Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-5753 State: PUBLISHED Published: 2023-10-24T16:09:03.896Z Last Updated: 2025-02-13T17:25:50.060Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-120, CWE-191 Description: Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hmpr-px56-rvww - http://www.openwall.com/lists/oss-security/2023/11/07/1 - http://seclists.org/fulldisclosure/2023/Nov/1 - http://packetstormsecurity.com/files/175657/
oss-security/2023/11/07/1 - http://seclists.org/fulldisclosure/2023/Nov/1 - http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html
CVE ID: CVE-2023-5754 State: PUBLISHED Published: 2023-10-26T19:47:06.226Z Last Updated: 2025-01-16T21:27:38.467Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Sielco Products: PolyEco1000 Problem Types: CWE-307 Description: Sielco PolyEco1000 uses a weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07
CVE ID: CVE-2023-5755 State: REJECTED Published: N/A Last Updated: 2024-04-03T14:11:49.935Z Description: No description available.
CVE ID: CVE-2023-5756 State: PUBLISHED Published: 2023-12-09T06:51:59.433Z Last Updated: 2024-08-02T08:07:32.758Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: supsysticcom Products: Digital Publications by Supsystic Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Digital Publications by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.6. This is due to missing or incorrect nonce validation on the AJAX action handler. This makes it possible for unauthenticated attackers to execute AJAX actions via a forged request granted they can trick a site administrator into perfo
henticated attackers to execute AJAX actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2304e4dc-0dc6-4ded-b8e6-8d76d70f63d7?source=cve - https://plugins.trac.wordpress.org/browser/digital-publications-by-supsystic/trunk/classes/frame.php#L144
CVE ID: CVE-2023-5757 State: PUBLISHED Published: 2023-12-11T19:22:40.578Z Last Updated: 2024-08-02T08:07:32.638Z Vendors: Unknown Products: WP Crowdfunding Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Crowdfunding WordPress plugin before 2.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2adc5995-03a9-4860-b00b-7f8d7fe18058
CVE ID: CVE-2023-5758 State: PUBLISHED Published: 2023-10-24T20:11:15.306Z Last Updated: 2025-06-12T15:00:36.041Z Vendors: Mozilla Products: Firefox for iOS Problem Types: Cross-Site Scripting (XSS) in reader mode Description: When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site Scripting (XSS) attack. This vulnerability affects Firefox for iOS < 119. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1850019 - https://www.mozilla.org/security/advisories/mfsa2023-48/ - https://security.gentoo.org/glsa/202401-10
CVE ID: CVE-2023-5759 State: PUBLISHED Published: 2023-11-08T15:48:18.816Z Last Updated: 2024-11-11T14:27:10.480Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Helix Products: Helix Core Problem Types: CWE-400 Description: In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the buffer was identified. Reported by Jason Geffner. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://perforce.com
CVE ID: CVE-2023-5760 State: PUBLISHED Published: 2023-11-08T16:36:29.217Z Last Updated: 2024-09-03T20:20:38.486Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Avast/AVG Products: Avast/Avg Antivirus Problem Types: CWE-367 Description: A time-of-check to time-of-use (TOCTOU) bug in handling of IOCTL (input/output control) requests. This TOCTOU bug leads to an out-of-bounds write vulnerability which can be further exploited, allowing an attacker to gain full local privilege escalation on the system.This issue affects Avast/Avg Antivirus: 23.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.norton.com/
8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.norton.com/sp/static/external/tools/security-advisories.html
CVE ID: CVE-2023-5761 State: PUBLISHED Published: 2023-12-07T02:00:05.488Z Last Updated: 2024-08-02T08:07:32.680Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: rogierlankhorst, Really Simple Plugins Products: Burst Statistics – Privacy-Friendly Analytics for WordPress, Burst Statistics Pro Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'url' parameter in versions 1.4.0 to 1.4.6.1 (free) and versions 1.4.0 to 1.5.0 (pro) due to insufficient escaping on the user
arameter in versions 1.4.0 to 1.4.6.1 (free) and versions 1.4.0 to 1.5.0 (pro) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/30f8419c-c7b9-4c68-a845-26c0308d76f3?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2976467%40burst-statistics&new=2976467%40burst-statistics&sf
wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2976467%40burst-statistics&new=2976467%40burst-statistics&sfp_email=&sfph_mail=
CVE ID: CVE-2023-5762 State: PUBLISHED Published: 2023-12-04T21:28:22.256Z Last Updated: 2024-08-02T08:07:32.666Z Vendors: Unknown Products: Filr Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The Filr WordPress plugin before 1.2.3.6 is vulnerable from an RCE (Remote Code Execution) vulnerability, which allows the operating system to execute commands and fully compromise the server on behalf of a user with Author-level privileges. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6ad99725-eccc-4b61-bce2-668b62619deb
CVE ID: CVE-2023-5763 State: PUBLISHED Published: 2023-11-03T06:40:43.441Z Last Updated: 2024-09-05T19:04:31.768Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Eclipse Foundation Products: Glassfish Problem Types: CWE-913, CWE-20 Description: In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or < 7u201, or < 8u191), allows remote attackers to load malicious code on the server via access to insecure ORB listeners. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://glassfish.org/docs/latest/security-guide.html#securing-glassfish-server - https://gitlab.eclipse.org/security/cve-assi
//glassfish.org/docs/latest/security-guide.html#securing-glassfish-server - https://gitlab.eclipse.org/security/cve-assignement/-/issues/14
