Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-5046 State: PUBLISHED Published: 2023-10-12T11:55:21.003Z Last Updated: 2024-08-02T07:44:53.809Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Biltay Technology Products: Procost Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Procost allows SQL Injection, Command Line Execution through SQL Injection.This issue affects Procost: before 1390. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-23-0581
CVE ID: CVE-2023-5047 State: PUBLISHED Published: 2023-11-22T11:20:29.178Z Last Updated: 2024-10-15T18:31:40.024Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: DRD Fleet Leasing Products: DRDrive Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DRD Fleet Leasing DRDrive allows SQL Injection.This issue affects DRDrive: before 20231006. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0651
CVE ID: CVE-2023-5048 State: PUBLISHED Published: 2023-11-22T15:33:27.053Z Last Updated: 2024-08-02T07:44:53.779Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: 10web Products: WDContactFormBuilder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WDContactFormBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Contact_Form_Builder' shortcode in versions up to, and including, 1.0.72 due to insufficient input sanitization and output escaping on 'id' user supplied attribute. This makes it possible for authenticated attackers with contributor level and abov
ping on 'id' user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7152253a-7bb8-4b5c-bffd-86e46df54b7e?source=cve - https://plugins.trac.wordpress.org/browser/contact-form-builder/tags/1.0.72/frontend/views/CFMViewForm_maker.php#L102
CVE ID: CVE-2023-5049 State: PUBLISHED Published: 2023-10-30T13:49:00.238Z Last Updated: 2025-02-05T18:55:08.982Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: smub Products: Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Giveaways and Contests by RafflePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rafflepress' and 'rafflepress_gutenberg' shortcode in versions up to, and including, 1.12.0 due to insufficient input sanitization and output esca
ess_gutenberg' shortcode in versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping on 'giframe' user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a6d663a9-3185-4c36-b9d1-878297965379?source=cve - https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.11.4/app/rafflepress.php#L796 - https://plugins.trac.wordpress.org/browser/raff
wordpress.org/browser/rafflepress/tags/1.11.4/app/rafflepress.php#L796 - https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.11.4/app/rafflepress.php#L955 - https://plugins.trac.wordpress.org/changeset/2976620/rafflepress#file0
CVE ID: CVE-2023-5050 State: PUBLISHED Published: 2023-10-20T06:35:15.119Z Last Updated: 2025-02-05T19:10:25.037Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bozdoz Products: Leaflet Map Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whe
ed attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3084c9ab-00aa-4b8e-aa46-bd70b335ec77?source=cve - https://plugins.trac.wordpress.org/browser/leaflet-map/tags/3.3.0/shortcodes/class.geojson-shortcode.php#L124 - https://plugins.trac.wordpress.org/changeset/2968965/leaflet-map#file12
CVE ID: CVE-2023-5051 State: PUBLISHED Published: 2023-10-27T03:16:17.469Z Last Updated: 2025-02-05T18:57:47.168Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: callrail Products: CallRail Phone Call Tracking Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The CallRail Phone Call Tracking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callrail_form' shortcode in versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping on the 'form_id' user supplied attribute. This makes it possible for authenticated attackers with contri
output escaping on the 'form_id' user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/35def866-7460-4cad-8d86-7b9e4905cbe4?source=cve - https://plugins.trac.wordpress.org/browser/callrail-phone-call-tracking/tags/0.5.2/callrail.php#L174 - https://plugins.trac.wordpress.org/changeset/2982876/callrail-phone-call-tracking#file0
CVE ID: CVE-2023-5052 State: PUBLISHED Published: 2024-05-13T06:53:44.172Z Last Updated: 2024-08-02T07:44:53.610Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Uniform Server Zero Products: Uniform Server Zero Problem Types: CWE-79 Description: vulnerability in Uniform Server Zero, version 10.2.5, consisting of an XSS through the /us_extra/phpinfo.php page. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and partially take over their session details. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-s
ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-uniform-server-zero
CVE ID: CVE-2023-5053 State: PUBLISHED Published: 2023-09-28T20:43:41.655Z Last Updated: 2024-09-23T18:09:12.162Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: hospital-management-system Products: hospital-management-system Problem Types: CWE-89 Description: Hospital management system version 378c157 allows to bypass authentication. This is possible because the application is vulnerable to SQLI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/shierro - https://github.com/projectworldsofficial/hospital-management-system-in-php/
