Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
eSWITCH servers for calls that rely on DTLS-SRTP. To address this vulnerability, upgrade FreeSWITCH to 1.10.11 which includes the security fix. The solution implemented is to drop all packets from addresses that have not been validated by an ICE check. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/signalwire/freeswitch/security/advisories/GHSA-39gv-hq72-j6m6 - https://github.com/signalwire/freeswitch/commit/86cbda90b84ba186e508fbc7bfae469270a97d11 - http://packetstormsecurity.com/files/176393/FreeSWITCH-Denial-Of-Service.html
CVE ID: CVE-2023-51444 State: PUBLISHED Published: 2024-03-20T15:07:29.869Z Last Updated: 2024-08-21T14:35:24.029Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: geoserver Products: geoserver Problem Types: CWE-20, CWE-434 Description: GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. An arbitrary file upload vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrator with permissions to modify coverage stores through the REST Coverage Store API to upload arbitrary file contents to arbitrary file locations which can lead to remote code execution. Coverag
Store API to upload arbitrary file contents to arbitrary file locations which can lead to remote code execution. Coverage stores that are configured using relative paths use a GeoServer Resource implementation that has validation to prevent path traversal but coverage stores that are configured using absolute paths use a different Resource implementation that does not prevent path traversal. This vulnerability can lead to executing arbitrary code. An administrator with limited privileges could also potentially exploit this to overwrite GeoServer security files and obtain full administrator privileges. Versions 2.23.4 and 2.24.1 contain a fix for this issue. Additional Analyst Notes: - CVE Pr
ll administrator privileges. Versions 2.23.4 and 2.24.1 contain a fix for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/geoserver/geoserver/security/advisories/GHSA-9v5q-2gwq-q9hq - https://github.com/geoserver/geoserver/pull/7222 - https://github.com/geoserver/geoserver/commit/ca683170c669718cb6ad4c79e01b0451065e13b8 - https://github.com/geoserver/geoserver/commit/fe235b3bb1d7f05751a4a2ef5390c36f5c9e78ae - https://osgeo-org.atlassian.net/browse/GEOS-11176
CVE ID: CVE-2023-51445 State: PUBLISHED Published: 2024-03-20T15:14:49.682Z Last Updated: 2024-08-21T23:01:43.594Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: geoserver Products: geoserver Problem Types: CWE-79 Description: GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.3 and 2.24.0 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in uploaded style/legend resources that will execute in the context of another administrator's browser when viewed in the R
uploaded style/legend resources that will execute in the context of another administrator's browser when viewed in the REST Resources API. Access to the REST Resources API is limited to full administrators by default and granting non-administrators access to this endpoint should be carefully considered as it may allow access to files containing sensitive information. Versions 2.23.3 and 2.24.0 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/geoserver/geoserver/security/advisories/GHSA-fh7p-5f6g-vj2w - https://github.com/geoserver/geoserver/pull/7161 - https://github.com/geoserver/geoserver/commit/7db
SA-fh7p-5f6g-vj2w - https://github.com/geoserver/geoserver/pull/7161 - https://github.com/geoserver/geoserver/commit/7db985738ff2422019ccac974cf547bae5770cad - https://osgeo-org.atlassian.net/browse/GEOS-11148
CVE ID: CVE-2023-51446 State: PUBLISHED Published: 2024-02-01T15:25:01.465Z Last Updated: 2024-08-02T22:32:09.928Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-90, CWE-74 Description: GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-p995-jmfv-c7r8 - https://github.com/glpi-project/glpi/commit/58c67d78f2e3ad08264213e9aaf56eab3c9
ecurity/advisories/GHSA-p995-jmfv-c7r8 - https://github.com/glpi-project/glpi/commit/58c67d78f2e3ad08264213e9aaf56eab3c9ded35 - https://github.com/glpi-project/glpi/releases/tag/10.0.12
CVE ID: CVE-2023-51447 State: PUBLISHED Published: 2024-02-20T17:29:35.677Z Last Updated: 2024-08-26T14:47:59.180Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: decidim Products: decidim Problem Types: CWE-79 Description: Decidim is a participatory democracy framework. Starting in version 0.27.0 and prior to versions 0.27.5 and 0.28.0, the dynamic file upload feature is subject to potential cross-site scripting attacks in case the attacker manages to modify the file names of the records being uploaded to the server. This appears in sections where the user controls the file upload dialogs themselves and has the technical knowledge to change the file names t
ns where the user controls the file upload dialogs themselves and has the technical knowledge to change the file names through the dynamic upload endpoint. Therefore I believe it would require the attacker to control the whole session of the particular user but in any case, this needs to be fixed. Successful exploit of this vulnerability would require the user to have successfully uploaded a file blob to the server with a malicious file name and then have the possibility to direct the other user to the edit page of the record where the attachment is attached. The users are able to craft the direct upload requests themselves controlling the file name that gets stored to the database. The atta
