Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
put escaping. This makes it possible for authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/28a8f025-c2ab-4a5f-a99e-a2d19b14a190?source=cve - https://advisory.abay.sh/cve-2023-6524 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3015598%40mappress-google-maps-for-wordpress%2Ftrunk&old=3001436%40mappress-google-maps-for-wordpress%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6525 State: PUBLISHED Published: 2024-03-16T02:34:28.155Z Last Updated: 2024-08-02T08:35:14.482Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: xpeedstudio Products: ElementsKit Elementor addons Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the progress bar element attributes in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access, to inject ar
tization and output escaping. This makes it possible for authenticated attackers, with editor-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This primarily affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e724394d-97aa-42e4-b36e-6e49bfefa2f6?source=cve - https://plugins.trac.wordpress.org/browser/elementskit-lite/tags/3.0.3/widgets/progressbar/progressbar.php#L535 - https://plugins.trac.wordpress.org/changeset/3011323/elementskit-lite/t
3.0.3/widgets/progressbar/progressbar.php#L535 - https://plugins.trac.wordpress.org/changeset/3011323/elementskit-lite/trunk/widgets/progressbar/progressbar.php
CVE ID: CVE-2023-6526 State: PUBLISHED Published: 2024-02-05T21:21:37.891Z Last Updated: 2024-08-02T08:35:14.008Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: rilwis Products: Meta Box – WordPress Custom Fields Framework Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Meta Box – WordPress Custom Fields Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta values displayed through the plugin's shortcode in all versions up to, and including, 5.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authent
to, and including, 5.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2a6bfc87-6135-4d49-baa2-e8e6291148dc?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3030376%40meta-box&new=3030376%40meta-box&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6527 State: PUBLISHED Published: 2023-12-06T04:32:48.010Z Last Updated: 2024-08-02T08:35:14.198Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nik00726 Products: Email Subscription Popup Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Email Subscription Popup plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the HTTP_REFERER header in all versions up to, and including, 1.2.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if
escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5f84814e-f7b7-4228-b331-63027a0770af?source=cve - https://plugins.trac.wordpress.org/browser/email-subscribe/tags/1.2.19/wp-email-subscription.php?rev=3005188#L2125
CVE ID: CVE-2023-6528 State: PUBLISHED Published: 2024-01-08T19:00:34.654Z Last Updated: 2025-06-03T14:34:40.468Z Vendors: Unknown Products: Slider Revolution Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/36ced447-84ea-4162-80d2-6df226cb53cb
CVE ID: CVE-2023-6529 State: PUBLISHED Published: 2024-01-08T19:00:26.949Z Last Updated: 2025-06-18T16:50:52.089Z Vendors: Unknown Products: WP VR Problem Types: CWE-284 Improper Access Control, CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users to downgrade the plugin, thus leading to Reflected or Stored XSS, as previous versions have such vulnerabilities. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c36314c1-a2c0-4816-93c9-e61f9cf7f27a
CVE ID: CVE-2023-6530 State: PUBLISHED Published: 2024-01-29T14:44:23.025Z Last Updated: 2025-05-29T15:09:44.989Z Vendors: Unknown Products: TJ Shortcodes Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The TJ Shortcodes WordPress plugin through 0.1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8e63bf7c-7827-4c4d-b0e3-66354b218bee/ - https://research.cleantalk.o
ent: References: - https://wpscan.com/vulnerability/8e63bf7c-7827-4c4d-b0e3-66354b218bee/ - https://research.cleantalk.org/cve-2023-6530-tj-shortcodes-stored-xss-poc/
CVE ID: CVE-2023-6531 State: PUBLISHED Published: 2024-01-21T10:01:07.215Z Last Updated: 2025-11-06T19:47:01.071Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Problem Types: CWE-362 Description: A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:2394 - ht
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:2394 - https://access.redhat.com/security/cve/CVE-2023-6531 - https://bugzilla.redhat.com/show_bug.cgi?id=2253034 - https://lore.kernel.org/all/c716c88321939156909cfa1bd8b0faaf1c804103.1701868795.git.asml.silence@gmail.com/
CVE ID: CVE-2023-6532 State: PUBLISHED Published: 2024-01-08T19:03:04.615Z Last Updated: 2025-06-18T16:51:32.843Z Vendors: Unknown Products: WP Blogs' Planetarium Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Blogs' Planetarium WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/05a730bc-2d72-49e3-a608-e4390b19e97f - https://magos-securitas.com/txt/CVE-2023-6532.txt
