Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-28083 State: PUBLISHED Published: 2023-03-20T12:34:16.606Z Last Updated: 2025-02-26T19:17:12.354Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: HPE Products: Integrated Lights-Out Problem Types: CWE-79 Description: A remote Cross-site Scripting vulnerability was discovered in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4). HPE has provided software updates to resolve this vulnerability in HPE Integrated Lights-Out. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04456
CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04456en_us
CVE ID: CVE-2023-28084 State: PUBLISHED Published: 2023-04-25T19:00:14.252Z Last Updated: 2025-02-03T17:00:17.458Z Vendors: Hewlett Packard Enterprise Products: HPE OneView, HPE OneView Global Dashboard Problem Types: CWE-522 Description: HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04468en_us - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04469en_us
CVE ID: CVE-2023-28085 State: PUBLISHED Published: 2023-04-14T14:22:24.896Z Last Updated: 2025-02-06T19:27:08.204Z Vendors: Hewlett Packard Enterprise (HPE) Products: HPE OneView Global Dashboard Description: An HPE OneView Global Dashboard (OVGD) appliance dump may expose OVGD user account credentials Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04468en_us
CVE ID: CVE-2023-28086 State: PUBLISHED Published: 2023-04-25T18:39:46.125Z Last Updated: 2025-02-03T17:12:02.168Z Vendors: Hewlett Packard Enterprise (HPE) Products: HPE OneView Description: An HPE OneView appliance dump may expose proxy credential settings Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04469en_us
CVE ID: CVE-2023-28087 State: PUBLISHED Published: 2023-04-25T18:41:15.824Z Last Updated: 2025-02-03T17:09:45.718Z Vendors: Hewlett Packard Enterprise (HPE) Products: HPE OneView Description: An HPE OneView appliance dump may expose OneView user accounts Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04469en_us
CVE ID: CVE-2023-28088 State: PUBLISHED Published: 2023-04-25T18:43:01.040Z Last Updated: 2025-02-03T17:08:10.085Z Vendors: Hewlett Packard Enterprise (HPE) Products: HPE OneView Description: An HPE OneView appliance dump may expose SAN switch administrative credentials Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04469en_us
CVE ID: CVE-2023-28089 State: PUBLISHED Published: 2023-04-25T18:44:21.865Z Last Updated: 2025-02-03T17:06:21.698Z Vendors: Hewlett Packard Enterprise (HPE) Products: HPE OneView Description: An HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect Modules Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04469en_us
CVE ID: CVE-2023-28090 State: PUBLISHED Published: 2023-04-25T18:45:35.090Z Last Updated: 2025-02-03T17:04:05.860Z Vendors: Hewlett Packard Enterprise (HPE) Products: HPE OneView Description: An HPE OneView appliance dump may expose SNMPv3 read credentials Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04469en_us
CVE ID: CVE-2023-28091 State: PUBLISHED Published: 2023-04-14T14:04:35.333Z Last Updated: 2025-02-06T19:33:15.638Z Vendors: Hewlett Packard Enterprise (HPE) Products: HPE OneView Description: HPE OneView virtual appliance "Migrate server hardware" option may expose sensitive information in an HPE OneView support dump Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04467en_us
CVE ID: CVE-2023-28092 State: PUBLISHED Published: 2023-05-01T14:10:19.471Z Last Updated: 2025-01-30T15:58:47.113Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE ProLiant RL300 Gen11 Description: A potential security vulnerability has been identified in HPE ProLiant RL300 Gen11 Server. The vulnerability could result in the system being vulnerable to exploits by attackers with physical access inside the server chassis. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04472en_us
CVE ID: CVE-2023-28093 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-02-07T20:12:24.206Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Pegasystems Products: RPA: Synchronization Engine Problem Types: CWE-295 Description: A user with a compromised configuration can start an unsigned binary as a service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.pega.com/support-doc/pega-security-advisory-b23-robotics-and-workforce-intelligence-local-privilege
CVE ID: CVE-2023-28094 State: PUBLISHED Published: 2023-06-22T00:00:00 Last Updated: 2024-12-06T21:20:43.179Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Pegasystems Products: Pega Platform Problem Types: CWE-1393 Description: Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be utilizing default credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.pega.com/support-doc/pega-security-advisory-%E2%80%93-c23-vulnerability-default-operators?
