Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-0010 State: PUBLISHED Published: 2023-06-14T16:31:35.543Z Last Updated: 2024-12-30T15:30:01.041Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Palo Alto Networks Products: PAN-OS, Cloud NGFW, Prisma Access Problem Types: CWE-79 Description: A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal user’s browser when they click on a specifically crafted link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.co
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2023-0010
CVE ID: CVE-2023-0011 State: PUBLISHED Published: 2023-12-20T07:55:52.437Z Last Updated: 2025-04-24T14:55:36.918Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: u-blox Products: TOBY-L2 Problem Types: CWE-20 Description: A flaw in the input validation in TOBY-L2 allows a user to execute arbitrary operating system commands using specifically crafted AT commands. This vulnerability requires physical access to the serial interface of the module or the ability to modify the system or software which uses its serial interface to send malicious AT commands. Exploitation of the vulnerability gives full administrative (root) privileges to the attacker to execute any o
commands. Exploitation of the vulnerability gives full administrative (root) privileges to the attacker to execute any operating system command on TOBY-L2 which can lead to modification of the behavior of the module itself as well as the components connected with it (depending on its rights on other connected systems). It can further provide the ability to read system level files and hamper the availability of the module as well.. This issue affects TOBY-L2 series: TOBY-L200, TOBY-L201, TOBY-L210, TOBY-L220, TOBY-L280. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.u-blox.com/en/report-security-issues
CVE ID: CVE-2023-0012 State: PUBLISHED Published: 2023-01-10T02:44:38.047Z Last Updated: 2025-04-09T14:06:07.736Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP Products: Host Agent (Windows) Problem Types: CWE-284 Description: In SAP Host Agent (Windows) - versions 7.21, 7.22, an attacker who gains local membership to SAP_LocalAdmin could be able to replace executables with a malicious file that will be started under a privileged account. Note that by default all user members of SAP_LocaAdmin are denied the ability to logon locally by security policy so that this can only occur if the system has already been compromised. Additional Analyst Notes: - CVE
security policy so that this can only occur if the system has already been compromised. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3276120 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-0013 State: PUBLISHED Published: 2023-01-10T02:50:52.294Z Last Updated: 2025-04-09T15:25:48.857Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP Products: NetWeaver AS for ABAP and ABAP Platform Problem Types: CWE-79 Description: The ABAP Keyword Documentation of SAP NetWeaver Application Server - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, for ABAP and ABAP Platform does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application. Additional Analyst Notes: - CV
an attacker can cause limited impact on confidentiality and integrity of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3283283 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-0014 State: PUBLISHED Published: 2023-01-10T03:02:39.962Z Last Updated: 2025-04-09T13:59:20.601Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP Products: NetWeaver ABAP Server and ABAP Platform Problem Types: CWE-294 Description: SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7.53, 7.77, 7.81, 7.85, 7.89, KRNL64UC 7.22, 7.22EXT, 7.53, KRNL64NUC 7.22, 7.22EXT, creates information about system identity in an ambiguous format. This could lead to capture-replay vulnerability and may be exploited by malicious users to obtain illegit
iguous format. This could lead to capture-replay vulnerability and may be exploited by malicious users to obtain illegitimate access to the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3089413 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-0015 State: PUBLISHED Published: 2023-01-10T03:05:47.922Z Last Updated: 2025-04-09T13:57:34.512Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: SAP Products: SAP BusinessObjects Business Intelligence Platform Problem Types: CWE-79 Description: In SAP BusinessObjects Business Intelligence Platform (Web Intelligence user interface) - version 420, some calls return json with wrong content type in the header of the response. As a result, a custom application that calls directly the jsp of Web Intelligence DHTML may be vulnerable to XSS attacks. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of t
le to XSS attacks. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3251447 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-0016 State: PUBLISHED Published: 2023-01-10T03:13:29.718Z Last Updated: 2025-04-09T13:56:25.313Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP Products: SAP BPC MS 10.0 Problem Types: CWE-89 Description: SAP BPC MS 10.0 - version 810, allows an unauthorized attacker to execute crafted database queries. The exploitation of this issue could lead to SQL injection vulnerability and could allow an attacker to access, modify, and/or delete data from the backend database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3275391 - https://www.sap.com/documents
- CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3275391 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-0017 State: PUBLISHED Published: 2023-01-10T03:18:57.927Z Last Updated: 2025-04-09T13:54:09.602Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: SAP Products: NetWeaver AS for Java Problem Types: CWE-284 Description: An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and data on the current system. This could allow the attacker to have full read access to user data, make modifications to user data, and make services with
