Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-7235 State: PUBLISHED Published: 2024-02-21T10:55:15.487Z Last Updated: 2024-08-26T16:13:36.611Z Vendors: OpenVPN Products: OpenVPN Problem Types: CWE-276 Description: The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN binaries when using a non-standard installation path, which allows an attacker to replace binaries to run arbitrary executables. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.openvpn.net/openvpn/wiki/CVE-2023-7235
CVE ID: CVE-2023-7236 State: PUBLISHED Published: 2024-03-18T19:05:53.302Z Last Updated: 2024-12-04T14:59:43.541Z Vendors: Unknown Products: Backup Bolt Problem Types: CWE-200 Information Exposure Description: The Backup Bolt WordPress plugin through 1.3.0 is vulnerable to Information Exposure via the unprotected access of debug logs. This makes it possible for unauthenticated attackers to retrieve the debug log which may contain information like system errors which could contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/2a4557e2-b764-4678-a6d6-af39dd1ba76b/
CVE ID: CVE-2023-7237 State: PUBLISHED Published: 2024-01-23T21:46:38.832Z Last Updated: 2025-06-17T21:19:26.741Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Lantronix Products: XPort Problem Types: CWE-261 Description: Lantronix XPort sends weakly encoded credentials within web request headers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-05 - https://www.lantronix.com/products/xport-edge/
CVE ID: CVE-2023-7238 State: PUBLISHED Published: 2024-01-23T19:20:02.324Z Last Updated: 2025-06-17T21:19:26.897Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Orthanc Products: Osimis DICOM Web Viewer Problem Types: CWE-79 Description: A XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered. If exploited, the attacker will be able to execute arbitrary JavaScript code inside the victim's browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-023-01
CVE ID: CVE-2023-7239 State: PUBLISHED Published: 2025-05-15T20:09:27.286Z Last Updated: 2025-05-16T16:48:50.536Z Vendors: Unknown Products: WP Dashboard Notes Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The WP Dashboard Notes WordPress plugin before 1.0.11 does not validate that the user has access to the post_id parameter in its wpdn_update_note AJAX action. This allows users with a role of contributor and above to update notes created by other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6e6afe50-27f9-41fa-a94b-f44df0850e2c/
CVE ID: CVE-2023-7240 State: PUBLISHED Published: 2024-05-07T13:11:23.031Z Last Updated: 2024-08-02T08:57:35.206Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: OpenText Products: NetIQ Identity Console Problem Types: CWE-20 Description: An improper authorization level has been detected in the login panel. It may lead to unauthenticated Server Side Request Forgery and allows to perform open services enumeration. Server makes query to provided server (Server IP/DNS field) and is triggering connection to arbitrary address. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.netiq.com/documentation/identity-con
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.netiq.com/documentation/identity-console/identity_console1720000_releasenotes/data/identity_console1720000_releasenotes.html
CVE ID: CVE-2023-7241 State: PUBLISHED Published: 2024-05-01T16:49:00.697Z Last Updated: 2024-08-02T08:57:35.475Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H) Vendors: Webroot Products: Webroot AntiVirus (Consumer) and Webroot Endpoint Protection (Business) Problem Types: CWE-269 Description: Privilege Escalation in WRSA.EXE in Webroot Antivirus 8.0.1X- 9.0.35.12 on Windows64 bit and 32 bit allows malicious software to abuse WRSA.EXE to delete arbitrary and protected files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://answers.webroot.com/Webroot/ukp.aspx?&app=vw&vw=1&login=1&solutionid=4258 - https://www.webroot.c
References: - https://answers.webroot.com/Webroot/ukp.aspx?&app=vw&vw=1&login=1&solutionid=4258 - https://www.webroot.com/us/en/support/support-consumer-release-notes - https://www.webroot.com/us/en/business/support/release-notes#heading-endpoint
CVE ID: CVE-2023-7242 State: PUBLISHED Published: 2024-03-01T20:17:51.283Z Last Updated: 2024-08-02T08:57:35.466Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: CISA Products: Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Plugin for Zeek Problem Types: CWE-125 Description: Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds read during the process of analyzing a specific Ethercat packet. This could allow an attacker to crash the Zeek process and leak some information in memory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Co
he Zeek process and leak some information in memory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-02
CVE ID: CVE-2023-7243 State: PUBLISHED Published: 2024-03-01T20:16:06.673Z Last Updated: 2024-08-02T08:57:35.067Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CISA Products: Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Plugin for Zeek Problem Types: CWE-787 Description: Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds write while analyzing specific Ethercat datagrams. This could allow an attacker to cause arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cis
