Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
tput escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8a4ee97c-63cd-4a5e-a112-6d4c4c627a57 - https://plugins.trac.wordpress.org/browser/gn-publisher/trunk/templates/settings.php#L70
CVE ID: CVE-2023-1081 State: PUBLISHED Published: 2023-02-28T00:00:00 Last Updated: 2024-08-02T05:32:46.386Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:H) Vendors: microweber Products: microweber/microweber Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/cf59deed-9d43-4552-acfd-43f38f3aabba - https://github.com/microweber/microweber/commit/29d418461d8407688f2720e7b4be915e03fc16c1
CVE ID: CVE-2023-1082 State: PUBLISHED Published: 2024-04-09T08:25:34.716Z Last Updated: 2024-08-21T14:01:54.372Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Welotec Products: TK515L, TK515L Set, TK515L-W, TK515L-W Set, TK525L, TK525L Set, TK525L-W, TK525L-W Set, TK525U, TK525U Set, TK525W, TK525W Set, TK535L1, TK535L1 Set Problem Types: CWE-78 Description: An remote attacker with low privileges can perform a command injection which can lead to root access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-009
CVE ID: CVE-2023-1083 State: PUBLISHED Published: 2024-04-09T08:25:46.915Z Last Updated: 2024-10-02T05:26:02.183Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Welotec Products: TK515L, TK515L Set, TK515L-W, TK515L-W Set, TK525L, TK525L Set, TK525L-W, TK525L-W Set, TK525U, TK525U Set, TK525W, TK525W Set, TK535L1, TK535L1 Set Problem Types: CWE-306 Description: An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands and firmware updates. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advis
Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-009
CVE ID: CVE-2023-1084 State: PUBLISHED Published: 2023-03-09T00:00:00.000Z Last Updated: 2025-02-28T21:34:19.563Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A malicious project Maintainer may create a Project Access Token with Owner level privileges using a crafted request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/390696 - https://hackerone.com/reports/1805549 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1084.json
CVE ID: CVE-2023-1086 State: PUBLISHED Published: 2023-03-27T15:37:36.168Z Last Updated: 2025-02-19T19:29:53.580Z Vendors: Unknown Products: Preview Link Generator Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Preview Link Generator WordPress plugin before 1.0.4 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e2bda716-76dc-4a26-b26a-7a2a764757b0
CVE ID: CVE-2023-1087 State: PUBLISHED Published: 2023-03-27T15:37:45.104Z Last Updated: 2025-02-19T15:17:49.312Z Vendors: Unknown Products: WC Sales Notification Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WC Sales Notification WordPress plugin before 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/356c89a1-81b6-4600-9291-1a74788af7f9
CVE ID: CVE-2023-1088 State: PUBLISHED Published: 2023-03-27T15:37:18.954Z Last Updated: 2025-02-19T20:21:05.267Z Vendors: Unknown Products: WP Plugin Manager Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a956f1cd-fce4-4235-b1af-4b7675a60ca2
CVE ID: CVE-2023-1089 State: PUBLISHED Published: 2023-03-27T15:37:20.593Z Last Updated: 2025-02-19T19:03:20.813Z Vendors: Unknown Products: Coupon Zen Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Coupon Zen WordPress plugin before 1.0.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9787e26f-33fe-4c65-abb3-7f5c76ae8d6f
CVE ID: CVE-2023-1090 State: PUBLISHED Published: 2023-05-02T07:04:58.593Z Last Updated: 2025-01-30T14:31:51.963Z Vendors: Unknown Products: SMTP Mailing Queue Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The SMTP Mailing Queue WordPress plugin before 2.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d470dd6c-dcac-4a3e-b42a-2489a31aca45 - https://github.com/youki
richment: References: - https://wpscan.com/vulnerability/d470dd6c-dcac-4a3e-b42a-2489a31aca45 - https://github.com/youki992/youki992.github.io/blob/master/others/apply.md
CVE ID: CVE-2023-1091 State: PUBLISHED Published: 2023-03-10T07:02:09.307Z Last Updated: 2025-02-27T21:03:43.201Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Alpata Products: Licensed Warehousing Automation System Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alpata Licensed Warehousing Automation System allows Command Line Execution through SQL Injection.This issue affects Licensed Warehousing Automation System: through 2023.1.01. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0139
CVE ID: CVE-2023-1092 State: PUBLISHED Published: 2023-03-27T15:39:36.079Z Last Updated: 2025-02-19T16:49:01.199Z Vendors: MiniOrange Products: OAuth Single Sign On Free, OAuth Single Sign On Standard, OAuth Single Sign On Premium, OAuth Single Sign On Enterprise Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admin
.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8fbf7efe-0bf2-42c6-aef1-7fcf2708b31b - https://wpscan.com/vulnerability/f6e165d9-2193-4c76-ae2d-618a739fe4fb - https://wpscan.com/vulnerability/52e29f16-b6dd-4132-9bb8-ad10bd3c39d7 - https://wpscan.com/vulnerability/5eb85df5-8aab-4f30-a401-f776a310b09c