could allow the attacker to have full read access to user data, make modifications to user data, and make services within the system unavailable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3268093 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-0018 State: PUBLISHED Published: 2023-01-10T03:21:37.871Z Last Updated: 2025-04-09T13:52:50.105Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP Products: BusinessObjects Business Intelligence Platform (Central management console) Problem Types: CWE-79 Description: Due to improper input sanitization of user-controlled input in SAP BusinessObjects Business Intelligence Platform CMC application - versions 420, and 430, an attacker with basic user-level privileges can modify/upload crystal reports containing a malicious payload. Once these reports are viewable, anyone who opens those reports would be susceptible to stored XSS attacks. As a
ayload. Once these reports are viewable, anyone who opens those reports would be susceptible to stored XSS attacks. As a result of the attack, information maintained in the victim's web browser can be read, modified, and sent to the attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3266006 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-0019 State: PUBLISHED Published: 2023-02-14T03:06:56.391Z Last Updated: 2025-03-20T18:52:31.598Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP GRC (Process Control) Problem Types: CWE-862 Description: In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V1200_750, remote-enabled function module in the proprietary SAP solution enables an authenticated attacker with minimal privileges to access all the confidential data stored in the database. Successful exploitation of this vulnerability can expose user credentials from client-specific tables of the databa
ase. Successful exploitation of this vulnerability can expose user credentials from client-specific tables of the database, leading to high impact on confidentiality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3281724 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-0020 State: PUBLISHED Published: 2023-02-14T03:08:46.257Z Last Updated: 2025-03-20T18:50:52.988Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: SAP_SE Products: SAP BusinessObjects Business Intelligence Platform Problem Types: CWE-200 Description: SAP BusinessObjects Business Intelligence platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted. On successful exploitation, there could be a high impact on confidentiality and limited impact on integrity of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpa
application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3263135 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-0021 State: PUBLISHED Published: 2023-03-14T04:34:41.118Z Last Updated: 2025-02-27T18:16:46.682Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP NetWeaver Problem Types: CWE-79 Description: Due to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password, which could lead to reflected Cross-Site scripting. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the application. Additional Analyst Notes: - CVE Program
uccessful exploitation can partially impact confidentiality of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3274920 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-0022 State: PUBLISHED Published: 2023-01-10T03:25:36.853Z Last Updated: 2025-04-09T13:50:34.971Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP Products: BusinessObjects Business Intelligence platform (Analysis edition for OLAP) Problem Types: CWE-94 Description: SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious code that can be executed by the application over the network. On successful exploitation, an attacker can perform operations that may completely compromise the application causing a high impact on the confidentiality, integrity, and availability of the app
mpletely compromise the application causing a high impact on the confidentiality, integrity, and availability of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3262810 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-0023 State: PUBLISHED Published: 2023-01-10T03:32:49.846Z Last Updated: 2025-04-09T13:21:26.390Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: SAP Products: Bank Account Management (Manage Banks) Problem Types: CWE-200 Description: In SAP Bank Account Management (Manage Banks) application, when a user clicks a smart link to navigate to another app, personal data is shown directly in the URL. They might get captured in log files, bookmarks, and so on disclosing sensitive data of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3150704 - https
CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3150704 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-0024 State: PUBLISHED Published: 2023-02-14T03:10:22.489Z Last Updated: 2025-03-20T18:50:16.520Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: SAP Products: Solution Manager (BSP Application) Problem Types: CWE-79 Description: SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information or craft a payload which may restrict access to the desired resources, resulting in Cross-Site Scripting vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
ross-Site Scripting vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3265846 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-0025 State: PUBLISHED Published: 2023-02-14T03:10:47.861Z Last Updated: 2025-03-21T14:21:13.618Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: SAP Products: Solution Manager (BSP Application) Problem Types: CWE-79 Description: SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information or craft a payload which may restrict access to the desired resources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/32
lyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3267442 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-0026 State: PUBLISHED Published: 2023-06-21T00:00:00 Last Updated: 2024-12-06T19:18:31.348Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS, Junos OS Evolved Problem Types: CWE-20, Denial of Service (DoS) Description: An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When a BGP update message is received over an established BGP session, and that message contains a specific, optional transitive attribute, this session will be torn down with an up