CVE ID: CVE-2023-28095 State: PUBLISHED Published: 2023-03-15T21:43:10.408Z Last Updated: 2025-02-25T14:56:28.982Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OpenSIPS Products: opensips Problem Types: CWE-20 Description: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.1.7 and 3.2.4 have a potential issue in `msg_translator.c:2628` which might lead to a server crash. This issue was found while fuzzing the function `build_res_buf_from_sip_req` but could not be reproduced against a running instance of OpenSIPS. This issue could not be exploited against a running instance of OpenSIPS since no public function was foun
of OpenSIPS. This issue could not be exploited against a running instance of OpenSIPS since no public function was found to make use of this vulnerable code. Even in the case of exploitation through unknown vectors, it is highly unlikely that this issue would lead to anything other than Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenSIPS/opensips/security/advisories/GHSA-7pf3-24qg-8v9h - https://github.com/OpenSIPS/opensips/commit/9cf3dd3398719dd91207495f76d7726701c5145c - https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf
CVE ID: CVE-2023-28096 State: PUBLISHED Published: 2023-03-15T21:52:00.194Z Last Updated: 2025-02-25T14:56:23.444Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: OpenSIPS Products: opensips Problem Types: CWE-401 Description: OpenSIPS, a Session Initiation Protocol (SIP) server implementation, has a memory leak starting in the 2.3 branch and priot to versions 3.1.8 and 3.2.5. The memory leak was detected in the function `parse_mi_request` while performing coverage-guided fuzzing. This issue can be reproduced by sending multiple requests of the form `{"jsonrpc": "2.0","method": "log_le`. This malformed message was tested against an instance of OpenSIPS via F
the form `{"jsonrpc": "2.0","method": "log_le`. This malformed message was tested against an instance of OpenSIPS via FIFO transport layer and was found to increase the memory consumption over time. To abuse this memory leak, attackers need to reach the management interface (MI) which typically should only be exposed on trusted interfaces. In cases where the MI is exposed to the internet without authentication, abuse of this issue will lead to memory exhaustion which may affect the underlying system’s availability. No authentication is typically required to reproduce this issue. On the other hand, memory leaks may occur in other areas of OpenSIPS where the cJSON library is used for parsing
issue. On the other hand, memory leaks may occur in other areas of OpenSIPS where the cJSON library is used for parsing JSON objects. The issue has been fixed in versions 3.1.8 and 3.2.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenSIPS/opensips/security/advisories/GHSA-2mg2-g46r-j4qr - https://github.com/OpenSIPS/opensips/commit/417568707520af25ec5c5dd91da18e6db3649dcb - https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf
CVE ID: CVE-2023-28097 State: PUBLISHED Published: 2023-03-15T22:03:41.362Z Last Updated: 2025-02-25T14:56:16.155Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OpenSIPS Products: opensips Problem Types: CWE-190 Description: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, a malformed SIP message containing a large _Content-Length_ value and a specially crafted Request-URI causes a segmentation fault in OpenSIPS. This issue occurs when a large amount of shared memory using the `-m` flag was allocated to OpenSIPS, such as 10 GB of RAM. On the test system, this issue occurred when shared memory was set t
ag was allocated to OpenSIPS, such as 10 GB of RAM. On the test system, this issue occurred when shared memory was set to `2362` or higher. This issue is fixed in versions 3.1.9 and 3.2.6. The only workaround is to guarantee that the Content-Length value of input messages is never larger than `2147483647`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c6j5-f4h4-2xrq - https://github.com/OpenSIPS/opensips/commit/7cab422e2fc648f910abba34f3f0dbb3ae171ff5 - https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf
CVE ID: CVE-2023-28098 State: PUBLISHED Published: 2023-03-15T22:11:01.323Z Last Updated: 2025-02-25T14:56:10.861Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OpenSIPS Products: opensips Problem Types: CWE-20 Description: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, a specially crafted Authorization header causes OpenSIPS to crash or behave in an unexpected way due to a bug in the function `parse_param_name()` . This issue was discovered while performing coverage guided fuzzing of the function parse_msg. The AddressSanitizer identified that the issue occurred in the function `q_memchr()` which