CVE ID: CVE-2023-5054 State: PUBLISHED Published: 2023-09-19T06:38:44.229Z Last Updated: 2025-02-05T19:27:39.251Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Super Store Finder Products: Super Store Finder Problem Types: CWE-862 Missing Authorization Description: The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to, and including, 6.9.3. This is due to insufficient restrictions on the sendMail.php file that allows direct access. This makes it possible for unauthenticated attackers to send emails utilizing the vulnerable site's server, with arbitrary content. Please note that thi
henticated attackers to send emails utilizing the vulnerable site's server, with arbitrary content. Please note that this vulnerability has already been publicly disclosed with an exploit which is why we are publishing the details without a patch available, we are attempting to initiate contact with the developer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d31d0553-9378-4c7e-a258-12562aa6b388?source=cve - https://superstorefinder.net/ - https://superstorefinder.net/support/forums/topic/super-store-finder-for-wordpress-patch-notes/
CVE ID: CVE-2023-5055 State: PUBLISHED Published: 2023-11-21T18:05:10.824Z Last Updated: 2024-08-02T07:44:53.707Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-121 Description: Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wr8r-7f8x-24jj
CVE ID: CVE-2023-5056 State: PUBLISHED Published: 2023-12-18T13:43:07.807Z Last Updated: 2025-11-20T07:02:56.903Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Red Hat Products: Service Interconnect 1 for RHEL 9 Problem Types: CWE-862 Description: A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in the adjacent cluster to view deployments in all namespaces in the cluster. This issue permits unauthorized viewing of information outside of the user's purview. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/
f the user's purview. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:6219 - https://access.redhat.com/security/cve/CVE-2023-5056 - https://bugzilla.redhat.com/show_bug.cgi?id=2239517
CVE ID: CVE-2023-5057 State: PUBLISHED Published: 2023-10-16T19:39:13.142Z Last Updated: 2024-08-02T07:44:53.809Z Vendors: Unknown Products: ActivityPub Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which could allow users with a role of Contributor and above to perform Stored XSS attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/58a63507-f0fd-46f1-a80c-6b1c41dddcf5
CVE ID: CVE-2023-5058 State: PUBLISHED Published: 2023-12-07T22:29:05.717Z Last Updated: 2025-07-28T20:50:19.406Z Vendors: Phoenix Products: SecureCore™ Technology™ 4 Problem Types: CWE-20 Description: Improper Input Validation in the processing of user-supplied splash screen during system boot in Phoenix SecureCore™ Technology™ 4 potentially allows denial-of-service attacks or arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://phoenixtech.com/phoenix-security-notifications/cve-2023-5058/ - https://www.kb.cert.org/vuls/id/811862
CVE ID: CVE-2023-5059 State: PUBLISHED Published: 2023-10-19T17:27:16.081Z Last Updated: 2025-01-16T21:29:06.591Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Santesoft Products: Sante FFT Imaging Problem Types: CWE-125 Description: Santesoft Sante FFT Imaging lacks proper validation of user-supplied data when parsing DICOM files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-285-02
CVE ID: CVE-2023-5060 State: PUBLISHED Published: 2023-09-19T02:03:32.344Z Last Updated: 2024-09-25T14:26:07.506Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: librenms Products: librenms/librenms Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/01b0917d-f92f-4903-9eca-bcfc46e847e3 - https://github.com/librenms/librenms/commit/8fd8d9b06a11060de5dc69588a1a83594a7e6f72
CVE ID: CVE-2023-5061 State: PUBLISHED Published: 2023-12-15T16:03:05.257Z Last Updated: 2025-11-20T04:10:18.303Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-862 Description: An issue has been discovered in GitLab affecting all versions starting from 9.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. In certain situations, it may have been possible for developers to override predefined CI variables via the REST API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/4
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/425521 - https://hackerone.com/reports/2125189
CVE ID: CVE-2023-5062 State: PUBLISHED Published: 2023-09-20T02:31:41.145Z Last Updated: 2025-02-05T19:27:31.035Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: webfactory Products: WordPress Charts Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WordPress Charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wp_charts' shortcode in versions up to, and including, 0.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject
ed attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2de2d2c5-1373-45b6-93a0-575713226669?source=cve - https://plugins.trac.wordpress.org/browser/wp-charts/tags/0.7.0/wordpress_charts_js.php#L223 - https://plugins.trac.wordpress.org/browser/wp-charts/tags/0.7.0/wordpress_charts_js.php#L229
