.com/s/article/CVE-2023-38041-New-client-side-release-to-address-a-privilege-escalation-on-Windows-user-machines?language=en_US
CVE ID: CVE-2023-38042 State: PUBLISHED Published: 2024-05-31T17:38:31.427Z Last Updated: 2024-08-02T17:30:12.374Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Secure Access Client Description: A local privilege escalation vulnerability in Ivanti Secure Access Client for Windows allows a low privileged user to execute code as SYSTEM. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Advisory-May-2024?language=en_US
CVE ID: CVE-2023-38043 State: PUBLISHED Published: 2023-11-14T23:18:08.378Z Last Updated: 2024-08-12T14:35:59.161Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Secure Access Client Windows Description: A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a vulnerable configuration, potentially leading to a denial of service (DoS) condition on the user machine and, in some cases, resulting in a full compromise of the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/art
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-fixes-included-in-the-latest-Ivanti-Secure-Access-Client-Release - https://northwave-cybersecurity.com/vulnerability-notice/arbitrary-kernel-function-call-in-ivanti-secure-access-client
CVE ID: CVE-2023-38044 State: PUBLISHED Published: 2023-08-07T16:51:06.984Z Last Updated: 2024-10-20T04:33:21.414Z Vendors: hikashop.com Products: HikaShop component for Joomla Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hikashop.com/support/documentation/56-hikashop-changelog.html - https://extensions.joomla.org/vulnerable-extensions/resolved/hikashop-versions-from-4-4-1-to-4-7-2-are-affected-sql-injection/
CVE ID: CVE-2023-38045 State: PUBLISHED Published: 2023-08-07T16:51:04.832Z Last Updated: 2024-09-29T04:33:08.310Z Vendors: admiror-design-studio.com Products: Admiror Gallery component for Joomla Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for Joomla. It allows XSS Targeting Non-Script Elements. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://extensions.joomla.org/extension/admiror-gallery/
CVE ID: CVE-2023-38046 State: PUBLISHED Published: 2023-07-12T16:20:06.175Z Last Updated: 2025-02-10T21:58:15.424Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: Palo Alto Networks Products: PAN-OS, Cloud NGFW, Prisma Access Problem Types: CWE-610 Description: A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specifically created configuration to read local files and resources from the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2023-38046
CVE ID: CVE-2023-38047 State: PUBLISHED Published: 2024-07-09T10:25:16.393Z Last Updated: 2024-08-02T17:30:12.380Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L) Products: easyappointments Problem Types: CWE-639 Description: A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} allows a low privileged user to fetch, modify or delete the category of any user (including admin). This results in unauthorized access and unauthorized data manipulation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/alextselegidis/easyappointments
CVE ID: CVE-2023-38048 State: PUBLISHED Published: 2024-07-09T10:25:44.382Z Last Updated: 2024-08-02T17:30:13.446Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Products: easyappointments Problem Types: CWE-639 Description: A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} allows a low privileged user to fetch, modify or delete a privileged user (provider). This results in unauthorized access and unauthorized data manipulation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/alextselegidis/easyappointments
CVE ID: CVE-2023-38049 State: PUBLISHED Published: 2024-07-09T10:26:17.043Z Last Updated: 2024-08-02T17:30:13.428Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Products: easyappointments Problem Types: CWE-639 Description: A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} allows a low privileged user to fetch, modify or delete an appointment of any user (including admin). This results in unauthorized access and unauthorized data manipulation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/alextselegidis/easyappointments
CVE ID: CVE-2023-38050 State: PUBLISHED Published: 2024-07-09T10:26:46.343Z Last Updated: 2024-08-02T17:30:12.942Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) Products: easyappointments Problem Types: CWE-639 Description: A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin). This results in unauthorized access and unauthorized data manipulation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/alextselegidis/easyappointments
CVE ID: CVE-2023-38051 State: PUBLISHED Published: 2024-07-09T10:27:20.370Z Last Updated: 2024-08-02T17:30:14.028Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Products: easyappointments Problem Types: CWE-639 Description: A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, modify or delete a low privileged user (secretary). This results in unauthorized access and unauthorized data manipulation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/alextselegidis/easyappointments
CVE ID: CVE-2023-38052 State: PUBLISHED Published: 2024-07-09T10:27:51.931Z Last Updated: 2024-08-02T17:30:12.376Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Products: easyappointments Problem Types: CWE-639 Description: A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} allows a low privileged user to fetch, modify or delete a high privileged user (admin). This results in unauthorized access and unauthorized data manipulation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/alextselegidis/easyappointments
CVE ID: CVE-2023-38053 State: PUBLISHED Published: 2024-07-09T10:28:33.660Z Last Updated: 2024-08-02T17:30:13.663Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Products: easyappointments Problem Types: CWE-639 Description: A BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} allows a low privileged user to fetch, modify or delete the settings of any user (including admin). This results in unauthorized access and unauthorized data manipulation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/alextselegidis/easyappointments
