Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6498 State: PUBLISHED Published: 2024-01-04T03:30:11.982Z Last Updated: 2024-11-14T18:22:41.759Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: rogierlankhorst Products: Complianz – GDPR/CCPA Cookie Consent Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 6.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and
ation and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/01c1458d-3e38-4dbf-bb65-80465ea6d0ad?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3009228%40complianz-gdpr&new=3009228%40complianz-gdpr&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6499 State: PUBLISHED Published: 2024-02-12T16:05:59.115Z Last Updated: 2025-05-06T21:03:14.616Z Vendors: Unknown Products: lasTunes Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The lasTunes WordPress plugin through 3.6.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/69592e52-92db-4e30-92ca-b7b3d5b9185d/
CVE ID: CVE-2023-6500 State: PUBLISHED Published: 2024-03-12T23:33:51.869Z Last Updated: 2024-08-02T20:04:30.083Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: 3uu Products: Shariff Wrapper Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including, 4.6.9 due to insufficient input sanitization and output escaping on user supplied attributes such as 'secondarycolor' and 'maincolor'. This makes it possible for authenticated attackers with co
supplied attributes such as 'secondarycolor' and 'maincolor'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cac2a45e-f09e-4639-9a45-68d528a5094e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3030487%40shariff&new=3030487%40shariff&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6501 State: PUBLISHED Published: 2024-02-12T16:05:57.049Z Last Updated: 2024-10-28T00:07:44.359Z Vendors: Unknown Products: Splashscreen Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Splashscreen WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/dd19189b-de04-44b6-8ac9-0c32399a8976/ - https://magos-securitas.com/txt/CVE-2023-6501.txt
CVE ID: CVE-2023-6502 State: PUBLISHED Published: 2024-05-23T11:02:31.779Z Last Updated: 2024-10-03T06:23:16.789Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-1333 Description: A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. It is possible for an attacker to cause a denial of service using a crafted wiki page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/433534 - https://hackerone.com/reports/2263638
CVE ID: CVE-2023-6503 State: PUBLISHED Published: 2024-01-29T14:44:26.055Z Last Updated: 2024-09-05T18:01:51.341Z Vendors: Unknown Products: WP Plugin Lister Problem Types: CWE-352 Cross-Site Request Forgery (CSRF), CWE-79 Cross-Site Scripting (XSS) Description: The WP Plugin Lister WordPress plugin through 2.1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0d95de23-e8f6-4342-b19c-57cd22b2fee2/ - https://magos-securitas.com/txt/CVE-2
rences: - https://wpscan.com/vulnerability/0d95de23-e8f6-4342-b19c-57cd22b2fee2/ - https://magos-securitas.com/txt/CVE-2023-6503.txt
CVE ID: CVE-2023-6504 State: PUBLISHED Published: 2024-01-11T08:33:08.576Z Last Updated: 2025-06-03T14:08:28.779Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: reflectionmedia Products: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wppb_toolbox_usermeta_handler function in all versions up to, and including, 3.10.7. This makes it p
bility check on the wppb_toolbox_usermeta_handler function in all versions up to, and including, 3.10.7. This makes it possible for authenticated attackers, with contributor-level access and above, to expose sensitive information within user metadata. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f515ccf8-7231-4728-b155-c47049087d42?source=cve - https://plugins.trac.wordpress.org/changeset/3012472/profile-builder
CVE ID: CVE-2023-6505 State: PUBLISHED Published: 2024-01-08T19:00:38.801Z Last Updated: 2025-06-18T16:05:29.760Z Vendors: Unknown Products: Migrate WordPress Website & Backups Problem Types: CWE-200 Information Exposure Description: The Migrate WordPress Website & Backups WordPress plugin before 1.9.3 does not prevent directory listing in sensitive directories containing export files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/eca6f099-6af0-4f42-aade-ab61dd792629
CVE ID: CVE-2023-6506 State: PUBLISHED Published: 2024-01-11T06:49:33.842Z Last Updated: 2025-06-03T14:25:07.119Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: melapress Products: WP 2FA – Two-factor authentication for WordPress Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the send_backup_codes_email due to missing validation on a user controlled key. This makes it possible for subscriber-level attackers to email arbitrary users on the site. Additi
user controlled key. This makes it possible for subscriber-level attackers to email arbitrary users on the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/caff9be6-4161-47a0-ba47-6c8fc0c4ab40?source=cve - https://plugins.trac.wordpress.org/browser/wp-2fa/trunk/includes/classes/Admin/class-setup-wizard.php?rev=2940688#L606 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3009922%40wp-2fa&new=3009922%40wp-2fa&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6507 State: PUBLISHED Published: 2023-12-08T18:20:49.583Z Last Updated: 2024-08-02T08:35:13.267Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Python Software Foundation Products: CPython Problem Types: CWE-269 Description: An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the new process. There is no