CVE ID: CVE-2023-1093 State: PUBLISHED Published: 2023-03-27T15:37:22.994Z Last Updated: 2025-02-19T20:16:48.586Z Vendors: Unknown Products: OAuth Single Sign On Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1e13b9ea-a3ef-483b-b967-6ec14bd6d54d
CVE ID: CVE-2023-1094 State: PUBLISHED Published: 2023-05-08T00:00:00.000Z Last Updated: 2025-01-29T16:18:42.852Z Vendors: n/a Products: MonicaHQ Problem Types: Stored cross-site scripting (XSS) Description: MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/food` endpoint and food parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/napoli - https://www.monicahq.com/
CVE ID: CVE-2023-1095 State: PUBLISHED Published: 2023-02-28T00:00:00.000Z Last Updated: 2025-03-18T15:14:46.858Z Vendors: n/a Products: Linux kernel netfilter subsystem. Problem Types: CWE-476 Description: In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2173973 - https://github.com/torvalds/linux/commit/580077855a40741cf511
s: - https://bugzilla.redhat.com/show_bug.cgi?id=2173973 - https://github.com/torvalds/linux/commit/580077855a40741cf511766129702d97ff02f4d9
CVE ID: CVE-2023-1096 State: PUBLISHED Published: 2023-05-12T00:00:00.000Z Last Updated: 2025-01-27T18:11:39.702Z Vendors: n/a Products: SnapCenter Problem Types: Authentication Bypass Description: SnapCenter versions 4.7 prior to 4.7P2 and 4.8 prior to 4.8P1 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to gain access as an admin user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.netapp.com/advisory/ntap-20230511-0011/
CVE ID: CVE-2023-1097 State: PUBLISHED Published: 2023-03-01T19:29:26.456Z Last Updated: 2025-03-07T15:53:21.691Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Baicells Products: EG7035-M11 Problem Types: CWE-94 Description: Baicells EG7035-M11 devices with firmware through BCE-ODU-1.0.8 are vulnerable to improper code exploitation via HTTP GET command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods have been tested and validated by a 3rd party analyst and have been confirmed exploitable special thanks to Lionel Musonza for the discovery. Additional Analyst Notes: - CVE Program Contain
onfirmed exploitable special thanks to Lionel Musonza for the discovery. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.na.baicells.com/t/baice-bm-2-5-26-new-cpe-software-has-been-released/1756 - https://img.baicells.com//Upload/20220524/FILE/BaiCE_BM_2.5.26_NA.bin.bin
CVE ID: CVE-2023-1098 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-10T20:58:02.109Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure through an error message in GitLab Description: An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 will allow an admin to leak password from repository mirror configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
tory mirror configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/383745 - https://hackerone.com/reports/1784294 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1098.json
CVE ID: CVE-2023-1099 State: PUBLISHED Published: 2023-02-28T20:03:21.662Z Last Updated: 2024-11-25T15:29:21.469Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Student Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Student Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file eduauth/edit-class-detail.php. The manipulation of the argument editid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-222002 is the identifier assigned to this vulnerability.
e exploit has been disclosed to the public and may be used. VDB-222002 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.222002 - https://vuldb.com/?ctiid.222002 - https://github.com/E1CHO/cve_hub/blob/main/Online%20student%20management%20system%20pdf/Online%20student%20management%20system%20sql%20vlun%201.pdf
CVE ID: CVE-2023-1100 State: PUBLISHED Published: 2023-02-28T20:07:24.304Z Last Updated: 2024-08-02T05:32:46.395Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Catering Reservation System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Online Catering Reservation System 1.0. This affects an unknown part of the file /reservation/add_message.php of the component POST Parameter Handler. The manipulation of the argument fullname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of th
tiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222003. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222003 - https://vuldb.com/?ctiid.222003 - https://github.com/jackswordsz/bug_report/blob/main/vendors/emoblazz/Online%20Catering%20Reservation%20System/SQLi-1.md
CVE ID: CVE-2023-1101 State: PUBLISHED Published: 2023-03-02T00:00:00.000Z Last Updated: 2025-03-07T19:19:56.993Z Vendors: SonicWall Products: SonicOS Problem Types: CWE-307 Description: SonicOS SSLVPN improper restriction of excessive MFA attempts vulnerability allows an authenticated attacker to use excessive MFA codes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0005
CVE ID: CVE-2023-1103 State: REJECTED Published: N/A Last Updated: 2023-04-04T00:00:00 Description: No description available.
