Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-4118 State: PUBLISHED Published: 2023-08-03T08:00:05.998Z Last Updated: 2025-07-09T13:40:48.932Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: Cute Http File Server Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in Cute Http File Server 2.0. This affects an unknown part of the component Search. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235965 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any wa
assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.235965 - https://vuldb.com/?ctiid.235965 - https://github.com/goodric/chfs
CVE ID: CVE-2023-4119 State: PUBLISHED Published: 2023-08-03T08:31:03.018Z Last Updated: 2024-10-11T18:23:36.154Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Academy Products: LMS Problem Types: CWE-79 Description: A vulnerability has been found in Academy LMS 6.0 and classified as problematic. This vulnerability affects unknown code of the file /academy/home/courses. The manipulation of the argument query/sort_by leads to cross site scripting. The attack can be initiated remotely. VDB-235966 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Contai
was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.235966 - https://vuldb.com/?ctiid.235966 - http://packetstormsecurity.com/files/173941/Academy-LMS-6.0-Cross-Site-Scripting.html
CVE ID: CVE-2023-4120 State: PUBLISHED Published: 2023-08-03T09:00:06.902Z Last Updated: 2024-10-15T20:13:16.771Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Byzoro Products: Smart S85F Management Platform Problem Types: CWE-77 Description: A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230722 and classified as critical. This issue affects some unknown processing of the file importhtml.php. The manipulation of the argument sql leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235967. NOTE: The vendor was contacted ea
public and may be used. The associated identifier of this vulnerability is VDB-235967. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.235967 - https://vuldb.com/?ctiid.235967 - https://vuldb.com/?submit.185751 - https://github.com/RCEraser/cve/blob/main/rce.md
CVE ID: CVE-2023-4121 State: PUBLISHED Published: 2023-08-03T09:31:04.009Z Last Updated: 2024-08-02T07:17:11.920Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Byzoro Products: Smart S85F Management Platform Problem Types: CWE-434 Description: A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230722. It has been classified as critical. Affected is an unknown function. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235968. NOTE: The vendor was contacted early about this disclo
may be used. The identifier of this vulnerability is VDB-235968. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.235968 - https://vuldb.com/?ctiid.235968 - https://vuldb.com/?submit.185755 - https://github.com/torres14852/cve/blob/main/upload.md
CVE ID: CVE-2023-4122 State: PUBLISHED Published: 2023-12-07T23:10:04.387Z Last Updated: 2025-05-28T13:51:13.982Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Kashipara Group Products: Student Information System Problem Types: CWE-434 Description: Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'photo' parameter of my-profile page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/rubinstein/ - https://www.kashipara.com/
CVE ID: CVE-2023-4124 State: PUBLISHED Published: 2023-08-03T03:05:32.060Z Last Updated: 2024-10-10T20:22:32.785Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: answerdev Products: answerdev/answer Problem Types: CWE-862 Description: Missing Authorization in GitHub repository answerdev/answer prior to v1.1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/2c684f99-d181-4106-8ee2-64a76ae6a348 - https://github.com/answerdev/answer/commit/964195fd859ee5d7171fac847374dfa31893e793
CVE ID: CVE-2023-4125 State: PUBLISHED Published: 2023-08-03T03:06:49.367Z Last Updated: 2024-10-10T20:21:47.494Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: answerdev Products: answerdev/answer Problem Types: CWE-521 Description: Weak Password Requirements in GitHub repository answerdev/answer prior to v1.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/85bfd18f-8d3b-4154-8b7b-1f8fcf704e28 - https://github.com/answerdev/answer/commit/7d23b17cdbbefcd2e7b5c3150f0b5ec908dc835f
CVE ID: CVE-2023-4126 State: PUBLISHED Published: 2023-08-03T03:08:57.887Z Last Updated: 2024-10-10T20:16:50.358Z Severity: MEDIUM (CVSS 4.1 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: answerdev Products: answerdev/answer Problem Types: CWE-613 Description: Insufficient Session Expiration in GitHub repository answerdev/answer prior to v1.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/7f50bf1c-bcb9-46ca-8cec-211493d280c5 - https://github.com/answerdev/answer/commit/4f468b58d0dea51290bfbdd3e96332b0014c8730
CVE ID: CVE-2023-4127 State: PUBLISHED Published: 2023-08-03T03:20:57.777Z Last Updated: 2024-10-10T20:15:44.062Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: answerdev Products: answerdev/answer Problem Types: CWE-366 Description: Race Condition within a Thread in GitHub repository answerdev/answer prior to v1.1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/cf7d19e3-1318-4c77-8366-d8d04a0b41ba - https://github.com/answerdev/answer/commit/47661dc8a356ce6aa7793f1bd950399292180182
CVE ID: CVE-2023-4128 State: REJECTED Published: 2023-08-10T16:50:25.184Z Last Updated: 2023-11-14T11:27:04.495Z Description: No description available.