able to craft the direct upload requests themselves controlling the file name that gets stored to the database. The attacker is able to change the filename e.g. to `<svg onload=alert('XSS')>` if they know how to craft these requests themselves. And then enter the returned blob ID to the form inputs manually by modifying the edit page source. Versions 0.27.5 and 0.28.0 contain a patch for this issue. As a workaround, disable dynamic uploads for the instance, e.g. from proposals. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/decidim/decidim/security/advisories/GHSA-9w99-78rj-hmxq - https://github.com/decidim/decidim/pull/11612 - ht
/github.com/decidim/decidim/security/advisories/GHSA-9w99-78rj-hmxq - https://github.com/decidim/decidim/pull/11612 - https://github.com/decidim/decidim/commit/aaf72787cf18beeeb6a771c1f7cbb7654b073423 - https://github.com/decidim/decidim/releases/tag/v0.27.5 - https://github.com/decidim/decidim/releases/tag/v0.28.0 - https://github.com/rails/rails/blob/a967d355c6fee9ad9b8bd115d43bc8b0fc207e7e/activestorage/app/controllers/active_storage/direct_uploads_controller.rb#L14
CVE ID: CVE-2023-51448 State: PUBLISHED Published: 2023-12-22T16:44:57.007Z Last Updated: 2025-02-13T17:19:45.658Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Cacti Products: cacti Problem Types: CWE-89 Description: Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `‘/cacti/managers.php’` with an SQLi payload in the `‘selected_graphs_array’` HTTP GET parameter. As of time of publi
nt `‘/cacti/managers.php’` with an SQLi payload in the `‘selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-w85f-7c4w-7594 - https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/managers.php#L941 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
CVE ID: CVE-2023-51449 State: PUBLISHED Published: 2023-12-22T20:58:36.185Z Last Updated: 2024-08-02T22:32:09.953Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: gradio-app Products: gradio Problem Types: CWE-22 Description: Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created
attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/gradio-app/gradio/security/advisories/GHSA-6qm2-wpxq-7qh2 - https://github.com/gradio-app/gradio/commit/1b9d4234d6c25ef250d882c7b90e1f4039ed2d76 - https://github.com/gradio-app/gradio/commit/7ba8c5da45b004edd12c0460be9222f5b5f5f055
CVE ID: CVE-2023-51450 State: PUBLISHED Published: 2024-02-22T14:50:51.098Z Last Updated: 2024-08-02T22:32:10.287Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: baserproject Products: basercms Problem Types: CWE-78 Description: baserCMS is a website development framework. Prior to version 5.0.9, there is an OS Command Injection vulnerability in the site search feature of baserCMS. Version 5.0.9 contains a fix for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/baserproject/basercms/security/advisories/GHSA-77fc-4cv5-hmfr - https://github.com/baserproject/basercms/commit/18f426
m/baserproject/basercms/security/advisories/GHSA-77fc-4cv5-hmfr - https://github.com/baserproject/basercms/commit/18f426d63e752b4d22c40e9ea8d1f6e692ef601c - https://basercms.net/security/JVN_09767360
CVE ID: CVE-2023-51451 State: PUBLISHED Published: 2023-12-22T21:01:21.824Z Last Updated: 2024-08-02T22:32:10.044Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: getsentry Products: symbolicator Problem Types: CWE-918 Description: Symbolicator is a service used in Sentry. Starting in Symbolicator version 0.3.3 and prior to version 21.12.1, an attacker could make Symbolicator send GET HTTP requests to arbitrary URLs with internal IP addresses by using an invalid protocol. The responses of those requests could be exposed via Symbolicator's API. In affected Sentry instances, the data could be exposed through the Sentry API and user interface if the attacker ha
PI. In affected Sentry instances, the data could be exposed through the Sentry API and user interface if the attacker has a registered account. The issue has been fixed in Symbolicator release 23.12.1, Sentry self-hosted release 23.12.1, and has already been mitigated on sentry.io on December 18, 2023. If updating is not possible, some other mitigations are available. One may disable JS processing by toggling the option `Allow JavaScript Source Fetching` in `Organization Settings > Security & Privacy` and/or disable all untrusted public repositories under `Project Settings > Debug Files`. Alternatively, if JavaScript and native symbolication are not required, disable Symbolicator completely
> Debug Files`. Alternatively, if JavaScript and native symbolication are not required, disable Symbolicator completely in `config.yml`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/getsentry/symbolicator/security/advisories/GHSA-ghg9-7m82-h96r - https://github.com/getsentry/symbolicator/pull/1343 - https://github.com/getsentry/self-hosted/releases/tag/23.12.1 - https://github.com/getsentry/symbolicator/releases/tag/23.12.1