CVE ID: CVE-2023-1104 State: PUBLISHED Published: 2023-03-01T00:00:00.000Z Last Updated: 2025-03-11T14:17:13.681Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H) Vendors: flatpressblog Products: flatpressblog/flatpress Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/a4909b4e-ab3c-41d6-b0d8-1c6e933bf758 - https://github.com/flatpressblog/flatpress/commit/f6394eac7a0e001d2b1ac638d3313e531d19ea93
CVE ID: CVE-2023-1105 State: PUBLISHED Published: 2023-03-01T00:00:00.000Z Last Updated: 2025-03-11T14:15:57.436Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: flatpressblog Products: flatpressblog/flatpress Problem Types: CWE-73 Description: External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/flatpressblog/flatpress/commit/5d5c7f6d8f072d14926fc2c3a97cdd763802f170 - https://huntr.dev/bounties/4089a63f-cffd-42f3-b8d8-e80b6bd9c80f
CVE ID: CVE-2023-1106 State: PUBLISHED Published: 2023-03-02T00:00:00.000Z Last Updated: 2025-03-07T21:35:57.091Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: flatpressblog Products: flatpressblog/flatpress Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository flatpressblog/flatpress prior to 1.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/flatpressblog/flatpress/commit/5f23b4c2eac294cc0ba5e541f83a6f8a26f9fed1 - https://huntr.dev/bounties/1288ec00-f69d-4b84-abce-efc9a97941a0
CVE ID: CVE-2023-1107 State: PUBLISHED Published: 2023-03-02T00:00:00.000Z Last Updated: 2025-03-07T21:37:05.474Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: flatpressblog Products: flatpressblog/flatpress Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/flatpressblog/flatpress/commit/d3f329496536dc99f9707f2f295d571d65a496f5 - https://huntr.dev/bounties/4b880868-bd28-4fd0-af56-7686e55d3762
CVE ID: CVE-2023-1108 State: PUBLISHED Published: 2023-09-14T14:48:58.869Z Last Updated: 2024-08-02T05:32:46.370Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: EAP 7.4.10 release, Red Hat Fuse 7.12, Red Hat JBoss Enterprise Application Platform 7.1.0, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9, Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7, Red Hat Single Sign-On 7, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, Red Hat support for Spring Boot 2.7.13, RHEL-8 based Middleware Cont
for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, Red Hat support for Spring Boot 2.7.13, RHEL-8 based Middleware Containers, RHPAM 7.13.1 async, Red Hat build of Quarkus, Red Hat Data Grid 8, Red Hat Integration Camel K, Red Hat Integration Camel Quarkus, Red Hat Integration Service Registry, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Fuse 6, Red Hat OpenStack Platform 13 (Queens) Problem Types: CWE-835 Description: A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates. Additional Analyst Notes: - CISA ADP
nexpected handshake status updated in SslConduit, where the loop never terminates. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:1184 - https://access.redhat.com/errata/RHSA-2023:1185 - https://access.redhat.com/errata/RHSA-2023:1512 - https://access.redhat.com/errata/RHSA-2023:1513 - https://access.redhat.com/errata/RHSA-2023:1514 - https://access.redhat.com/errata/RHSA-2023:1516 - https://access.redhat.com/errata/RHSA-2023:2135 - https://access.redhat.com/errata/RHSA-2023:3883 - https://access.redhat.com/errata/RHSA-2023:3884 - https://access.redhat.com/errata/RHSA-2023:3885 - https://access.redhat.com/e
/access.redhat.com/errata/RHSA-2023:3884 - https://access.redhat.com/errata/RHSA-2023:3885 - https://access.redhat.com/errata/RHSA-2023:3888 - https://access.redhat.com/errata/RHSA-2023:3892 - https://access.redhat.com/errata/RHSA-2023:3954 - https://access.redhat.com/errata/RHSA-2023:4612 - https://access.redhat.com/security/cve/CVE-2023-1108 - https://bugzilla.redhat.com/show_bug.cgi?id=2174246 - https://github.com/advisories/GHSA-m4mm-pg93-fv78 - https://security.netapp.com/advisory/ntap-20231020-0002/
CVE ID: CVE-2023-1109 State: PUBLISHED Published: 2023-04-17T07:32:24.262Z Last Updated: 2025-02-05T21:19:53.289Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PHOENIX CONTACT Products: ENERGY AXC PU (1264327), SMARTRTU AXC SG (1110435), SMARTRTU AXC IG (1264328), Infobox (1169323 ) Problem Types: CWE-22 Description: In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via the upload and download functionality of the web service. This may lead to full control of the service. Additional Analyst Notes: - CVE Program Con
ctionality of the web service. This may lead to full control of the service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2023-003/
CVE ID: CVE-2023-1110 State: PUBLISHED Published: 2023-08-16T11:03:26.120Z Last Updated: 2024-10-08T19:54:40.508Z Vendors: Unknown Products: Yellow Yard Searchbar Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Yellow Yard Searchbar WordPress plugin before 2.8.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1830e829-4a43-4d98-8214-eecec6bef694
CVE ID: CVE-2023-1111 State: PUBLISHED Published: 2024-05-24T06:31:07.931Z Last Updated: 2024-08-02T05:32:46.371Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: FastCMS Problem Types: CWE-79 Description: A vulnerability was found in FastCMS up to 0.1.5 and classified as problematic. Affected by this issue is some unknown functionality of the component New Article Tab. The manipulation of the argument Title leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-266126 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Contai
s the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.266126 - https://vuldb.com/?ctiid.266126 - https://gitee.com/dianbuapp_admin/fastcms/issues/I8ERNV