Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-0749 State: PUBLISHED Published: 2023-03-13T16:03:31.466Z Last Updated: 2025-02-27T20:20:24.100Z Vendors: Unknown Products: Ocean Extra Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, such as draft, private or even password protected ones. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9caa8d2e-383b-47d7-8d21-d2ed6b1664cb
CVE ID: CVE-2023-0750 State: PUBLISHED Published: 2023-04-06T13:12:11.304Z Last Updated: 2025-02-10T20:20:33.303Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Lynx Technik AG Products: Yellowbrik Problem Types: CWE-602 Description: Yellobrik PEC-1864 implements authentication checks via javascript in the frontend interface. When the device can be accessed over the network an attacker could bypass authentication. This would allow an attacker to : - Change the password, resulting in a DOS of the users - Change the streaming source, compromising the integrity of the stream - Change the streaming destination, compromising the confidentiality of the stream T
omising the integrity of the stream - Change the streaming destination, compromising the confidentiality of the stream This issue affects Yellowbrik: PEC 1864. No patch has been issued by the manufacturer as this model was discontinued. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lynx-technik.com/support/solutions/articles/1000317081-pec-1864-web-ui-for-configuration
CVE ID: CVE-2023-0751 State: PUBLISHED Published: 2023-02-08T19:25:01.118Z Last Updated: 2025-03-25T13:47:39.852Z Vendors: FreeBSD Products: FreeBSD Problem Types: CWE-20 Description: When GELI reads a key file from standard input, it does not reuse the key file to initialize multiple providers at once resulting in the second and subsequent devices silently using a NULL key as the user key file. If a user only uses a key file without a user passphrase, the master key is encrypted with an empty key file allowing trivial recovery of the master key. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-23:01.
CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-23:01.geli.asc
CVE ID: CVE-2023-0754 State: PUBLISHED Published: 2023-02-23T21:27:09.964Z Last Updated: 2025-01-16T21:55:46.607Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PTC, Microsoft, Rockwell Automation , General Electric Products: ThingWorx Edge C-SDK, .NET-SDK, ThingWorx Edge MicroServer (EMS), Kepware KEPServerEX, ThingWorx Kepware Server , ThingWorx Industrial Connectivity, ThingWorx Kepware Edge, KEPServer Enterprise , Digital Industrial Gateway Server Problem Types: CWE-190 Description: The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely execute arbitrary code. Additiona
overflow or wraparound, which could allow an attacker to crash the server and remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-054-01
CVE ID: CVE-2023-0755 State: PUBLISHED Published: 2023-02-23T21:23:19.210Z Last Updated: 2025-01-16T21:55:52.537Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PTC, Microsoft, Rockwell Automation , General Electric Products: ThingWorx Edge C-SDK, .NET-SDK, ThingWorx Edge MicroServer (EMS), Kepware KEPServerEX, ThingWorx Kepware Server , ThingWorx Industrial Connectivity, ThingWorx Kepware Edge, KEPServer Enterprise , Digital Industrial Gateway Server Problem Types: CWE-129 Description: The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code. Addit
validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-054-01
CVE ID: CVE-2023-0756 State: PUBLISHED Published: 2023-05-03T00:00:00.000Z Last Updated: 2025-02-12T16:08:12.043Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper control of generation of code ('code injection') in GitLab Description: An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The main branch of a repository with a specially crafted name allows an attacker to create repositories with malicious code, victims who clone or download these repositories will execute arbitrary code on thei
e repositories with malicious code, victims who clone or download these repositories will execute arbitrary code on their systems. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/390910 - https://hackerone.com/reports/1864278 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0756.json
CVE ID: CVE-2023-0757 State: PUBLISHED Published: 2023-12-14T14:04:10.708Z Last Updated: 2024-08-02T05:24:33.525Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PHOENIX CONTACT Products: MULTIPROG, ProConOS eCLR (SDK) Problem Types: CWE-732 Description: Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to upload arbitrary malicious code and gain full access on the affected device. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2023-051/
CVE ID: CVE-2023-0758 State: PUBLISHED Published: 2023-02-09T10:59:53.003Z Last Updated: 2025-03-24T18:31:57.799Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: glorylion Products: JFinalOA Problem Types: CWE-89 Description: A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects some unknown processing of the file src/main/java/com/pointlion/mvc/common/model/SysOrg.java. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220469 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Cont
may be used. The identifier VDB-220469 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.220469 - https://vuldb.com/?ctiid.220469 - https://github.com/skisw/Vul/blob/main/vuloa