CVE ID: CVE-2023-38054 State: PUBLISHED Published: 2024-07-09T10:29:10.033Z Last Updated: 2024-08-02T17:30:13.356Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Products: easyappointments Problem Types: CWE-639 Description: A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer). This results in unauthorized access and unauthorized data manipulation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/alextselegidis/easyappointments
CVE ID: CVE-2023-38055 State: PUBLISHED Published: 2024-07-09T10:29:43.626Z Last Updated: 2024-08-02T17:30:13.582Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) Products: easyappointments Problem Types: CWE-639 Description: A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} allows a low privileged user to fetch, modify or delete the services of any user (including admin). This results in unauthorized access and unauthorized data manipulation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/alextselegidis/easyappointments
CVE ID: CVE-2023-38056 State: PUBLISHED Published: 2023-07-24T08:27:13.127Z Last Updated: 2024-10-23T17:49:19.541Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: OTRS AG Products: OTRS, ((OTRS)) Community Edition Problem Types: CWE-78 Description: Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authenticated attacker with admin privileges local execution of Code.This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
((OTRS)) Community Edition: from 6.0.1 through 6.0.34. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-advisory-2023-05/
CVE ID: CVE-2023-38057 State: PUBLISHED Published: 2023-07-24T08:27:55.315Z Last Updated: 2024-10-17T13:02:55.563Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: OTRS AG Products: OTRS, ((OTRS)) Community Edition Problem Types: CWE-20 Description: An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. This allows a cross site scripting attack while reading the replies as authenticated agent. This issue affects OTRS Survey module from 7.0.X before 7.0.32, from 8.0.X before 8.0.13 and ((OTRS)) Community Edition Survey module from
OTRS Survey module from 7.0.X before 7.0.32, from 8.0.X before 8.0.13 and ((OTRS)) Community Edition Survey module from 6.0.X through 6.0.22. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-advisory-2023-06/
CVE ID: CVE-2023-38058 State: PUBLISHED Published: 2023-07-24T08:28:03.242Z Last Updated: 2024-10-17T13:03:11.116Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: OTRS AG Products: OTRS Problem Types: CWE-269 Description: An improper privilege check in the OTRS ticket move action in the agent interface allows any as agent authenticated attacker to to perform a move of an ticket without the needed permission. This issue affects OTRS: from 8.0.X before 8.0.35. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-advisory-2023-07/
CVE ID: CVE-2023-38059 State: PUBLISHED Published: 2023-10-16T08:10:44.014Z Last Updated: 2024-09-16T16:56:26.630Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: OTRS AG Products: OTRS, ((OTRS)) Community Edition Problem Types: CWE-200 Description: The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retreive the IP of the user.This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://otrs.com/rel
h 6.0.34. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-advisory-2023-08/
CVE ID: CVE-2023-38060 State: PUBLISHED Published: 2023-07-24T08:28:13.816Z Last Updated: 2025-02-13T17:01:45.040Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: OTRS AG Products: OTRS, ((OTRS)) Community Edition Problem Types: CWE-20 Description: Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment. This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
ffects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-advisory-2023-04/ - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE ID: CVE-2023-38061 State: PUBLISHED Published: 2023-07-12T12:48:19.126Z Last Updated: 2024-10-23T14:40:18.471Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2023.05.1 stored XSS when using a custom theme was possible Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-38062 State: PUBLISHED Published: 2023-07-12T12:48:19.714Z Last Updated: 2024-10-23T14:40:05.492Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-200 Description: In JetBrains TeamCity before 2023.05.1 parameters of the "password" type could be shown in the UI in certain composite build configurations Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-38063 State: PUBLISHED Published: 2023-07-12T12:48:20.416Z Last Updated: 2024-10-23T14:37:18.530Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2023.05.1 stored XSS while running custom builds was possible Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-38064 State: PUBLISHED Published: 2023-07-12T12:48:20.927Z Last Updated: 2024-10-22T18:40:04.179Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-532 Description: In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be written to the agent log Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-38065 State: PUBLISHED Published: 2023-07-12T12:48:21.501Z Last Updated: 2024-10-22T18:40:21.852Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2023.05.1 stored XSS while viewing the build log was possible Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-38066 State: PUBLISHED Published: 2023-07-12T12:48:21.874Z Last Updated: 2024-10-21T21:10:13.344Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-38067 State: PUBLISHED Published: 2023-07-12T12:48:22.381Z Last Updated: 2024-10-22T18:09:10.767Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-532 Description: In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to the agent log Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-38068 State: PUBLISHED Published: 2023-07-12T12:48:22.777Z Last Updated: 2024-11-07T17:00:22.476Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: JetBrains Products: YouTrack Problem Types: CWE-799 Description: In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/