` before calling `exec()`, thus not dropping the original processes' groups before starting the new process. There is no issue when the parameter isn't used or when any value is used besides an empty list. This issue only impacts CPython processes run with sufficient privilege to make the `setgroups` system call (typically `root`). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/python/cpython/issues/112334 - https://mail.python.org/archives/list/security-announce@python.org/thread/AUL7QFHBLILGISS7U63B47AYSSGJJQZD/ - https://github.com/python/cpython/commit/9fe7655c6ce0b8e9adc229daf681b6d30e6b1610 - https://github.com/python/cpytho
/ - https://github.com/python/cpython/commit/9fe7655c6ce0b8e9adc229daf681b6d30e6b1610 - https://github.com/python/cpython/commit/10e9bb13b8dcaa414645b9bd10718d8f7179e82b - https://github.com/python/cpython/commit/85bbfa8a4bbdbb61a3a84fbd7cb29a4096ab8a06
CVE ID: CVE-2023-6508 State: PUBLISHED Published: 2023-12-06T01:19:19.544Z Last Updated: 2025-02-13T17:26:23.163Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Media Stream in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop.html - https://crbug.com/1497984 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMHY76AWPA46MAFXPWDGJX6FEGXZVR5Z/ - htt
fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMHY76AWPA46MAFXPWDGJX6FEGXZVR5Z/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RI3UHCTFH6KWAJGDZ2TOLT6VHKW53WCC/ - https://www.debian.org/security/2023/dsa-5573 - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-6509 State: PUBLISHED Published: 2023-12-06T01:19:19.993Z Last Updated: 2025-02-13T17:26:23.782Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Side Panel Search in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific UI interaction. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop.html - https://crbug.com/1494565 - https://lists.fedoraproject.org/archives/list/package-announce@list
pdate-for-desktop.html - https://crbug.com/1494565 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMHY76AWPA46MAFXPWDGJX6FEGXZVR5Z/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RI3UHCTFH6KWAJGDZ2TOLT6VHKW53WCC/ - https://www.debian.org/security/2023/dsa-5573 - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-6510 State: PUBLISHED Published: 2023-12-06T01:19:20.171Z Last Updated: 2025-02-13T17:26:24.405Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Media Capture in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific UI interaction. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop.html - https://crbug.com/1480152 - https://lists.fedoraproject.org/archives/list/package-announce@lists.
ate-for-desktop.html - https://crbug.com/1480152 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMHY76AWPA46MAFXPWDGJX6FEGXZVR5Z/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RI3UHCTFH6KWAJGDZ2TOLT6VHKW53WCC/ - https://www.debian.org/security/2023/dsa-5573 - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-6511 State: PUBLISHED Published: 2023-12-06T01:19:20.519Z Last Updated: 2025-02-13T17:26:25.001Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Autofill in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop.html - https://crbug.com/1478613 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/messag
ttps://crbug.com/1478613 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMHY76AWPA46MAFXPWDGJX6FEGXZVR5Z/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RI3UHCTFH6KWAJGDZ2TOLT6VHKW53WCC/ - https://www.debian.org/security/2023/dsa-5573 - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-6512 State: PUBLISHED Published: 2023-12-06T01:19:20.768Z Last Updated: 2025-05-28T15:52:13.885Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially spoof the contents of an iframe dialog context menu via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop.html - https://crbug.com/1457702 - https://lists.fedoraproject.org/archives/list/packag
table-channel-update-for-desktop.html - https://crbug.com/1457702 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMHY76AWPA46MAFXPWDGJX6FEGXZVR5Z/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RI3UHCTFH6KWAJGDZ2TOLT6VHKW53WCC/ - https://www.debian.org/security/2023/dsa-5573 - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-6514 State: PUBLISHED Published: 2023-12-06T08:26:59.626Z Last Updated: 2024-08-02T08:35:13.715Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Huawei Products: AJMD-370S Problem Types: CWE-840 Description: The Bluetooth module of some Huawei Smart Screen products has an identity authentication bypass vulnerability. Successful exploitation of this vulnerability may allow attackers to access restricted functions. Successful exploitation of this vulnerability may allow attackers to access restricted functions. Additional Analyst Notes: - CVE Program Container: References: - https://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-ibvi
st Notes: - CVE Program Container: References: - https://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-ibvishssp-4bf951d4-en