g of the function parse_msg. The AddressSanitizer identified that the issue occurred in the function `q_memchr()` which is being called by the function `parse_param_name()`. This issue may cause erratic program behaviour or a server crash. It affects configurations containing functions that make use of the affected code, such as the function `www_authorize()` . Versions 3.1.7 and 3.2.4 contain a fix. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jrqg-vppj-hr2h - https://github.com/OpenSIPS/opensips/commit/dd9141b6f67d7df4072f3430f628d4b73df5e102 - https://opensips.org/pub/audit-2022/open
/github.com/OpenSIPS/opensips/commit/dd9141b6f67d7df4072f3430f628d4b73df5e102 - https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf
CVE ID: CVE-2023-28099 State: PUBLISHED Published: 2023-03-15T22:16:57.958Z Last Updated: 2025-02-25T14:56:03.865Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OpenSIPS Products: opensips Problem Types: CWE-20 Description: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, if `ds_is_in_list()` is used with an invalid IP address string (`NULL` is illegal input), OpenSIPS will attempt to print a string from a random address (stack garbage), which could lead to a crash. All users of `ds_is_in_list()` without the `$si` variable as 1st parameter could be affected by this vulnerability to a larger, lesser o
_is_in_list()` without the `$si` variable as 1st parameter could be affected by this vulnerability to a larger, lesser or no extent at all, depending if the data passed to the function is a valid IPv4 or IPv6 address string or not. Fixes will are available starting with the 3.1.9 and 3.2.6 minor releases. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenSIPS/opensips/security/advisories/GHSA-pfm5-6vhv-3ff3 - https://github.com/OpenSIPS/opensips/issues/2780 - https://github.com/OpenSIPS/opensips/commit/e2f13d374
CVE ID: CVE-2023-28100 State: PUBLISHED Published: 2023-03-16T15:51:32.037Z Last Updated: 2025-02-13T16:45:39.112Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: flatpak Products: flatpak Problem Types: CWE-20 Description: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command buffer, from which the command
as `/dev/tty1`, it can copy text from the virtual console and paste it into the command buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is primarily designed to be used in a Wayland or X11 graphical environment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/flatpak/flatpak/se
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/flatpak/flatpak/security/advisories/GHSA-7qpw-3vjv-xrqp - https://github.com/flatpak/flatpak/commit/8e63de9a7d3124f91140fc74f8ca9ed73ed53be9 - https://marc.info/?l=oss-security&m=167879021709955&w=2 - https://security.gentoo.org/glsa/202312-12
CVE ID: CVE-2023-28101 State: PUBLISHED Published: 2023-03-16T15:55:53.576Z Last Updated: 2025-02-25T14:55:35.911Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: flatpak Products: flatpak Problem Types: CWE-116 Description: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A fix is available in ver
her permissions to crafted values that contain non-printable control characters such as `ESC`. A fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/flatpak/flatpak/security/advisories/GHSA-h43h-fwqx-mpp8 - https://github.com/flatpak/flatpak/commit/409e34187de2b2b2c4ef34c79f417be698830f6c - https://github.com/flatpak/flatpak/commit/6cac99dafe6003c8a4bd5666341c217876536869 - https://github.com/flatpak/flatpak/commit/7fe63f2e8f1fd2dafc31d4
atpak/commit/6cac99dafe6003c8a4bd5666341c217876536869 - https://github.com/flatpak/flatpak/commit/7fe63f2e8f1fd2dafc31d45154cf0b191ebec66c - https://security.gentoo.org/glsa/202312-12
CVE ID: CVE-2023-28102 State: PUBLISHED Published: 2023-03-27T21:23:29.252Z Last Updated: 2025-02-19T15:52:01.234Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: shardlab Products: discordrb Problem Types: CWE-78 Description: discordrb is an implementation of the Discord API using Ruby. In discordrb before commit `91e13043ffa` the `encoder.rb` file unsafely constructs a shell string using the file parameter, which can potentially leave clients of discordrb vulnerable to command injection. The library is not directly exploitable: the exploit requires that some client of the library calls the vulnerable method with user input. However, if unsafe input reaches t