CVE ID: CVE-2023-6533 State: PUBLISHED Published: 2024-02-21T19:55:26.586Z Last Updated: 2024-09-27T15:52:58.406Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: silabs.com Products: PC Controller Problem Types: CWE-248, CWE-419 Description: Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end device has left the network. After this, frames sent by the end device will not be acknowledged by the controller. This vulnerability exists in PC Controller v5.54.0, and earlier. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.silabs.com/
Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.silabs.com/068Vm000001HdNm
CVE ID: CVE-2023-6534 State: PUBLISHED Published: 2023-12-13T08:12:14.616Z Last Updated: 2025-02-13T17:26:26.737Z Vendors: FreeBSD Products: FreeBSD Description: In versions of FreeBSD 14.0-RELEASE before 14-RELEASE-p2, FreeBSD 13.2-RELEASE before 13.2-RELEASE-p7 and FreeBSD 12.4-RELEASE before 12.4-RELEASE-p9, the pf(4) packet filter incorrectly validates TCP sequence numbers. This could allow a malicious actor to execute a denial-of-service attack against hosts behind the firewall. Additional Analyst Notes: - CVE Program Container: References: - https://security.freebsd.org/advisories/FreeBSD-SA-23:17.pf.asc - https://security.netapp.com/advisory/ntap-20240112-0007/
CVE ID: CVE-2023-6535 State: PUBLISHED Published: 2024-02-07T21:04:21.409Z Last Updated: 2025-11-06T21:45:16.229Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, RHOL-5.8-RHEL-9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-476 Description: A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious a
476 Description: A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:0723 - https://access.redhat.com/errata/RHSA-2024:0724 - https://access.redhat.com/errata/RHSA-2024:0725 - https://access.redhat.com/errata/RHSA-2024:0881 - https://access.redhat.com/errata/RHSA-2024:0897 - https://access.redhat.com/errata/RHSA-2024:1248 - h
a/RHSA-2024:0881 - https://access.redhat.com/errata/RHSA-2024:0897 - https://access.redhat.com/errata/RHSA-2024:1248 - https://access.redhat.com/errata/RHSA-2024:2094 - https://access.redhat.com/errata/RHSA-2024:3810 - https://access.redhat.com/security/cve/CVE-2023-6535 - https://bugzilla.redhat.com/show_bug.cgi?id=2254053
CVE ID: CVE-2023-6536 State: PUBLISHED Published: 2024-02-07T21:05:13.716Z Last Updated: 2025-11-06T21:45:28.671Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, RHOL-5.8-RHEL-9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-476 Description: A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious a
a/RHSA-2024:0881 - https://access.redhat.com/errata/RHSA-2024:0897 - https://access.redhat.com/errata/RHSA-2024:1248 - https://access.redhat.com/errata/RHSA-2024:2094 - https://access.redhat.com/errata/RHSA-2024:3810 - https://access.redhat.com/security/cve/CVE-2023-6536 - https://bugzilla.redhat.com/show_bug.cgi?id=2254052
CVE ID: CVE-2023-6538 State: PUBLISHED Published: 2023-12-11T17:54:11.961Z Last Updated: 2024-08-02T08:35:13.612Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Hitachi Vantara Products: System Management Unit (SMU) Problem Types: CWE-285 Description: SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in Storage, Server or combined Server+Storage administrative roles are able to access SMU configuration backup, that would normally be barred to those specific administrative roles. Additional Analyst Notes: - CVE Program Container: References: - https://knowledge.hitachivantara.
administrative roles. Additional Analyst Notes: - CVE Program Container: References: - https://knowledge.hitachivantara.com/Security/System_Management_Unit_(SMU)_versions_prior_to_14.8.7825.01%2C_used_to_manage_Hitachi_Vantara_NAS_products_is_susceptible_to_unintended_information_disclosure_via_unprivileged_access_to_SMU_configuration_backup_data.
CVE ID: CVE-2023-6540 State: PUBLISHED Published: 2024-01-03T21:01:59.690Z Last Updated: 2025-06-17T17:52:27.688Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Lenovo Products: Lenovo Browser Mobile, Lenovo Browser HD Problem Types: CWE-94 Description: A vulnerability was reported in the Lenovo Browser Mobile and Lenovo Browser HD Apps for Android that could allow an attacker to craft a payload that could result in the disclosure of sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/419251
CVE ID: CVE-2023-6541 State: PUBLISHED Published: 2025-05-15T20:09:15.921Z Last Updated: 2025-05-16T18:28:14.995Z Vendors: Unknown Products: Allow SVG Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Allow SVG WordPress plugin before 1.2.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/bbe866b8-7497-4e5c-8f59-bb8edac1dc71/
CVE ID: CVE-2023-6542 State: PUBLISHED Published: 2023-12-12T01:36:22.773Z Last Updated: 2024-08-02T08:35:13.594Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: SAP_SE Products: SAP EMARSYS SDK ANDROID Problem Types: CWE-863 Description: Due to lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and can forward himself web pages and/or deep links without any validation directly from the host application. On successful attack, an attacker could navigate to arbitrary URL including application deep links on the device. Additional Analyst Notes: - CVE Program Container: References: - https://me.sap.com/notes/
