Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6694 State: PUBLISHED Published: 2024-04-09T19:05:06.081Z Last Updated: 2024-08-02T08:35:14.867Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Beaver Builder Products: Beaver Themer Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Beaver Themer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping on user supplied custom fields. This makes it possible for authenticated attackers with contributor-level and above permissions
supplied custom fields. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b8428a92-8b0a-4a9a-8f7e-571c252973c2?source=cve - https://www.wpbeaverbuilder.com/change-logs/
CVE ID: CVE-2023-6695 State: PUBLISHED Published: 2024-04-09T19:05:04.983Z Last Updated: 2024-08-02T08:35:14.920Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Beaver Builder Products: Beaver Themer Problem Types: CWE-359 Exposure of Private Information ('Privacy Violation') Description: The Beaver Themer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.9 via the 'wpbb' shortcode. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including arbitrary user_meta values. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Co
sensitive data including arbitrary user_meta values. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4165cff7-457d-4790-8678-84c4365a191a?source=cve - https://www.wpbeaverbuilder.com/change-logs/
CVE ID: CVE-2023-6696 State: PUBLISHED Published: 2024-06-15T02:02:00.502Z Last Updated: 2024-08-02T08:35:14.844Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: popupbuilder Products: Popup Builder – Create highly converting, mobile friendly marketing popups. Problem Types: CWE-862 Missing Authorization Description: The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several functions in all versions up to, and including, 4.3.1. While some functions contain a nonce check, the nonce can be obtained from the profile page of
to, and including, 4.3.1. While some functions contain a nonce check, the nonce can be obtained from the profile page of a logged-in user. This allows subscribers to perform several actions including deleting subscribers and perform blind Server-Side Request Forgery. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9f86ec30-7a9d-4c36-8559-bde331c8b958?source=cve - https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.2.3/com/classes/Ajax.php - https://plugins.trac.wordpress.org/changeset/3096000/popup-builder/trunk/com/classes/Ajax.php
CVE ID: CVE-2023-6697 State: PUBLISHED Published: 2024-01-24T13:52:53.769Z Last Updated: 2025-06-17T21:19:27.691Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wpgmaps Products: WP Go Maps (formerly WP Google Maps) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the map id parameter in all versions up to, and including, 9.0.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in p
itization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c3115b-8921-429d-b517-b946edab1cd5?source=cve - https://plugins.trac.wordpress.org/changeset/3022232/wp-google-maps/trunk/html/atlas-novus/map-edit-page/map-edit-page.html.php
CVE ID: CVE-2023-6699 State: PUBLISHED Published: 2024-01-11T06:49:34.348Z Last Updated: 2024-11-06T19:01:00.473Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: smartersite Products: WP Compress – Image Optimizer [All-In-One] Problem Types: CWE-24 Path Traversal: '../filedir' Description: The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.10.33 via the css parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CVE Program Container:
bitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/defb87dd-bf5f-411f-b948-699337d05d44?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3009183%40wp-compress-image-optimizer%2Ftrunk&old=2994665%40wp-compress-image-optimizer%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6700 State: PUBLISHED Published: 2024-02-05T21:21:41.583Z Last Updated: 2024-08-26T18:10:16.968Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: cookieinformation Products: Cookie Information | Free GDPR Consent Solution Problem Types: CWE-862 Missing Authorization Description: The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to arbitrary option updates due to a missing capability check on its AJAX request handler in versions up to, and including, 2.0.22. This makes it possible for authenticated attackers, with subscriber-level access or higher, to edit arbitrary site options which can be used to create ad
ticated attackers, with subscriber-level access or higher, to edit arbitrary site options which can be used to create administrator accounts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/42a4ef37-c842-4925-b06a-3e6423337567?source=cve - https://plugins.trac.wordpress.org/changeset/3028096/wp-gdpr-compliance/trunk?contextall=1&old=2865555&old_path=%2Fwp-gdpr-compliance%2Ftrunk
CVE ID: CVE-2023-6701 State: PUBLISHED Published: 2024-02-05T21:22:04.222Z Last Updated: 2024-08-02T08:35:14.940Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpengine, Delicious Brains Products: Advanced Custom Fields (ACF), Advanced Custom Fields Pro Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom text field in all versions up to, and including, 6.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contri
to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e3593dfd-7b2a-4d01-8af0-725b444dc81b?source=cve - https://www.advancedcustomfields.com/blog/acf-6-2-5-security-release/ - https://plugins.trac.wordpress.org/changeset/3022469/advanced-custom-fields
CVE ID: CVE-2023-6702 State: PUBLISHED Published: 2023-12-14T21:48:41.224Z Last Updated: 2025-11-04T18:22:03.019Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type confusion in V8 in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_12.html - https://crbug.com/1501326 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6NWZ23ZJ62XKWVNGHSIZ