requires that some client of the library calls the vulnerable method with user input. However, if unsafe input reaches the library method, then an attacker can execute arbitrary shell commands on the host machine. Full impact will depend on the permissions of the process running the `discordrb` library and will likely not be total system access. This issue has been addressed in code, but a new release of the `discordrb` gem has not been uploaded to rubygems. This issue is also tracked as `GHSL-2022-094`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2022-094_discordrb/ - https://github.com/shardlab/dis
ment: References: - https://securitylab.github.com/advisories/GHSL-2022-094_discordrb/ - https://github.com/shardlab/discordrb/commit/91e13043ffa89227c3fcdc3408f06da237d28c95
CVE ID: CVE-2023-28103 State: PUBLISHED Published: 2023-03-28T20:37:24.288Z Last Updated: 2025-02-18T17:26:55.589Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: matrix-org Products: matrix-react-sdk Problem Types: CWE-1321 Description: matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the `Object.prototype`, disrupting matrix-react-sdk functionality, causing denial of service and potentially affecting program logic. This is fixed in matrix-react-sdk 3.69.0 and users are advised to upgrade. There are no known worka
cting program logic. This is fixed in matrix-react-sdk 3.69.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. Note this advisory is distinct from GHSA-2x9c-qwgf-94xr which refers to a similar issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-6g43-88cp-w5gv - https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0
CVE ID: CVE-2023-28104 State: PUBLISHED Published: 2023-03-16T15:25:30.551Z Last Updated: 2025-02-25T14:55:43.730Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: silverstripe Products: silverstripe-graphql Problem Types: CWE-770 Description: `silverstripe/graphql` serves Silverstripe data as GraphQL representations. In versions 4.2.2 and 4.1.1, an attacker could use a specially crafted graphql query to execute a denial of service attack against a website which has a publicly exposed graphql endpoint. This mostly affects websites with particularly large/complex graphql schemas. Users should upgrade to `silverstripe/graphql` 4.2.3 or 4.1.2 to remedy the vulnera
larly large/complex graphql schemas. Users should upgrade to `silverstripe/graphql` 4.2.3 or 4.1.2 to remedy the vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/silverstripe/silverstripe-graphql/security/advisories/GHSA-67g8-c724-8mp3 - https://github.com/silverstripe/silverstripe-graphql/pull/526 - https://github.com/silverstripe/silverstripe-graphql/releases/tag/4.1.2 - https://github.com/silverstripe/silverstripe-graphql/releases/tag/4.2.3
CVE ID: CVE-2023-28105 State: PUBLISHED Published: 2023-03-16T16:26:34.669Z Last Updated: 2025-02-25T14:55:23.289Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L) Vendors: dablelv Products: go-huge-util Problem Types: CWE-22 Description: go-used-util has commonly used utility functions for Go. Versions prior to 0.0.34 have a ZipSlip issue when using fsutil package to unzip files. When users use `zip.Unzip` to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. The issue has been fixed in version 0.0.34. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://githu
own workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dablelv/go-huge-util/security/advisories/GHSA-5g39-ppwg-6xx8 - https://github.com/dablelv/go-huge-util/commit/0e308b0fac8973e6fa251b0ab095cdc5c1c0956b
CVE ID: CVE-2023-28106 State: PUBLISHED Published: 2023-03-16T16:31:20.723Z Last Updated: 2025-02-25T14:55:17.566Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: pimcore Products: pimcore Problem Types: CWE-79 Description: Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pimcore/pimcore/security/advisories/GHSA-x5j
rogram Container: - CISA ADP Vulnrichment: References: - https://github.com/pimcore/pimcore/security/advisories/GHSA-x5j3-mq9g-8jc8 - https://github.com/pimcore/pimcore/pull/14669.patch - https://github.com/pimcore/pimcore/commit/c59d0bf1d03a5037b586fe06230694fa3818dbf2 - https://huntr.dev/bounties/fa77d780-9b23-404b-8c44-12108881d11a
CVE ID: CVE-2023-28107 State: PUBLISHED Published: 2023-03-17T16:23:31.324Z Last Updated: 2025-02-25T14:54:15.962Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: discourse Products: discourse Problem Types: CWE-770 Description: Discourse is an open-source discussion platform. Prior to version 3.0.2 of the `stable` branch and version 3.1.0.beta3 of the `beta` and `tests-passed` branches, a user logged as an administrator can request backups multiple times, which will eat up all the connections to the DB. If this is done on a site using multisite, then it can affect the whole cluster. The vulnerability is patched in version 3.0.2 of the `stable` branch and ve