CVE ID: CVE-2023-5764 State: PUBLISHED Published: 2023-12-12T22:01:33.467Z Last Updated: 2025-11-20T18:07:16.802Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9 Problem Types: CWE-1336 Description: A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
introduce templating injection when supplying templating data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:7773 - https://access.redhat.com/security/cve/CVE-2023-5764 - https://bugzilla.redhat.com/show_bug.cgi?id=2247629
CVE ID: CVE-2023-5765 State: PUBLISHED Published: 2023-11-01T17:12:15.912Z Last Updated: 2024-09-06T15:47:08.487Z Vendors: Devolutions Products: Remote Desktop Manager Description: Improper access control in the password analyzer feature in Devolutions Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to bypass permissions via data source switching. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2023-0019/
CVE ID: CVE-2023-5766 State: PUBLISHED Published: 2023-11-01T17:08:03.162Z Last Updated: 2024-09-06T18:45:42.992Z Vendors: Devolutions Products: Remote Desktop Manager Description: A remote code execution vulnerability in Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to remotely execute code from another windows user session on the same host via a specially crafted TCP packet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2023-0019/
CVE ID: CVE-2023-5767 State: PUBLISHED Published: 2023-12-04T14:30:23.253Z Last Updated: 2024-08-02T08:07:32.705Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L) Vendors: Hitachi Energy Products: RTU500 Description: A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. A malicious actor could perform cross-site scripting on the webserver due to an RDT language file being improperly sanitized. Additional Analyst Notes: - CVE Program Container: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000176&languageCode=en&Preview=true
CVE ID: CVE-2023-5768 State: PUBLISHED Published: 2023-12-04T14:33:47.898Z Last Updated: 2024-08-02T08:07:32.849Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Hitachi Energy Products: RTU500 series Description: A vulnerability exists in the HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Incomplete or wrong received APDU frame layout may cause blocking on link layer. Error reason was an endless blocking when reading incoming frames on link layer with wrong length information of APDU or delayed reception of data octets. Only communication link of affected HCI IEC 60870-5-104 is blocked. If attack sequence stops the communi
of data octets. Only communication link of affected HCI IEC 60870-5-104 is blocked. If attack sequence stops the communication to the previously attacked link gets normal again. Additional Analyst Notes: - CVE Program Container: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000176&languageCode=en&Preview=true
CVE ID: CVE-2023-5769 State: PUBLISHED Published: 2023-12-14T16:19:51.846Z Last Updated: 2024-08-02T08:07:32.850Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Hitachi Energy Products: RTU500 Description: A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. A malicious actor could perform cross-site scripting on the webserver due to user input being improperly sanitized. Additional Analyst Notes: - CVE Program Container: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000176&languageCode=en&Preview=true
CVE ID: CVE-2023-5770 State: PUBLISHED Published: 2024-01-09T22:02:03.839Z Last Updated: 2025-06-03T14:29:46.790Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Proofpoint Products: Proofpoint Enterprise Protection Problem Types: CWE-838 Description: Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject. The vulnerability is caused by inappropriate encoding when rewriting the email before delivery.This issue affects Proofpoint Enterprise Protection: from 8.20.2 before patch 4809, from 8.20.0 bef
mail before delivery.This issue affects Proofpoint Enterprise Protection: from 8.20.2 before patch 4809, from 8.20.0 before patch 4805, from 8.18.6 before patch 4804 and all other prior versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0009
CVE ID: CVE-2023-5771 State: PUBLISHED Published: 2023-11-06T20:06:28.575Z Last Updated: 2024-09-04T18:55:47.857Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Proofpoint Products: Proofpoint Enterprise Protection Problem Types: CWE-79 Description: Proofpoint Enterprise Protection contains a stored XSS vulnerability in the AdminUI. An unauthenticated attacker can send a specially crafted email with HTML in the subject which triggers XSS when viewing quarantined messages. This issue affects Proofpoint Enterprise Protection: from 8.20.0 before patch 4796, from 8.18.6 before patch 4795 and all other prior versions. Additional Analyst Notes: - CVE Program Cont
ore patch 4796, from 8.18.6 before patch 4795 and all other prior versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0010
CVE ID: CVE-2023-5772 State: PUBLISHED Published: 2023-11-30T03:32:49.964Z Last Updated: 2024-08-02T08:07:32.668Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: qriouslad Products: Debug Log Manager Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Debug Log Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the clear_log() function. This makes it possible for unauthenticated attackers to clear the debug log via a forged request granted they can trick a site administrator into performing an action such as clickin
the debug log via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7e539549-1125-4b0e-aa3c-c8844041c23a?source=cve - https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.2.0/classes/class-debug-log.php#L822 - https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.2.2/classes/class-debug-log.php#L828
CVE ID: CVE-2023-5773 State: REJECTED Published: N/A Last Updated: 2023-11-27T21:42:55.097Z Description: No description available.