ion deep links on the device. Additional Analyst Notes: - CVE Program Container: References: - https://me.sap.com/notes/3406244 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-6544 State: PUBLISHED Published: 2024-04-25T15:58:47.204Z Last Updated: 2025-11-11T15:57:26.470Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat build of Keycloak 22, Red Hat build of Keycloak 22.0.10, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, RHEL-8 based Middleware Containers, RHSSO 7.6.8 Problem Types: CWE-625 Description: A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows hosts to register a dynamic client. A malicious user with enough information about t
ardcoded for filtering which allows hosts to register a dynamic client. A malicious user with enough information about the environment could jeopardize an environment with this specific Dynamic Client Registration and TrustedDomain configuration previously unauthorized. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:1860 - https://access.redhat.com/errata/RHSA-2024:1861 - https://access.redhat.com/errata/RHSA-2024:1862 - https://access.redhat.com/errata/RHSA-2024:1864 - https://access.redhat.com/errata/RHSA-2024:1866 - https://access.redhat.com/errata/RHSA-2024:1867 - https://access.redhat.com/errata/RHSA-2
at.com/errata/RHSA-2024:1866 - https://access.redhat.com/errata/RHSA-2024:1867 - https://access.redhat.com/errata/RHSA-2024:1868 - https://access.redhat.com/security/cve/CVE-2023-6544 - https://bugzilla.redhat.com/show_bug.cgi?id=2253116
CVE ID: CVE-2023-6545 State: PUBLISHED Published: 2023-12-14T14:09:13.652Z Last Updated: 2024-08-27T16:10:41.931Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: Beckhoff Products: authelia-bhf of TwinCAT/BSD Problem Types: CWE-601 Description: The package authelia-bhf included in Beckhoffs TwinCAT/BSD is prone to an open redirect that allows a remote unprivileged attacker to redirect a user to another site. This may have limited impact to integrity and does solely affect anthelia-bhf the Beckhoff fork of authelia. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2023-067/ - http
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2023-067/ - https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2023-001.pdf
CVE ID: CVE-2023-6546 State: PUBLISHED Published: 2023-12-21T20:01:03.217Z Last Updated: 2025-11-06T19:39:08.118Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise
ed Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, RHOL-5.7-RHEL-8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-416 Description: A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This could allow a local unprivileged user to escalate their privilege
n a struct gsm_dlci while restarting the gsm mux. This could allow a local unprivileged user to escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:0930 - https://access.redhat.com/errata/RHSA-2024:0937 - https://access.redhat.com/errata/RHSA-2024:1018 - https://access.redhat.com/errata/RHSA-2024:1019 - https://access.redhat.com/errata/RHSA-2024:1055 - https://access.redhat.com/errata/RHSA-2024:1250 - https://access.redhat.com/errata/RHSA-2024:1253 - https://access.redhat.com/errata/RHSA-2024:1306 - https://access.redhat.com/errata/RHSA-2024:1607 - https://access.redhat.com/errata/RHSA-2024:1612
rata/RHSA-2024:1306 - https://access.redhat.com/errata/RHSA-2024:1607 - https://access.redhat.com/errata/RHSA-2024:1612 - https://access.redhat.com/errata/RHSA-2024:1614 - https://access.redhat.com/errata/RHSA-2024:2093 - https://access.redhat.com/errata/RHSA-2024:2394 - https://access.redhat.com/errata/RHSA-2024:2621 - https://access.redhat.com/errata/RHSA-2024:2697 - https://access.redhat.com/errata/RHSA-2024:4577 - https://access.redhat.com/errata/RHSA-2024:4729 - https://access.redhat.com/errata/RHSA-2024:4731 - https://access.redhat.com/errata/RHSA-2024:4970 - https://access.redhat.com/security/cve/CVE-2023-6546 - https://bugzilla.redhat.com/show_bug.cgi?id=2255498 - https://github.com/
access.redhat.com/security/cve/CVE-2023-6546 - https://bugzilla.redhat.com/show_bug.cgi?id=2255498 - https://github.com/torvalds/linux/commit/3c4f8333b582487a2d1e02171f1465531cde53e3 - https://www.zerodayinitiative.com/advisories/ZDI-CAN-20527
CVE ID: CVE-2023-6547 State: PUBLISHED Published: 2023-12-12T08:22:41.419Z Last Updated: 2025-05-12T19:28:29.898Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions to a playbook but no permissions to the team the playbook is on to access and modify the playbook. This can happen if the user was once a member of the team, got permissions to the playbook and was then removed from the team. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
then removed from the team. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-6548 State: PUBLISHED Published: 2024-01-17T20:11:18.462Z Last Updated: 2025-10-21T23:05:28.157Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Cloud Software Group Products: NetScaler ADC , NetScaler Gateway Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.citrix.com/article/CTX584986/nets
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549
CVE ID: CVE-2023-6549 State: PUBLISHED Published: 2024-01-17T20:15:53.345Z Last Updated: 2025-10-21T23:05:27.936Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Cloud Software Group Products: NetScaler ADC Problem Types: CWE-119 Description: Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out-Of-Bounds Memory Read Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549