Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-44445 State: PUBLISHED Published: 2024-05-03T02:14:08.089Z Last Updated: 2024-08-02T20:07:33.183Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NETGEAR Products: CAX30 Problem Types: CWE-121 Description: NETGEAR CAX30 SSO Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR CAX30 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the sso binary. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-l
he issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19058. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1636/ - https://kb.netgear.com/000065859/Security-Advisory-for-Pre-authentication-Buffer-Overflow-on-the-CAX30-PSV-2023-0093
CVE ID: CVE-2023-44446 State: PUBLISHED Published: 2024-05-03T02:14:08.770Z Last Updated: 2025-11-04T19:25:23.848Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GStreamer Products: GStreamer Problem Types: CWE-416 Description: GStreamer MXF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of MXF video files. The issue results from the lack of validating the exis
. The specific flaw exists within the parsing of MXF video files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22299. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1647/ - https://gstreamer.freedesktop.org/security/sa-2023-0010.html
CVE ID: CVE-2023-44447 State: PUBLISHED Published: 2024-05-03T02:14:09.524Z Last Updated: 2024-08-02T20:07:33.121Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: TP-Link Products: TL-WR902AC Problem Types: CWE-290 Description: TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR902AC routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An
s within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-21529. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1623/
CVE ID: CVE-2023-44448 State: PUBLISHED Published: 2024-05-03T02:14:10.290Z Last Updated: 2024-08-02T20:07:33.433Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: TP-Link Products: Archer A54 Problem Types: CWE-121 Description: TP-Link Archer A54 libcmm.so dm_fillObjByStr Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A54 routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the file libcmm.so. The issue results from the lack of proper validation of the length of user-supplie
law exists within the file libcmm.so. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22262. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1625/
CVE ID: CVE-2023-44449 State: PUBLISHED Published: 2024-05-03T02:14:11.010Z Last Updated: 2024-09-18T18:30:33.338Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NETGEAR Products: ProSAFE Network Management System Problem Types: CWE-89 Description: NETGEAR ProSAFE Network Management System clearAlertByIds SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability. The specific flaw exists within the clearAlertByIds function. The issue results from the lack of proper validation
lity. The specific flaw exists within the clearAlertByIds function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-21875. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1717/ - https://kb.netgear.com/000065866/Security-Advisory-for-Multiple-Vulnerabilities-on-the-NMS300-PSV-2023-0114-PSV-2023-0115
CVE ID: CVE-2023-44450 State: PUBLISHED Published: 2024-05-03T02:14:11.766Z Last Updated: 2024-09-18T18:30:34.058Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NETGEAR Products: ProSAFE Network Management System Problem Types: CWE-89 Description: NETGEAR ProSAFE Network Management System getNodesByTopologyMapSearch SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability. The specific flaw exists within the getNodesByTopologyMapSearch function. The issue results from t
t this vulnerability. The specific flaw exists within the getNodesByTopologyMapSearch function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-21858. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1718/ - https://kb.netgear.com/000065866/Security-Advisory-for-Multiple-Vulnerabilities-on-the-NMS300-PSV-2023-0114-PSV-2023-0115
CVE ID: CVE-2023-44451 State: PUBLISHED Published: 2024-05-03T02:14:12.509Z Last Updated: 2024-08-02T20:07:33.425Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Linux Mint Products: Xreader Problem Types: CWE-22 Description: Linux Mint Xreader EPUB File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EPUB files. The issue results from the lack of pro
open a malicious file. The specific flaw exists within the parsing of EPUB files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21897. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1835/ - https://github.com/linuxmint/xreader/commit/141f1313745b9cc73670df51ac145165efcbb14a
CVE ID: CVE-2023-44452 State: PUBLISHED Published: 2024-05-03T02:14:13.246Z Last Updated: 2024-08-08T14:58:50.450Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Linux Mint Products: Xreader Problem Types: CWE-88 Description: Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CBT files. The issue results from the lack of proper