CVE ID: CVE-2023-4129 State: PUBLISHED Published: 2023-09-27T15:44:02.272Z Last Updated: 2024-09-23T15:06:03.197Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: Data Protection Central Problem Types: CWE-326 Description: Dell Data Protection Central, version 19.9, contains an Inadequate Encryption Strength Vulnerability. An unauthenticated network attacker could potentially exploit this vulnerability, allowing an attacker to recover plaintext from a block of ciphertext. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000218045/dsa-2023-346-security-update-for-d
SA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000218045/dsa-2023-346-security-update-for-dell-data-protection-central
CVE ID: CVE-2023-4130 State: PUBLISHED Published: 2025-08-16T13:27:58.227Z Last Updated: 2025-08-19T05:47:15.732Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea() There are multiple smb2_ea_info buffers in FILE_FULL_EA_INFORMATION request from client. ksmbd find next smb2_ea_info using ->NextEntryOffset of current smb2_ea_info. ksmbd need to validate buffer length Before accessing the next ea. ksmbd should check buffer length using buf_len, not next variable. next is the start offset of current ea that got from previous ea. References: - https://git.kernel.org/
t next variable. next is the start offset of current ea that got from previous ea. References: - https://git.kernel.org/stable/c/aeb974907642be095e38ecb1a400ca583958b2b0 - https://git.kernel.org/stable/c/f339d76a3a972601d0738b881b099d49ebbdc3a2 - https://git.kernel.org/stable/c/4bf629262f9118ee91b1c3a518ebf2b3bcb22180 - https://git.kernel.org/stable/c/79ed288cef201f1f212dfb934bcaac75572fb8f6
CVE ID: CVE-2023-4131 State: REJECTED Published: N/A Last Updated: 2025-08-21T22:19:52.011Z Description: No description available.
CVE ID: CVE-2023-4132 State: PUBLISHED Published: 2023-08-03T14:32:15.246Z Last Updated: 2025-11-07T13:03:42.247Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 Problem Types: CWE-416 Description: A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This
smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:6901 - https://access.redhat.com/errata/RHSA-2023:7077 - https://access.redhat.com/errata/RHSA-2024:0575 - https://access.redhat.com/errata/RHSA-2024:0724 - https://access.redhat.com/security/cve/CVE-2023-4132 - https://bugzilla.redhat.com/show_bug.cgi?id=2221707
CVE ID: CVE-2023-4133 State: PUBLISHED Published: 2023-08-03T14:32:12.421Z Last Updated: 2025-11-06T19:46:38.846Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-416 Description: A use-after-free vulnerability was found in the cxgb4 driver in the Linux kernel. The bug occurs when the cxgb4 device is detaching due to a possible rearming of the flower_stats_timer from the work queue. This flaw allows a local user to crash the system, causing a denial of service condition. Additional Analyst Notes: - CVE Program Con
ows a local user to crash the system, causing a denial of service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:2394 - https://access.redhat.com/errata/RHSA-2024:2950 - https://access.redhat.com/errata/RHSA-2024:3138 - https://access.redhat.com/security/cve/CVE-2023-4133 - https://bugzilla.redhat.com/show_bug.cgi?id=2221702
CVE ID: CVE-2023-4134 State: PUBLISHED Published: 2024-11-14T10:44:42.864Z Last Updated: 2024-11-14T19:34:19.393Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-416 Description: A use-after-free vulnerability was found in the cyttsp4_core driver in the Linux kernel. This issue occurs in the device cleanup routine due to a possible rearming of the watchdog_timer from the workqueue. This could allow a local user to crash the system, causing a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
low a local user to crash the system, causing a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-4134 - https://bugzilla.redhat.com/show_bug.cgi?id=2221700