26 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6NWZ23ZJ62XKWVNGHSIZQYILVJWH5BLI/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-6703 State: PUBLISHED Published: 2023-12-14T21:48:41.669Z Last Updated: 2025-02-13T17:26:29.704Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Blink in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_12.html - https://crbug.com/1502102 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6NWZ23ZJ62XKWVNGHSIZQYILVJWH5BLI/ - https:
oraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6NWZ23ZJ62XKWVNGHSIZQYILVJWH5BLI/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-6704 State: PUBLISHED Published: 2023-12-14T21:48:41.823Z Last Updated: 2025-02-13T17:26:30.320Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in libavif in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted image file. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_12.html - https://crbug.com/1504792 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6NWZ23ZJ62XKWV
/1504792 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6NWZ23ZJ62XKWVNGHSIZQYILVJWH5BLI/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-6705 State: PUBLISHED Published: 2023-12-14T21:48:42.098Z Last Updated: 2025-02-13T17:26:30.994Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in WebRTC in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_12.html - https://crbug.com/1505708 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6NWZ23ZJ62XKWVNGHSIZQYILVJWH5BLI/ - https
doraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6NWZ23ZJ62XKWVNGHSIZQYILVJWH5BLI/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-6706 State: PUBLISHED Published: 2023-12-14T21:48:42.363Z Last Updated: 2025-02-13T17:26:31.513Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in FedCM in Google Chrome prior to 120.0.6099.109 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_12.html - https://crbug.com/1500921 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproj
op_12.html - https://crbug.com/1500921 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6NWZ23ZJ62XKWVNGHSIZQYILVJWH5BLI/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-6707 State: PUBLISHED Published: 2023-12-14T21:48:42.519Z Last Updated: 2025-02-13T17:26:32.113Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in CSS in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_12.html - https://crbug.com/1504036 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6NWZ23ZJ62XKWVNGHSIZQYILVJWH5BLI/ - https:
CVE ID: CVE-2023-6708 State: PUBLISHED Published: 2024-07-18T02:38:33.871Z Last Updated: 2024-08-02T08:35:14.901Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: benbodhi Products: SVG Support Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG upload feature in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping, even when the 'Sanitize SVG while uploading' feature is enabled. This makes it possible for authenticated attackers, with author-level acces
ize SVG while uploading' feature is enabled. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note that successful exploitation of this vulnerability requires the administrator to allow author-level users to upload SVG files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/72bcfd2a-6803-4073-8fa9-62bcf0a10571?source=cve - https://plugins.trac.wordpress.org/browser/svg-support/trunk/svg-support.php#L110 - https://plugins.trac.wordpress.org/browser/svg-supp
.trac.wordpress.org/browser/svg-support/trunk/svg-support.php#L110 - https://plugins.trac.wordpress.org/browser/svg-support/trunk/functions/attachment.php#L235 - https://wordpress.org/plugins/svg-support/
CVE ID: CVE-2023-6709 State: PUBLISHED Published: 2023-12-12T04:05:45.542Z Last Updated: 2024-10-08T19:52:57.222Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: mlflow Products: mlflow/mlflow Problem Types: CWE-1336 Description: Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/9e4cc07b-6fff-421b-89bd-9445ef61d34d - https://github.com/mlflow/mlflow/commit/432b8ccf27fd3a76df4ba79bb1bec62118a85625
CVE ID: CVE-2023-6710 State: PUBLISHED Published: 2023-12-12T22:01:34.359Z Last Updated: 2025-11-20T01:24:59.033Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Red Hat Products: JBoss Core Services for RHEL 8, JBoss Core Services on RHEL 7, Red Hat Enterprise Linux 9, Text-Only JBCS, Red Hat JBoss Core Services Problem Types: CWE-79 Description: A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the scri
(XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:1316 - https://access.redhat.com/errata/RHSA-2024:1317 - https://access.redhat.com/errata/RHSA-2024:2387 - https://access.redhat.com/security/cve/CVE-2023-6710 - https://bugzilla.redhat.com/show_bug.cgi?id=2254128
CVE ID: CVE-2023-6711 State: PUBLISHED Published: 2023-12-19T14:53:44.658Z Last Updated: 2024-09-25T08:43:52.208Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Hitachi Energy Products: RTU500 series CMU Firmware Problem Types: CWE-120 Description: Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Specially crafted messages sent to the mentioned components are not validated properly and can result in buffer overflow and as final consequence to a reboot of an RTU500 CMU. Additional Analyst Notes: - CVE Program Container: References: - https://publisher.hitachienergy.com/preview?D
U500 CMU. Additional Analyst Notes: - CVE Program Container: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000184&languageCode=en&Preview=true
CVE ID: CVE-2023-6716 State: REJECTED Published: N/A Last Updated: 2024-02-09T08:48:17.675Z Description: No description available.