CVE ID: CVE-2023-5774 State: PUBLISHED Published: 2023-10-27T10:59:12.331Z Last Updated: 2025-02-05T18:57:36.047Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: freeben Products: Animated Counters Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Animated Counters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to i
upplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/33c2756d-c300-479f-b3aa-8f22c3a70278?source=cve - https://drive.google.com/file/d/1zXWW545ktCznO36k90AN0APhTz8ky-gG/view?usp=sharing - https://plugins.trac.wordpress.org/changeset/2984228/
CVE ID: CVE-2023-5775 State: PUBLISHED Published: 2024-02-24T08:38:14.650Z Last Updated: 2024-08-02T08:07:32.667Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: wp_media Products: BackWPup – WordPress Backup Plugin Problem Types: CWE-256 Unprotected Storage of Credentials Description: The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination Password in all versions up to, and including, 4.0.2. This is due to to the plugin improperly storing backup destination passwords in plaintext. This makes it possible for authenticated attackers, with administrator-level access, to retrieve the password from the password input field in the
authenticated attackers, with administrator-level access, to retrieve the password from the password input field in the UI or from the options table where the password is stored. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4bce4f04-e622-468a-ac7e-5903ad50cc13?source=cve - https://plugins.trac.wordpress.org/changeset/3039678/backwpup
CVE ID: CVE-2023-5776 State: PUBLISHED Published: 2023-11-21T08:32:47.939Z Last Updated: 2024-10-11T18:06:53.707Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: gandhihitesh9 Products: Post Meta Data Manager Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Post Meta Data Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the pmdm_wp_ajax_delete_meta, pmdm_wp_delete_user_meta, and pmdm_wp_delete_user_meta functions. This makes it possible for unauthenticated attackers to delete arbitrary user, term, and post meta via a forged
nctions. This makes it possible for unauthenticated attackers to delete arbitrary user, term, and post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d49b8c44-4dad-4990-a8a8-116b424a7dfa?source=cve - https://plugins.svn.wordpress.org/post-meta-data-manager/tags/1.2.1/readme.txt - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2981559%40post-meta-data-manager&new=2981559%40post-meta-data-manager&sfp_email=&sfph_mail= - https://plugins.tra
e=&old=2981559%40post-meta-data-manager&new=2981559%40post-meta-data-manager&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2994271%40post-meta-data-manager&new=2994271%40post-meta-data-manager&sfp_email=&sfph_mail=
CVE ID: CVE-2023-5777 State: PUBLISHED Published: 2023-11-06T19:26:09.044Z Last Updated: 2025-01-16T21:26:49.870Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Weintek Products: EasyBuilder Pro Problem Types: CWE-798 Description: Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the private key is exposed to the public, which could result in obtaining remote control of the crash report server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-05
CVE ID: CVE-2023-5779 State: PUBLISHED Published: 2024-02-18T07:46:41.927Z Last Updated: 2024-08-28T16:31:48.264Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-787 Description: can: out of bounds in remove_rx_filter function Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7cmj-963q-jj47
CVE ID: CVE-2023-5780 State: PUBLISHED Published: 2023-10-26T12:00:07.857Z Last Updated: 2024-08-02T08:07:32.733Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Tongda Products: OA 2017 Problem Types: CWE-89 Description: A vulnerability classified as critical was found in Tongda OA 2017 11.10. This vulnerability affects unknown code of the file general/system/approve_center/flow_guide/flow_type/set_print/delete.php. The manipulation of the argument DELETE_STR leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-243586 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early
blic and may be used. VDB-243586 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.243586 - https://vuldb.com/?ctiid.243586 - https://github.com/RCEraser/cve/blob/main/sql_inject_5.md
CVE ID: CVE-2023-5781 State: PUBLISHED Published: 2023-10-26T12:31:04.961Z Last Updated: 2024-08-02T08:07:32.665Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Tongda Products: OA 2017 Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in Tongda OA 2017 11.10. This issue affects the function DELETE_STR of the file general/system/res_manage/monitor/delete_webmail.php. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243587. NOTE: The vendor was contacted early about this disclosure bu
associated identifier of this vulnerability is VDB-243587. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.243587 - https://vuldb.com/?ctiid.243587 - https://github.com/wangxinyudad/cve/blob/main/sql.md
CVE ID: CVE-2023-5782 State: PUBLISHED Published: 2023-10-26T13:31:04.119Z Last Updated: 2024-08-02T08:07:32.655Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Tongda Products: OA 2017 Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.10. Affected is an unknown function of the file /manage/delete_query.php of the component General News. The manipulation of the argument NEWS_ID leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243588. NOTE: The vendor was contacted early about this disclosure but did not re