CVE ID: CVE-2023-4135 State: PUBLISHED Published: 2023-08-04T13:19:15.760Z Last Updated: 2024-08-02T07:17:11.930Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: n/a, Red Hat, Fedora Products: qemu-kvm, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8 Advanced Virtualization, Red Hat Enterprise Linux 9, Fedora, Extra Packages for Enterprise Linux Problem Types: CWE-125 Description: A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU. The QEMU process does not validate an offset provided by the guest before computing a host heap pointer, which is used for copying data b
does not validate an offset provided by the guest before computing a host heap pointer, which is used for copying data back to the guest. Arbitrary heap memory relative to an allocated buffer can be disclosed. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-4135 - https://bugzilla.redhat.com/show_bug.cgi?id=2229101 - https://security.netapp.com/advisory/ntap-20230915-0012/ - https://www.zerodayinitiative.com/advisories/ZDI-CAN-21521
CVE ID: CVE-2023-4136 State: PUBLISHED Published: 2023-08-03T13:33:10.409Z Last Updated: 2025-02-13T17:09:02.003Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: CrafterCMS Products: CrafterCMS Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.craftercms.org/en/4.0/security/advisory.html#cv-2023080301 - http://
- CISA ADP Vulnrichment: References: - https://docs.craftercms.org/en/4.0/security/advisory.html#cv-2023080301 - http://seclists.org/fulldisclosure/2023/Aug/30 - http://packetstormsecurity.com/files/174304/CrafterCMS-4.0.2-Cross-Site-Scripting.html
CVE ID: CVE-2023-4138 State: PUBLISHED Published: 2023-08-03T13:41:50.659Z Last Updated: 2024-10-11T18:19:21.848Z Severity: MEDIUM (CVSS 4.2 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-770 Description: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/1b1fa915-d588-4bb1-9e82-6a6be79befed - https://github.com/ikus060/rdiffweb/commit/feef0d7b11d86aed29bf98c21526088117964d85
CVE ID: CVE-2023-4139 State: PUBLISHED Published: 2023-08-04T02:04:27.318Z Last Updated: 2025-02-05T19:37:39.876Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: smackcoders Products: Import All Pages, Post types, Products, Orders, and Users as XML & CSV Problem Types: CWE-200 Information Exposure Description: The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export folder indexing in versions up to, and including, 7.9.8. This makes it possible for unauthenticated attackers to list and view exported files. Additional Analyst Notes: - CVE Program Container: - CIS
for unauthenticated attackers to list and view exported files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6404476e-0c32-4f8e-882f-6a1785ba5748?source=cve - https://plugins.trac.wordpress.org/changeset/2944635/wp-ultimate-csv-importer/trunk/wp-ultimate-csv-importer.php
CVE ID: CVE-2023-4140 State: PUBLISHED Published: 2023-08-04T02:04:24.655Z Last Updated: 2025-02-05T19:37:47.687Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: smackcoders Products: Import All Pages, Post types, Products, Orders, and Users as XML & CSV Problem Types: CWE-269 Improper Privilege Management Description: The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insufficient restriction on the 'get_header_values' function. This makes it possible for authenticated attackers, with minimal permissions such as an author, if the administrator previously grants access in the
uthenticated attackers, with minimal permissions such as an author, if the administrator previously grants access in the plugin settings, to modify their user role by supplying the 'wp_capabilities->cus1' parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5fdba41f-daa5-44e8-bc47-aa8b7bd31054?source=cve - https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.9.6/importExtensions/ImportHelpers.php#L205 - https://plugins.trac.wordpress.org/changeset/2944635/wp-ultimate-csv-importer/trunk/wp-ultimate-csv-importer.php