CVE ID: CVE-2023-6717 State: PUBLISHED Published: 2024-04-25T16:02:03.267Z Last Updated: 2025-11-20T18:06:13.086Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L) Vendors: Red Hat Products: Red Hat AMQ Broker 7, Red Hat build of Keycloak 22, Red Hat build of Keycloak 22.0.10, RHOSS-1.33-RHEL-8, RHPAM 7.13.5 async, Migration Toolkit for Applications 6, Migration Toolkit for Applications 7, Red Hat build of Apicurio Registry 2, Red Hat build of Quarkus, Red Hat Data Grid 8, Red Hat Decision Manager 7, Red Hat Developer Hub, Red Hat Fuse 7, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform 6, Red Hat JBoss Enterprise Application Platform 7, Red Hat J
Data Grid 7, Red Hat JBoss Enterprise Application Platform 6, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat OpenShift GitOps, Red Hat Process Automation 7, Red Hat Single Sign-On 7 Problem Types: CWE-79 Description: A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one realm or a client with registration access to target users in different realms or appl
ay allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission. This can enable unauthorized access and harmful actions, compromising the confidentiality, integrity, and availability of the complete KC instance. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:1353 - https://access.redhat.com/errata/RHSA-2024:1867 - https://access.redhat.com/errata/RHSA-2024:1868 - https://access.redhat.com/errata/RHSA-2024:2945 - https://access.redhat.com/errata/RHSA-2024:4057 - https://acc
4:1868 - https://access.redhat.com/errata/RHSA-2024:2945 - https://access.redhat.com/errata/RHSA-2024:4057 - https://access.redhat.com/security/cve/CVE-2023-6717 - https://bugzilla.redhat.com/show_bug.cgi?id=2253952
CVE ID: CVE-2023-6718 State: PUBLISHED Published: 2023-12-13T09:08:24.080Z Last Updated: 2024-10-01T14:47:57.187Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Repox Products: Repox Problem Types: CWE-288 Description: An authentication bypass vulnerability has been found in Repox, which allows a remote user to send a specially crafted POST request, due to the lack of any authentication method, resulting in the alteration or creation of users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repox
CVE ID: CVE-2023-6719 State: PUBLISHED Published: 2023-12-13T09:16:51.993Z Last Updated: 2024-08-02T08:35:14.925Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Repox Products: Repox Problem Types: CWE-79 Description: An XSS vulnerability has been detected in Repox, which allows an attacker to compromise interactions between a user and the vulnerable application, and can be exploited by a third party by sending a specially crafted JavaScript payload to a user, and thus gain full control of their session. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repox
CVE ID: CVE-2023-6720 State: PUBLISHED Published: 2023-12-13T10:04:07.091Z Last Updated: 2024-08-02T08:35:14.839Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Repox Products: Repox Problem Types: CWE-79 Description: An XSS vulnerability stored in Repox has been identified, which allows a local attacker to store a specially crafted JavaScript payload on the server, due to the lack of proper sanitisation of field elements, allowing the attacker to trigger the malicious payload when the application loads. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repox
CVE ID: CVE-2023-6721 State: PUBLISHED Published: 2023-12-13T10:06:55.214Z Last Updated: 2024-08-02T08:35:14.894Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: Repox Products: Repox Problem Types: CWE-611 Description: An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application's XML data processing in the fileupload function, resulting in interaction between the attacker and the server's file system. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repox
CVE ID: CVE-2023-6722 State: PUBLISHED Published: 2023-12-13T10:09:02.058Z Last Updated: 2024-08-02T08:35:14.917Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Repox Products: Repox Problem Types: CWE-23 Description: A path traversal vulnerability has been detected in Repox, which allows an attacker to read arbitrary files on the running server, resulting in a disclosure of sensitive information. An attacker could access files such as application code or data, backend credentials, operating system files... Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repox
CVE ID: CVE-2023-6723 State: PUBLISHED Published: 2023-12-13T10:10:44.157Z Last Updated: 2025-05-22T18:17:20.983Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Repox Products: Repox Problem Types: CWE-434 Description: An unrestricted file upload vulnerability has been identified in Repbox, which allows an attacker to upload malicious files via the transforamationfileupload function, due to the lack of proper file type validation controls, resulting in a full system compromise. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repox