CVE ID: CVE-2023-6515 State: PUBLISHED Published: 2024-02-08T09:43:20.064Z Last Updated: 2025-06-17T21:29:28.896Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Mia Technology Inc. Products: MİA-MED Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Mia Technology Inc. MİA-MED allows Authentication Abuse.This issue affects MİA-MED: before 1.0.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-0087
CVE ID: CVE-2023-6516 State: PUBLISHED Published: 2024-02-13T14:05:28.933Z Last Updated: 2025-02-13T17:26:26.170Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND 9 Description: To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first allocated and then queued for later processing. It was discovered that if the resolver is continuously processing query patterns triggering this type of cache-database maintenance, `named` may not
resolver is continuously processing query patterns triggering this type of cache-database maintenance, `named` may not be able to handle the cleanup events in a timely manner. This in turn enables the list of queued cleanup events to grow infinitely large over time, allowing the configured `max-cache-size` limit to be significantly exceeded. This issue affects BIND 9 versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2023-6516 - http://www.openwall.com/lists/oss-security/2024/02/13/1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedora
enwall.com/lists/oss-security/2024/02/13/1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/ - https://security.netapp.com/advisory/ntap-20240503-0008/
CVE ID: CVE-2023-6517 State: PUBLISHED Published: 2024-02-08T11:41:09.482Z Last Updated: 2024-11-07T19:50:05.518Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Mia Technology Inc. Products: MİA-MED Problem Types: CWE-213 Description: Exposure of Sensitive Information Due to Incompatible Policies vulnerability in Mia Technology Inc. MİA-MED allows Collect Data as Provided by Users.This issue affects MİA-MED: before 1.0.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-0087
CVE ID: CVE-2023-6518 State: PUBLISHED Published: 2024-02-08T11:46:17.475Z Last Updated: 2025-05-15T19:40:49.259Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Mia Technology Inc. Products: MİA-MED Problem Types: CWE-256 Description: Plaintext Storage of a Password vulnerability in Mia Technology Inc. MİA-MED allows Read Sensitive Strings Within an Executable.This issue affects MİA-MED: before 1.0.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-0087
CVE ID: CVE-2023-6519 State: PUBLISHED Published: 2024-02-08T11:50:58.838Z Last Updated: 2025-06-17T21:29:29.062Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Mia Technology Inc. Products: MİA-MED Problem Types: CWE-488 Description: Exposure of Data Element to Wrong Session vulnerability in Mia Technology Inc. MİA-MED allows Read Sensitive Strings Within an Executable.This issue affects MİA-MED: before 1.0.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-0087
CVE ID: CVE-2023-6520 State: PUBLISHED Published: 2024-01-11T06:49:30.129Z Last Updated: 2025-06-09T18:40:03.052Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: melapress Products: WP 2FA – Two-factor authentication for WordPress Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on the send_backup_codes_email function. This makes it possible for unauthenticated attackers to send emails with arbitrary content to registered use
l function. This makes it possible for unauthenticated attackers to send emails with arbitrary content to registered users via a forged request granted they can trick a site administrator or other registered user into performing an action such as clicking on a link. While a nonce check is present, it is only executed if a nonce is set. By omitting a nonce from the request, the check can be bypassed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0af451be-2477-453c-a230-7f3fb804398b?source=cve - https://plugins.trac.wordpress.org/browser/wp-2fa/trunk/includes/classes/Admin/class-setup-wizard.p
804398b?source=cve - https://plugins.trac.wordpress.org/browser/wp-2fa/trunk/includes/classes/Admin/class-setup-wizard.php?rev=2940688#L606 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3009922%40wp-2fa&new=3009922%40wp-2fa&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6522 State: PUBLISHED Published: 2024-04-05T11:33:30.000Z Last Updated: 2024-09-26T12:11:09.133Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: ExtremePacs Products: Extreme XDS Problem Types: CWE-648 Description: Incorrect Use of Privileged APIs vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users.This issue affects Extreme XDS: before 3914. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-0276
CVE ID: CVE-2023-6523 State: PUBLISHED Published: 2024-04-05T11:37:17.988Z Last Updated: 2024-08-15T18:50:18.322Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ExtremePacs Products: Extreme XDS Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in ExtremePacs Extreme XDS allows Authentication Abuse.This issue affects Extreme XDS: before 3914. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-0276
CVE ID: CVE-2023-6524 State: PUBLISHED Published: 2024-01-03T05:31:17.918Z Last Updated: 2025-06-17T20:29:08.338Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: chrisvrichardson Products: MapPress Maps for WordPress Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the map title parameter in all versions up to and including 2.88.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access or higher to inject arbitrary w