ode execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-02
CVE ID: CVE-2023-7244 State: PUBLISHED Published: 2024-03-01T20:14:27.469Z Last Updated: 2024-08-05T13:13:35.428Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CISA Products: Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Plugin for Zeek Problem Types: CWE-787 Description: Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds write in their primary analyses function for Ethercat communication packets. This could allow an attacker to cause arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Ref
acker to cause arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-02
CVE ID: CVE-2023-7245 State: PUBLISHED Published: 2024-02-20T11:08:29.089Z Last Updated: 2024-08-14T14:36:15.335Z Vendors: OpenVPN Products: OpenVPN Connect Problem Types: CWE-95 Description: The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRON_RUN_AS_NODE environment variable Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log/ - https://openvpn.net/vpn-server-resources/openvpn-connect-for-windows-change-log/
CVE ID: CVE-2023-7246 State: PUBLISHED Published: 2024-03-20T05:00:02.302Z Last Updated: 2024-08-05T15:32:24.317Z Vendors: Unknown Products: System Dashboard Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7413d5ec-10a7-4cb8-ac1c-4ef554751518/
CVE ID: CVE-2023-7247 State: PUBLISHED Published: 2024-03-11T17:56:06.449Z Last Updated: 2024-08-11T13:36:09.877Z Vendors: Unknown Products: Login as User or Customer Problem Types: CWE-269 Improper Privilege Management Description: The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/96b93253-31d0-4184-94b7-f1e18355d841/ - https://drive.google.com/file/d/1GCOzJ-ZovYij9GIdmsrZrR9g8mlC22hs/view?usp=sharing
CVE ID: CVE-2023-7248 State: PUBLISHED Published: 2024-03-15T19:30:27.419Z Last Updated: 2024-08-02T08:57:35.093Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L) Vendors: Opentext Products: Vertica Management Console Problem Types: CWE-20 Description: Certain functionality in OpenText Vertica Management console might be prone to bypass via crafted requests. The vulnerability would affect one of Vertica’s authentication functionalities by allowing specially crafted requests and sequences. This issue impacts the following Vertica Management Console versions: 10.x 11.1.1-24 or lower 12.0.4-18 or lower Please upgrade to one of the following Vertica Management Console versi
ions: 10.x 11.1.1-24 or lower 12.0.4-18 or lower Please upgrade to one of the following Vertica Management Console versions: 10.x to upgrade to latest versions from below. 11.1.1-25 12.0.4-19 23.x 24.x Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://portal.microfocus.com/s/article/KM000027542?language=en_US
CVE ID: CVE-2023-7249 State: PUBLISHED Published: 2024-08-12T15:59:00.272Z Last Updated: 2024-08-12T16:26:51.063Z Vendors: OpenText Products: OpenText Directory Services Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText OpenText Directory Services allows Path Traversal.This issue affects OpenText Directory Services: from 16.4.2 before 24.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0807814
CVE ID: CVE-2023-7250 State: PUBLISHED Published: 2024-03-18T12:21:24.985Z Last Updated: 2025-11-06T21:45:49.127Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 7 Problem Types: CWE-183 Description: A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server to hang indefinitely waiting for the remainder or until the connection gets closed. This will prevent other connections to the server, leadi
waiting for the remainder or until the connection gets closed. This will prevent other connections to the server, leading to a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:4241 - https://access.redhat.com/errata/RHSA-2024:9185 - https://access.redhat.com/security/cve/CVE-2023-7250 - https://bugzilla.redhat.com/show_bug.cgi?id=2244707
CVE ID: CVE-2023-7251 State: PUBLISHED Published: 2024-03-26T08:40:39.209Z Last Updated: 2024-08-06T15:22:09.297Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Jeff Starr Products: User Submitted Posts Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows Stored XSS.This issue affects User Submitted Posts: from n/a through 20230901. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/user-submitted-posts/wordpress-user-submitted-posts-plugin-20230901-cro
- https://patchstack.com/database/vulnerability/user-submitted-posts/wordpress-user-submitted-posts-plugin-20230901-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-7252 State: PUBLISHED Published: 2024-04-22T05:00:01.365Z Last Updated: 2024-11-22T14:41:14.188Z Vendors: Unknown Products: Tickera Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Tickera WordPress plugin before 3.5.2.5 does not prevent users from leaking other users' tickets. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/c452c5da-05a6-4a14-994d-e5049996d496/
CVE ID: CVE-2023-7253 State: PUBLISHED Published: 2024-04-24T05:00:01.731Z Last Updated: 2024-08-02T08:57:35.106Z Vendors: Unknown Products: Import WP Problem Types: CWE-918 Server-Side Request Forgery (SSRF) Description: The Import WP WordPress plugin before 2.13.1 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/aeefcc01-bbbf-4d86-9cfd-ea0f9a85e1a5/
CVE ID: CVE-2023-7255 State: REJECTED Published: N/A Last Updated: 2024-12-03T17:09:05.120Z Description: No description available.