CVE ID: CVE-2023-0759 State: PUBLISHED Published: 2023-02-09T00:00:00.000Z Last Updated: 2025-03-24T18:14:23.367Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: cockpit-hq Products: cockpit-hq/cockpit Problem Types: CWE-268 Description: Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/49e2cccc-bb56-4633-ba6a-b3803e251347 - https://github.com/cockpit-hq/cockpit/commit/78d6ed3bf093ee11356ba66320c628c727068714
CVE ID: CVE-2023-0760 State: PUBLISHED Published: 2023-02-09T00:00:00.000Z Last Updated: 2025-03-24T18:59:05.060Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: gpac Products: gpac/gpac Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to V2.1.0-DEV. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/d06223df-a473-4c82-96d0-23726b844b21 - https://github.com/gpac/gpac/commit/ea7395f39f601a7750d48d606e9d10ea0b7beefe - https://www.debian.org/security/2023/dsa-5452
CVE ID: CVE-2023-0761 State: PUBLISHED Published: 2023-05-15T12:15:43.882Z Last Updated: 2025-01-24T21:19:28.938Z Vendors: Unknown Products: Clock In Portal- Staff & Attendance Management Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Staff members, which could allow attackers to make logged in admins delete arbitrary Staff via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/88fb064e-0001-446c-8e43-9fe3feff6c1f
CVE ID: CVE-2023-0762 State: PUBLISHED Published: 2023-05-15T12:15:32.523Z Last Updated: 2025-01-24T20:27:00.862Z Vendors: Unknown Products: Clock In Portal- Staff & Attendance Management Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting designations, which could allow attackers to make logged in admins delete arbitrary designations via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9be952e0-d8ae-440f-8819-cb19485f35f3
CVE ID: CVE-2023-0763 State: PUBLISHED Published: 2023-05-15T12:15:37.541Z Last Updated: 2025-01-24T20:52:16.568Z Vendors: Unknown Products: Clock In Portal- Staff & Attendance Management Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Holidays, which could allow attackers to make logged in admins delete arbitrary holidays via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4b55f868-62f8-43a1-9817-68cd1fc6190f
CVE ID: CVE-2023-0764 State: PUBLISHED Published: 2023-04-17T12:17:37.533Z Last Updated: 2025-02-06T16:43:09.033Z Vendors: Unknown Products: Gallery by BestWebSoft Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not perform proper sanitization of gallery information, leading to a Stored Cross-Site Scription vulnerability. The attacker must have at least the privileges of the Author role. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d48c6c50-3734-4191-9833-0d9b09b1bd8a
CVE ID: CVE-2023-0765 State: PUBLISHED Published: 2023-04-17T12:17:39.159Z Last Updated: 2025-03-05T18:54:54.186Z Vendors: Unknown Products: Gallery by BestWebSoft Problem Types: CWE-89 SQL Injection Description: The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to an Blind SQL Injection vulnerability. The attacker must have at least the privileges of an Author, and the vendor's Slider plugin (https://wordpress.org/plugins/slider-bws/) must also be installed for this vulnerability to be exploitable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2699
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2699cefa-1cae-4ef3-ad81-7f3db3fcce25
CVE ID: CVE-2023-0766 State: PUBLISHED Published: 2023-05-30T07:49:19.438Z Last Updated: 2025-01-10T20:53:59.826Z Vendors: Unknown Products: Newsletter Popup Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Newsletter Popup WordPress plugin through 1.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks as the wp_newsletter_show_localrecord page is not protected with a nonce. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/90a1976c-0348-41ea-90b4-f7a5d9306c88
CVE ID: CVE-2023-0767 State: PUBLISHED Published: 2023-06-02T00:00:00.000Z Last Updated: 2025-05-05T16:07:43.135Z Vendors: Mozilla Products: Firefox, Thunderbird, Firefox ESR Problem Types: Arbitrary memory write via PKCS 12 in NSS Description: An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-06/ - https://www.mozilla.org/security/advisories/mfsa2023-05/ -
- https://www.mozilla.org/security/advisories/mfsa2023-06/ - https://www.mozilla.org/security/advisories/mfsa2023-05/ - https://www.mozilla.org/security/advisories/mfsa2023-07/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1804640 - https://alas.aws.amazon.com/AL2/ALAS-2023-1992.html
CVE ID: CVE-2023-0768 State: PUBLISHED Published: 2023-05-08T13:58:02.011Z Last Updated: 2025-01-29T15:06:04.387Z Vendors: Unknown Products: Avirato hotels online booking engine Problem Types: CWE-89 SQL Injection Description: The Avirato hotels online booking engine WordPress plugin through 5.0.5 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/03d061b4-1b71-44f5-b3dc-f82a5fcd92eb
CVE ID: CVE-2023-0769 State: PUBLISHED Published: 2024-01-16T15:56:25.178Z Last Updated: 2025-06-02T15:09:44.119Z Vendors: Unknown Products: hiWeb Migration Simple Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The hiWeb Migration Simple WordPress plugin through 2.0.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1d4a2f0e-a371-4e27-98de-528e070f41b0/
CVE ID: CVE-2023-0770 State: PUBLISHED Published: 2023-02-09T00:00:00 Last Updated: 2024-08-02T05:24:34.231Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: gpac Products: gpac/gpac Problem Types: CWE-121 Description: Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/e0fdeee5-7909-446e-9bd0-db80fd80e8dd - https://github.com/gpac/gpac/commit/c31941822ee275a35bc148382bafef1c53ec1c26 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2023-0771 State: PUBLISHED Published: 2023-02-10T00:00:00.000Z Last Updated: 2025-03-24T16:17:19.069Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ampache Products: ampache/ampache Problem Types: CWE-89 Description: SQL Injection in GitHub repository ampache/ampache prior to 5.5.7,develop. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/2493f350-271b-4c38-9e1d-c8fa189c5ce1 - https://github.com/ampache/ampache/commit/c456e66ef6fd8d11390181a40c66910ae01fbf4c