session, and that message contains a specific, optional transitive attribute, this session will be torn down with an update message error. This issue cannot propagate beyond an affected system as the processing error occurs as soon as the update is received. This issue is exploitable remotely as the respective attribute can propagate through unaffected systems and intermediate AS (if any). Continuous receipt of a BGP update containing this attribute will create a sustained Denial of Service (DoS) condition. Some customers have experienced these BGP session flaps which prompted Juniper SIRT to release this advisory out of cycle before fixed releases are widely available as there is an effect
pted Juniper SIRT to release this advisory out of cycle before fixed releases are widely available as there is an effective workaround. This issue affects: Juniper Networks Junos OS 15.1R1 and later versions prior to 20.4R3-S8; 21.1 version 21.1R1 and later versions prior to 21.2R3-S6; 21.3 versions prior to 21.3R3-S5; 21.4 versions prior to 21.4R3-S4; 22.1 versions prior to 22.1R3-S4; 22.2 versions prior to 22.2R3-S2; 22.3 versions prior to 22.3R2-S2, 22.3R3-S1; 22.4 versions prior to 22.4R2-S1, 22.4R3; 23.1 versions prior to 23.1R1-S1, 23.1R2. Juniper Networks Junos OS Evolved All versions prior to 20.4R3-S8-EVO; 21.1 version 21.1R1-EVO and later versions prior to 21.2R3-S6-EVO; 21.3 versi
olved All versions prior to 20.4R3-S8-EVO; 21.1 version 21.1R1-EVO and later versions prior to 21.2R3-S6-EVO; 21.3 versions prior to 21.3R3-S5-EVO; 21.4 versions prior to 21.4R3-S4-EVO; 22.1 versions prior to 22.1R3-S4-EVO; 22.2 versions prior to 22.2R3-S2-EVO; 22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO; 22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO; 23.1 versions prior to 23.1R1-S1-EVO, 23.1R2-EVO. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA71542 - https://www.juniper.net/documentation/us/en/software/junos/bgp/topics/topic-map/bgp-error-messages.html
CVE ID: CVE-2023-0027 State: PUBLISHED Published: 2023-03-17T16:52:21.564Z Last Updated: 2025-02-26T18:36:20.083Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Rockwell Automation Products: Modbus TCP Server Add On Instructions Problem Types: CWE-200 Description: Rockwell Automation Modbus TCP Server AOI prior to 2.04.00 is vulnerable to an unauthorized user sending a malformed message that could cause the controller to respond with a copy of the most recent response to the last valid request. If exploited, an unauthorized user could read the connected device’s Modbus TCP Server AOI information. Additional Analyst Notes: - CVE Program Container: - CISA ADP
the connected device’s Modbus TCP Server AOI information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1138766
CVE ID: CVE-2023-0028 State: PUBLISHED Published: 2023-01-01T00:00:00.000Z Last Updated: 2025-04-09T15:30:52.013Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:H) Vendors: linagora Products: linagora/twake Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository linagora/twake prior to 2023.Q1.1200+. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/bfd935f4-2d1d-4d3f-8b59-522abe7dd065 - https://github.com/linagora/Twake/pull/2678/commits/c0708c397e199c68cea0db9f59d29d7dbdcdde7b
CVE ID: CVE-2023-0029 State: PUBLISHED Published: 2023-01-01T13:46:19.323Z Last Updated: 2024-08-02T04:54:32.612Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Multilaser Products: RE708 Problem Types: CWE-404 Description: A vulnerability was found in Multilaser RE708 RE1200R4GC-2T2R-V3_v3411b_MUL029B. It has been rated as problematic. This issue affects some unknown processing of the component Telnet Service. The manipulation leads to denial of service. The attack may be initiated remotely. The identifier VDB-217169 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.217169 - https://v
vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.217169 - https://vuldb.com/?ctiid.217169 - https://www.youtube.com/watch?v=yh0pK7YlmI4
CVE ID: CVE-2023-0030 State: PUBLISHED Published: 2023-03-08T00:00:00.000Z Last Updated: 2025-03-05T20:30:09.455Z Vendors: n/a Products: kernel Problem Types: CWE-416 Description: A use-after-free flaw was found in the Linux kernel’s nouveau driver in how a user triggers a memory overflow that causes the nvkm_vma_tail function to fail. This flaw allows a local user to crash or potentially escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2157270 - https://github.com/torvalds/linux/commit/729eba3355674f2d9524629b73683ba1d1cd3f10 - https://security.netapp.com/advisory/nt
ps://github.com/torvalds/linux/commit/729eba3355674f2d9524629b73683ba1d1cd3f10 - https://security.netapp.com/advisory/ntap-20230413-0010/
CVE ID: CVE-2023-0033 State: PUBLISHED Published: 2023-01-30T20:31:53.710Z Last Updated: 2025-03-27T15:41:12.443Z Vendors: Unknown Products: PDF Viewer Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The PDF Viewer WordPress plugin before 1.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2d9ae43b-75a7-4fcc-bce3-d9e9d7a97ec0
CVE ID: CVE-2023-0034 State: PUBLISHED Published: 2023-02-13T14:32:25.406Z Last Updated: 2025-01-14T21:18:37.779Z Vendors: Unknown Products: JetWidgets For Elementor Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The JetWidgets For Elementor WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ffbdb8a1-19c3-45e9-81b0-ad47a0791c4a
CVE ID: CVE-2023-0035 State: PUBLISHED Published: 2023-01-09T02:23:54.999Z Last Updated: 2025-04-09T14:09:05.707Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-287 Description: softbus_client_stub in communication subsystem within OpenHarmony-v3.0.5 and prior versions has an authentication bypass vulnerability which allows an "SA relay attack".Local attackers can bypass authentication and attack other SAs with high privilege. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2023/2023-01.md