CVE ID: CVE-2023-5063 State: PUBLISHED Published: 2023-09-20T02:31:41.738Z Last Updated: 2025-02-05T19:27:22.936Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: stefanoai Products: Widget Responsive for Youtube Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Widget Responsive for Youtube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'youtube' shortcode in versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and abov
escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/72daa533-8b17-420c-9b51-b5f72da2726c?source=cve - https://plugins.trac.wordpress.org/browser/youtube-widget-responsive/trunk/youtube-widget-responsive.php?rev=2905626#L246 - https://plugins.trac.wordpress.org/changeset/2968766/youtube-widget-responsive#file1
CVE ID: CVE-2023-5068 State: PUBLISHED Published: 2023-09-21T22:01:07.522Z Last Updated: 2025-01-16T21:29:52.168Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAScreen Problem Types: CWE-787 Description: Delta Electronics DIAScreen may write past the end of an allocated buffer while parsing a specially crafted input file. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-264-03 - https://diastudio.deltaww.com/home/downloads?sec=download#catalog
CVE ID: CVE-2023-5070 State: PUBLISHED Published: 2023-10-20T07:29:38.342Z Last Updated: 2025-02-05T19:03:05.786Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: socialdude Products: Social Media Share Buttons & Social Sharing Icons Problem Types: CWE-200 Information Exposure Description: The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsi_save_export function. This can allow subscribers to export plugin settings that include social media authentication tokens and secrets as well as app passwords. Additional Analyst Notes: - CVE Program
include social media authentication tokens and secrets as well as app passwords. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e9e43c5b-a094-44ab-a8a3-52d437f0e00d?source=cve - https://plugins.trac.wordpress.org/changeset/2975574/ultimate-social-media-icons/tags/2.8.6/libs/controllers/sfsi_buttons_controller.php?old=2956446&old_path=ultimate-social-media-icons%2Ftags%2F2.8.5%2Flibs%2Fcontrollers%2Fsfsi_buttons_controller.php
CVE ID: CVE-2023-5071 State: PUBLISHED Published: 2023-10-20T06:35:04.245Z Last Updated: 2025-02-05T19:11:44.977Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: webvitaly Products: Sitekit Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Sitekit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sitekit_iframe' shortcode in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execu
thenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/011c8a06-298e-4a53-9ef8-552585426d79?source=cve - https://plugins.trac.wordpress.org/browser/sitekit/trunk/inc/sitekit-shortcode-iframe.php#L3 - https://plugins.trac.wordpress.org/changeset/2970788/sitekit
CVE ID: CVE-2023-5072 State: PUBLISHED Published: 2023-10-12T16:13:27.974Z Last Updated: 2025-02-13T17:19:28.975Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: https://github.com/stleary/JSON-java Products: n/a Problem Types: CWE-770 Description: Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/stleary/JSON-java/issues/758 - https://github.com/stleary/JSON-java/issues/771 - http://www.openwall.com/lists/oss-security/2
ry/JSON-java/issues/758 - https://github.com/stleary/JSON-java/issues/771 - http://www.openwall.com/lists/oss-security/2023/12/13/4 - https://security.netapp.com/advisory/ntap-20240621-0007/
CVE ID: CVE-2023-5073 State: PUBLISHED Published: 2023-10-31T11:29:12.022Z Last Updated: 2025-02-05T18:52:45.376Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jrbecart Products: iframe forms Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The iframe forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iframe' shortcode in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will
or authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/818de7f7-913a-4ade-927e-bba281b4709a?source=cve - https://plugins.trac.wordpress.org/browser/iframe-forms/trunk/iframe-forms.php#L29
CVE ID: CVE-2023-5074 State: PUBLISHED Published: 2023-09-20T15:32:44.451Z Last Updated: 2024-09-24T15:26:54.056Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: D-View 8 Problem Types: CWE-798 Description: Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-32
CVE ID: CVE-2023-5075 State: PUBLISHED Published: 2023-11-08T22:01:34.869Z Last Updated: 2024-09-03T20:09:35.465Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: IdeaPad Duet 3-10IGL5 Problem Types: CWE-120 Description: A buffer overflow was reported in the FmpSipoCapsuleDriver driver in the IdeaPad Duet 3-10IGL5 that may allow a local attacker with elevated privileges to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-141775
CVE ID: CVE-2023-5076 State: PUBLISHED Published: 2023-11-07T07:33:57.920Z Last Updated: 2025-02-05T18:51:28.086Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ziteboard Products: Ziteboard Online Whiteboard Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Ziteboard Online Whiteboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ziteboard' shortcode in versions up to, and including, 2.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbit
t escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f5608f50-e17a-471f-b644-dceb64d82f0c?source=cve - https://plugins.trac.wordpress.org/changeset/2988896/ziteboard-online-whiteboard