CVE ID: CVE-2023-0772 State: PUBLISHED Published: 2023-03-13T16:03:30.688Z Last Updated: 2025-02-27T21:10:26.369Z Vendors: Unknown Products: Popup Builder by OptinMonster Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protected ones. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/28754886-b7b4-44
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/28754886-b7b4-44f7-9042-b81c542d3c9c
CVE ID: CVE-2023-0773 State: PUBLISHED Published: 2023-09-19T09:33:42.479Z Last Updated: 2024-09-25T14:40:18.835Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: Uniview Products: Uniview IP Camera IPC322LB-SF28-A Problem Types: CWE-287 Description: The vulnerability exists in Uniview IP Camera due to identification and authentication failure at its web-based management interface. A remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device. Successful exploitation of this vulnerability could allow the attacker to gain complete control of the targeted device. Additional Analyst Notes: - CVE Program
ility could allow the attacker to gain complete control of the targeted device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0270 - https://global.uniview.com/About_Us/Security/Notice/202309/976482_140493_0.htm
CVE ID: CVE-2023-0774 State: PUBLISHED Published: 2023-02-10T11:52:38.683Z Last Updated: 2024-08-02T05:24:34.558Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Medical Certificate Generator App Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Medical Certificate Generator App 1.0 and classified as critical. This vulnerability affects unknown code of the file action.php. The manipulation of the argument lastname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-220558 is the identifier assigned to this vulnerability. Additional Analyst Notes:
ed to the public and may be used. VDB-220558 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.220558 - https://vuldb.com/?ctiid.220558 - https://www.youtube.com/watch?v=s3oK5jebx_I
CVE ID: CVE-2023-0775 State: PUBLISHED Published: 2023-03-28T16:23:29.836Z Last Updated: 2025-02-18T20:11:16.516Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: silabs.com Products: GSDK Problem Types: CWE-20 Description: An invalid ‘prepare write request’ command can cause the Bluetooth LE stack to run out of memory and fail to be able to handle subsequent connection requests, resulting in a denial-of-service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000SMMyGQAX?operationContext=S1 - https://github.com/SiliconLabs/gecko_sdk
CVE ID: CVE-2023-0776 State: PUBLISHED Published: 2023-02-10T21:50:42.853Z Last Updated: 2025-03-24T17:53:53.299Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L) Vendors: Baicells Products: Nova 436Q, Nova 430E, Nova 430I, Neutrino 430 Problem Types: CWE-79 Description: Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods below have been tested and validated by a 3rd party analyst and has been confirmed exploitable special tha
owing methods below have been tested and validated by a 3rd party analyst and has been confirmed exploitable special thanks to Rustam Amin for providing the steps to reproduce. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://baicells.com/Service/Firmware
CVE ID: CVE-2023-0777 State: PUBLISHED Published: 2023-02-10T00:00:00.000Z Last Updated: 2025-03-24T16:18:28.474Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: modoboa Products: modoboa/modoboa Problem Types: CWE-305 Description: Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/a17e7a9f-0fee-4130-a522-5a0466fc17c7 - https://github.com/modoboa/modoboa/commit/47d17ac6643f870719691073956a26e4be0a4806 - http://packetstormsecurity.com/files/171744/modoboa-2.0.4-Admin-Takeover.html
CVE ID: CVE-2023-0778 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-24T17:25:59.179Z Vendors: n/a Products: podman Problem Types: CWE-367 Description: A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2168256
CVE ID: CVE-2023-0779 State: PUBLISHED Published: 2023-05-30T00:00:00.000Z Last Updated: 2025-02-13T16:39:07.447Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: zephyrproject-rtos Products: zephyr Problem Types: CWE-20 Description: At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9xj8-6989-r549
CVE ID: CVE-2023-0780 State: PUBLISHED Published: 2023-02-11T00:00:00.000Z Last Updated: 2025-03-24T17:48:07.905Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: cockpit-hq Products: cockpit-hq/cockpit Problem Types: CWE-1021 Description: Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/801efd0b-404b-4670-961a-12a986252fa4 - https://github.com/cockpit-hq/cockpit/commit/8450bdf7e1dc23e9d88adf30a2aa9101c0c41720
CVE ID: CVE-2023-0781 State: PUBLISHED Published: 2023-02-11T10:06:45.744Z Last Updated: 2024-08-02T05:24:34.332Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Canteen Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been declared as critical. This vulnerability affects the function query of the file removeOrder.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-220624. Additional Analyst Notes: - CVE Program Con
public and may be used. The identifier of this vulnerability is VDB-220624. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.220624 - https://vuldb.com/?ctiid.220624 - https://blog.csdn.net/weixin_43864034/article/details/128986083