CVE ID: CVE-2023-7256 State: PUBLISHED Published: 2024-08-30T23:44:04.383Z Last Updated: 2024-09-03T20:07:34.599Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: The Tcpdump Group Products: libpcap Problem Types: CWE-415 Description: In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A
ible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/the-tcpdump-group/libpcap/commit/262e4f34979872d822ccedf9f318ed89c4d31c03 - https://github.com/the-tcpdump-group/libpcap/commit/2aa69b04d8173b18a0e3492e0c8f2f7fabdf642d
CVE ID: CVE-2023-7258 State: PUBLISHED Published: 2024-05-15T16:29:08.574Z Last Updated: 2024-08-02T08:57:35.072Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: Google Products: Gvisor Problem Types: CWE-400 Description: A denial of service exists in Gvisor Sandbox where a bug in reference counting code in mount point tracking could lead to a panic, making it possible for an attacker running as root and with permission to mount volumes to kill the sandbox. We recommend upgrading past commit 6a112c60a257dadac59962e0bc9e9b5aee70b5b6 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/google/gvisor/commi
al Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/google/gvisor/commit/6a112c60a257dadac59962e0bc9e9b5aee70b5b6
CVE ID: CVE-2023-7259 State: PUBLISHED Published: 2024-05-24T07:00:10.006Z Last Updated: 2024-08-02T08:57:35.537Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: zzdevelop Products: lenosp Problem Types: CWE-79 Description: ** DISPUTED ** A vulnerability was found in zzdevelop lenosp up to 20230831. It has been classified as problematic. This affects an unknown part of the component Adduser Page. The manipulation of the argument username with the input <script>alert(1)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at th
xploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-266127. NOTE: The vendor rejected the issue because he claims that XSS which require administrative privileges are not of any use for attackers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.266127 - https://vuldb.com/?ctiid.266127 - https://gitee.com/zzdevelop/lenosp/issues/I7XC2Y
CVE ID: CVE-2023-7260 State: PUBLISHED Published: 2024-08-22T20:54:55.297Z Last Updated: 2024-08-23T14:28:18.837Z Vendors: OpenText™ Products: CX-E Voice Problem Types: CWE-22 Description: Path Traversal vulnerability discovered in OpenText™ CX-E Voice, affecting all version through 22.4. The vulnerability could allow arbitrarily access files on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0823114
CVE ID: CVE-2023-7261 State: PUBLISHED Published: 2024-06-07T20:09:06.392Z Last Updated: 2025-03-14T19:21:19.509Z Vendors: Google Products: Omaha Problem Types: Inappropriate implementation Description: Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://issues.chromium.org/issues/40064602
CVE ID: CVE-2023-7263 State: PUBLISHED Published: 2024-12-28T07:02:47.815Z Last Updated: 2024-12-28T16:15:44.746Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Huawei Products: HarmonyOS AILife Solution 8.0 Problem Types: CWE-35 Description: Some Huawei home music system products have a path traversal vulnerability. Successful exploitation of this vulnerability may cause unauthorized file deletion or file permission change.(Vulnerability ID:HWPSIRT-2023-53450) This vulnerability has been assigned a (CVE)ID:CVE-2023-7263 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.huawei.com/en/psirt/security-advisories/2024/huawei-sa-ptvihhms
otes: - CISA ADP Vulnrichment: References: - https://www.huawei.com/en/psirt/security-advisories/2024/huawei-sa-ptvihhms-20747ba3-en