CVE ID: CVE-2023-4141 State: PUBLISHED Published: 2023-08-04T02:04:28.826Z Last Updated: 2025-02-05T19:37:31.557Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: smackcoders Products: Import All Pages, Post types, Products, Orders, and Users as XML & CSV Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to create a PHP fil
or-level permissions or above, if the administrator previously grants access in the plugin settings, to create a PHP file and execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that this means php file creation is still allowed for site administrators, use the plugin with caution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b4fe8b1f-da1c-4f94-9ab4-272766b488c3?source=cve - https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.9.6/importExtensions/ImportHelpers.php#L205 - https:
/plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.9.6/importExtensions/ImportHelpers.php#L205 - https://plugins.trac.wordpress.org/changeset/2944635/wp-ultimate-csv-importer/trunk/wp-ultimate-csv-importer.php
CVE ID: CVE-2023-4142 State: PUBLISHED Published: 2023-08-04T02:04:30.714Z Last Updated: 2025-02-05T19:37:21.869Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: smackcoders Products: Import All Pages, Post types, Products, Orders, and Users as XML & CSV Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus1' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to execute code on
or-level permissions or above, if the administrator previously grants access in the plugin settings, to execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that this means remote code execution is still possible for site administrators, use the plugin with caution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/db1bad2e-55df-40c5-9a3f-651858a19b42?source=cve - https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.9.6/importExtensions/ImportHelpers.php#L205 - https://plugins.trac.wo
dpress.org/browser/wp-ultimate-csv-importer/tags/7.9.6/importExtensions/ImportHelpers.php#L205 - https://plugins.trac.wordpress.org/changeset/2944635/wp-ultimate-csv-importer/trunk/wp-ultimate-csv-importer.php
CVE ID: CVE-2023-4143 State: REJECTED Published: N/A Last Updated: 2025-08-21T22:19:51.837Z Description: No description available.
CVE ID: CVE-2023-4145 State: PUBLISHED Published: 2023-08-03T16:04:11.248Z Last Updated: 2024-10-11T18:18:22.385Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: pimcore Products: pimcore/customer-data-framework Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/ce852777-2994-40b4-bb4e-c4d10023eeb0 - https://github.com/pimcore/customer-data-framework/commit/72f45dd537a706954e7a71c99fbe318640e846a2
CVE ID: CVE-2023-4147 State: PUBLISHED Published: 2023-08-07T13:19:43.593Z Last Updated: 2025-11-20T07:12:49.304Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Problem Types: CWE-416 Description: A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
alate their privileges on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2023:5069 - https://access.redhat.com/errata/RHSA-2023:5091 - https://access.redhat.com/errata/RHSA-2023:5093 - https://access.redhat.com/errata/RHSA-2023:7382 - https://access.redhat.com/errata/RHSA-2023:7389 - https://access.redhat.com/errata/RHSA-2023:7411 - https://access.redhat.com/security/cve/CVE-2023-4147 - https://bugzilla.redhat.com/show_bug.cgi?id=2225239 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0ebc1064e4874d5987722a2ddbc18f94aa53b211 - https://www.spinics.net/lists/stable/msg67
/git/torvalds/linux.git/commit/?id=0ebc1064e4874d5987722a2ddbc18f94aa53b211 - https://www.spinics.net/lists/stable/msg671573.html
CVE ID: CVE-2023-4148 State: PUBLISHED Published: 2023-09-25T15:56:54.696Z Last Updated: 2025-05-01T15:32:25.859Z Vendors: Unknown Products: Ditty Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/aa39de78-55b3-4237-84db-6fdf6820c58d