CVE ID: CVE-2023-51452 State: PUBLISHED Published: 2024-04-02T10:28:16.090Z Last Updated: 2024-09-30T10:01:13.806Z Severity: LOW (CVSS 3 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: DJI Products: Mavic 3 Pro, Mavic 3, Mavic 3 Classic, Mavic 3 Enterprise, Matrice 300, Matrice M30, Mini 3 Pro Problem Types: CWE-787 Description: A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to cause a crash of the service through a crafted payload triggering a missing input size check in the pull_file_v2_proc function implemented in the libv2_sdk.so library used by the dji_vtwo_sdk binary implementing the
the pull_file_v2_proc function implemented in the libv2_sdk.so library used by the dji_vtwo_sdk binary implementing the service, compromising it in a term of availability and producing a denial-of-service attack. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-51452/
CVE ID: CVE-2023-51453 State: PUBLISHED Published: 2024-04-02T10:28:38.221Z Last Updated: 2024-09-30T10:01:48.829Z Severity: LOW (CVSS 3 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: DJI Products: Mavic 3 Pro, Mavic 3, Mavic 3 Classic, Mavic 3 Enterprise, Matrice 300, Matrice M30, Mini 3 Pro Problem Types: CWE-787 Description: A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to cause a crash of the service through a crafted payload triggering a missing input size check in the process_push_file function implemented in the libv2_sdk.so library used by the dji_vtwo_sdk binary implementing the
the process_push_file function implemented in the libv2_sdk.so library used by the dji_vtwo_sdk binary implementing the service, compromising it in a term of availability and producing a denial-of-service attack. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-51453/
CVE ID: CVE-2023-51454 State: PUBLISHED Published: 2024-04-02T10:28:47.933Z Last Updated: 2024-08-19T20:13:36.786Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: DJI, DJI Products: Mavic 3 Pro, Mavic 3, Mavic 3 Classic, Mavic 3 Enterprise, Matrice 300, Matrice M30, Mini 3 Pro Problem Types: CWE-787 Description: A Out-of-bounds Write issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to overwrite a pointer in the process memory through a crafted payload triggering an unsafe memory write operation in the my_tcp_receive function implemented in the libv2_sdk.so library used by the dji_vtwo_sdk bina
ory write operation in the my_tcp_receive function implemented in the libv2_sdk.so library used by the dji_vtwo_sdk binary implementing the service, potentially leading to a memory information leak or to an arbitrary code execution. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-51454/
CVE ID: CVE-2023-51455 State: PUBLISHED Published: 2024-04-02T10:31:01.115Z Last Updated: 2024-08-08T21:24:18.935Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: DJI, DJI Products: Mavic 3 Pro, Mavic 3, Mavic 3 Classic, Mavic 3 Enterprise, Matrice 300, Matrice M30, Mini 3 Pro Problem Types: CWE-129 Description: A Improper Validation of Array Index issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to corrupt a controlled memory location due to a missing input validation in the on_receive_session_packet_ack function implemented in the libv2_sdk.so library used by the dji_vtwo_sdk binary implemen
on_receive_session_packet_ack function implemented in the libv2_sdk.so library used by the dji_vtwo_sdk binary implementing the service, potentially leading to a memory information leak or to an arbitrary code execution. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-51455/
CVE ID: CVE-2023-51456 State: PUBLISHED Published: 2024-04-02T10:31:30.487Z Last Updated: 2024-09-30T10:03:29.786Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: DJI Products: Mavic 3 Pro, Mavic 3, Mavic 3 Classic, Mavic 3 Enterprise, Matrice 300, Matrice M30, Mini 3 Pro Problem Types: CWE-125, CWE-787 Description: A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to trigger an out-of-bound read/write into the process memory through a crafted payload due to a missing input sanity check in the v2_pack_array_to_msg function implemented in the libv2_sdk.so library impo
ad due to a missing input sanity check in the v2_pack_array_to_msg function implemented in the libv2_sdk.so library imported by the v2_sdk_service binary implementing the service, potentially leading to a memory information leak or an arbitrary code execution. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-51456/
CVE ID: CVE-2023-51457 State: PUBLISHED Published: 2023-12-20T14:02:53.185Z Last Updated: 2024-10-07T13:47:54.295Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.a
CVE ID: CVE-2023-51458 State: PUBLISHED Published: 2023-12-20T14:02:56.290Z Last Updated: 2025-05-06T18:43:55.405Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
CVE ID: CVE-2023-51459 State: PUBLISHED Published: 2023-12-20T14:02:52.420Z Last Updated: 2024-10-07T14:14:23.391Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/expe
CVE ID: CVE-2023-51460 State: PUBLISHED Published: 2023-12-20T14:02:54.745Z Last Updated: 2024-10-07T13:37:41.863Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.a
CVE ID: CVE-2023-51461 State: PUBLISHED Published: 2023-12-20T14:02:53.974Z Last Updated: 2024-10-07T13:54:17.427Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.a
CVE ID: CVE-2023-51462 State: PUBLISHED Published: 2023-12-20T14:02:55.519Z Last Updated: 2024-10-07T13:31:39.686Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.c