en a malicious file. The specific flaw exists within the parsing of CBT files. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22132. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1836/ - https://github.com/linuxmint/xreader/commit/cd678889ecfe4e84a5cbcf3a0489e15a5e2e3736
CVE ID: CVE-2023-44463 State: PUBLISHED Published: 2023-10-02T00:00:00 Last Updated: 2024-09-23T16:19:47.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration files causes the application to trust unchecked X-Forwarded-For headers even though it has not been configured to do so. This can lead to IP address spoofing by users of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pretix.eu/about/en/ticketing - https://github.com/pretix/pretix/tags - https://github.com/pretix/pretix/compare/v2023.7.0...v2023.7.1 - https://github.com/preti
ithub.com/pretix/pretix/tags - https://github.com/pretix/pretix/compare/v2023.7.0...v2023.7.1 - https://github.com/pretix/pretix/commit/ccdce2ccb8207b82501af3c03f50abc0f819b469 - https://pretix.eu/about/en/blog/20230911-release-2023-7-1/
CVE ID: CVE-2023-44464 State: PUBLISHED Published: 2023-09-29T00:00:00 Last Updated: 2024-09-23T16:36:45.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: pretix before 2023.7.2 allows Pillow to parse EPS files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pretix.eu/about/en/ticketing - https://github.com/pretix/pretix/tags - https://github.com/pretix/pretix/compare/v2023.7.1...v2023.7.2 - https://github.com/pretix/pretix/commit/8583bfb7d97263e9e923ad5d7f123ca1cadc8f2e - https://pretix.eu/about/de/blog/20230912-release-2023-7-2/
CVE ID: CVE-2023-44466 State: PUBLISHED Published: 2023-09-29T00:00:00 Last Updated: 2024-08-02T20:07:33.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel before 6.4.5. There is an integer signedness error, leading to a buffer overflow and remote code execution via HELLO or one of the AUTH frames. This occurs because of an untrusted length taken from a TCP packet in ceph_decode_32. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/security-research/security/advisories/GHSA-jg27-jx6w-xwph - https://www.spinics.net/lists/ceph-devel/msg57909.html - https://github.com/tor
ecurity/advisories/GHSA-jg27-jx6w-xwph - https://www.spinics.net/lists/ceph-devel/msg57909.html - https://github.com/torvalds/linux/commit/a282a2f10539dce2aa619e71e1817570d557fc97 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a282a2f10539dce2aa619e71e1817570d557fc97 - https://security.netapp.com/advisory/ntap-20231116-0003/
CVE ID: CVE-2023-44467 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-08-02T20:07:33.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via __import__ in Python code, which is not prohibited by pal_chain/base.py. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/langchain-ai/langchain/commit/4c97a10bd0d9385cfee234a63b5bd826a295e483
CVE ID: CVE-2023-44469 State: PUBLISHED Published: 2023-09-29T00:00:00 Last Updated: 2024-09-23T16:32:58.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arbitrary URLs through the request_uri authorization parameter. This is similar to CVE-2020-10770. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2998 - https://security.lauritz-holtmann.de/post/sso-security-ssrf/ - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/relea
https://security.lauritz-holtmann.de/post/sso-security-ssrf/ - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.17.1 - https://lists.debian.org/debian-lts-announce/2023/10/msg00014.html
CVE ID: CVE-2023-44470 State: PUBLISHED Published: 2023-10-10T13:59:01.385Z Last Updated: 2024-09-18T18:20:20.332Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Kvvaradha Products: Kv TinyMCE Editor Add Fonts Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Kvvaradha Kv TinyMCE Editor Add Fonts plugin <= 1.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/kv-tinymce-editor-fonts/wordpress-kv-tinymce-editor-add-fonts-plugin-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-44471 State: PUBLISHED Published: 2023-10-10T14:22:55.834Z Last Updated: 2024-09-18T18:20:07.742Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Bernhard Kau Products: Backend Localization Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Bernhard Kau Backend Localization plugin <= 2.1.10 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/kau-boys-backend-localization/wordpress-backend-localization-plugin-2-1-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-44472 State: PUBLISHED Published: 2024-05-03T07:33:51.972Z Last Updated: 2024-08-02T20:07:33.224Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: ThemeFuse Products: Unyson Problem Types: CWE-862 Description: Missing Authorization vulnerability in ThemeFuse Unyson.This issue affects Unyson: from n/a through 2.7.28. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/unyson/wordpress-unyson-plugin-2-7-28-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-44473 State: PUBLISHED Published: 2023-10-09T10:08:47.756Z Last Updated: 2024-09-19T14:02:44.075Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Michael Tran Products: Table of Contents Plus Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Michael Tran Table of Contents Plus plugin <= 2302 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/table-of-contents-plus/wordpress-table-of-contents-plus-plugin-2302-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-44474 State: PUBLISHED Published: 2023-10-02T08:53:03.698Z Last Updated: 2024-09-20T15:28:43.533Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: MD Jakir Hosen Products: Tiger Forms – Drag and Drop Form Builder Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in MD Jakir Hosen Tiger Forms – Drag and Drop Form Builder plugin <= 2.0.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/tiger-form/wordpress-tiger-forms-plugin-2-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-44475 State: PUBLISHED Published: 2023-10-10T14:25:19.501Z Last Updated: 2024-09-18T18:19:42.903Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Michael Simpson Products: Add Shortcodes Actions And Filters Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Michael Simpson Add Shortcodes Actions And Filters plugin <= 2.0.9 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/add-actions-and-filters/wordpress-add-shortcodes-actions-and-filters-plugin-2-0-9-multiple-cross-site-request-forgery-csrf-vulnerability?_s_id
s/wordpress-add-shortcodes-actions-and-filters-plugin-2-0-9-multiple-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-44476 State: PUBLISHED Published: 2023-10-10T14:28:09.364Z Last Updated: 2024-09-18T16:04:27.568Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Andres Felipe Perea V. Products: CopyRightPro Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Andres Felipe Perea V. CopyRightPro plugin <= 2.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/copyrightpro/wordpress-copyrightpro-plugin-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-44477 State: PUBLISHED Published: 2023-10-02T08:55:38.171Z Last Updated: 2024-09-20T15:29:12.685Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Boxy Studio Products: Cooked Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Boxy Studio Cooked plugin <= 1.7.13 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/cooked/wordpress-cooked-plugin-1-7-13-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-44478 State: PUBLISHED Published: 2024-05-17T08:28:33.328Z Last Updated: 2024-08-02T20:07:33.189Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L) Vendors: WP Hive Products: Events Rich Snippets for Google Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Hive Events Rich Snippets for Google allows Exploitation of Trusted Credentials.This issue affects Events Rich Snippets for Google: from n/a through 1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/rich-snippets-vevents/wordpress-events-rich-snippets-for-google-plugin-1-8-
ttps://patchstack.com/database/vulnerability/rich-snippets-vevents/wordpress-events-rich-snippets-for-google-plugin-1-8-csrf-leading-to-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2023-44479 State: PUBLISHED Published: 2023-10-02T08:13:52.369Z Last Updated: 2025-02-19T21:22:57.064Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Jim Krill Products: WP Jump Menu Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jim Krill WP Jump Menu plugin <= 3.6.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-jump-menu/wordpress-wp-jump-menu-plugin-3-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-44480 State: PUBLISHED Published: 2023-10-27T20:52:46.311Z Last Updated: 2024-09-09T17:14:16.879Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Leave Management System Project Problem Types: CWE-89 Description: Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setcasualleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://projectworlds.in/ - https://fluidattacks
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://projectworlds.in/ - https://fluidattacks.com/advisories/martin/
CVE ID: CVE-2023-44481 State: PUBLISHED Published: 2023-12-21T18:58:20.939Z Last Updated: 2024-09-12T19:52:52.641Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Leave Management System Project Problem Types: CWE-89 Description: Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setearnleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://projectworlds.in/ - https://fluidattacks.c
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://projectworlds.in/ - https://fluidattacks.com/advisories/martin/
CVE ID: CVE-2023-44482 State: PUBLISHED Published: 2023-12-21T18:59:05.773Z Last Updated: 2024-11-27T18:42:26.664Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Leave Management System Project Problem Types: CWE-89 Description: Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setsickleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://projectworlds.in/ - https://fluidattacks.c
CVE ID: CVE-2023-44483 State: PUBLISHED Published: 2023-10-20T09:23:53.483Z Last Updated: 2025-11-03T21:49:47.169Z Vendors: Apache Software Foundation Products: Apache Santuario Problem Types: CWE-532 Description: All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/vm
tional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/vmqbp9mfxtrf0kmbnnmbn3h9j6dr9q55 - http://www.openwall.com/lists/oss-security/2023/10/20/5