CVE ID: CVE-2023-7264 State: PUBLISHED Published: 2024-06-11T03:16:59.623Z Last Updated: 2024-08-02T08:57:35.098Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: hakeemnala Products: Build App Online Problem Types: CWE-640 Weak Password Recovery Mechanism for Forgotten Password Description: The Build App Online plugin for WordPress is vulnerable to account takeover due to a weak password reset mechanism in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to reset the password of arbitrary users by guessing an 4-digit numeric reset code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Re
y guessing an 4-digit numeric reset code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f6047ae6-b1b4-4b31-aa12-560927e1040b?source=cve - https://plugins.trac.wordpress.org/browser/build-app-online/tags/1.0.21/public/class-build-app-online-public.php#L3688 - https://plugins.trac.wordpress.org/browser/build-app-online/tags/1.0.21/public/class-build-app-online-public.php#L3757
CVE ID: CVE-2023-7265 State: PUBLISHED Published: 2024-08-08T08:06:06.977Z Last Updated: 2024-08-08T14:02:07.503Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-264 Description: Permission verification vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect availability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2024/8/
CVE ID: CVE-2023-7266 State: PUBLISHED Published: 2024-12-28T07:00:51.369Z Last Updated: 2024-12-28T16:18:05.578Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Huawei Products: TC7001-10, WS7200-10, WS7206-10 Problem Types: CWE-420 Description: Some Huawei home routers have a connection hijacking vulnerability. Successful exploitation of this vulnerability may cause DoS or information leakage.(Vulnerability ID:HWPSIRT-2023-76605) This vulnerability has been assigned a (CVE)ID:CVE-2023-7266 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.huawei.com/en/psirt/security-advisories/2024/huawei-sa-chvishhr-d616b19e-en
CVE ID: CVE-2023-7268 State: PUBLISHED Published: 2024-07-19T06:00:04.159Z Last Updated: 2024-08-02T08:57:35.460Z Vendors: Unknown Products: ArtPlacer Widget Problem Types: CWE-862 Missing Authorization Description: The ArtPlacer Widget WordPress plugin before 2.21.2 does not have authorisation check in place when deleting widgets, allowing ay authenticated users, such as subscriber, to delete arbitrary widgets Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/9ac233dd-e00d-4aee-a41c-0de6e8aaefd7/
CVE ID: CVE-2023-7269 State: PUBLISHED Published: 2024-07-19T06:00:05.343Z Last Updated: 2024-08-02T08:57:35.220Z Vendors: Unknown Products: ArtPlacer Widget Problem Types: CWE-352 Cross-Site Request Forgery (CSRF), CWE-79 Cross-Site Scripting (XSS) Description: The ArtPlacer Widget WordPress plugin before 2.21.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/1e8e1186-323b-473b-a0c4-580dc94020d7/
CVE ID: CVE-2023-7270 State: PUBLISHED Published: 2024-06-27T09:28:21.528Z Last Updated: 2025-02-13T17:27:05.773Z Vendors: SoftMaker Software GmbH Products: Office, FreeOffice Description: An issue was discovered in SoftMaker Office 2024 / NX before revision 1214 and SoftMaker FreeOffice 2014 before revision 1215. FreeOffice 2021 is also affected, but won't be fixed. The SoftMaker Office and FreeOffice MSI installer files were found to produce a visible conhost.exe window running as the SYSTEM user when using the repair function of msiexec.exe. This allows a local, low-privileged attacker to use a chain of actions, to open a fully functional cmd.exe with the privileges of the SYSTEM user. Ad
ileged attacker to use a chain of actions, to open a fully functional cmd.exe with the privileges of the SYSTEM user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/softmaker - https://softmaker.de/download/servicepacks - https://www.freeoffice.com/de/download/servicepacks - http://seclists.org/fulldisclosure/2024/Jul/5