Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-0723 State: PUBLISHED Published: 2023-02-07T22:57:37.080Z Last Updated: 2025-01-13T17:07:57.219Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: wickedplugins Products: Wicked Folders Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_move_object function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clickin
e this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dc01108f-e781-484b-997a-c1d4e218a3f4 - https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk
.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-0724 State: PUBLISHED Published: 2023-02-08T01:04:50.748Z Last Updated: 2025-01-13T17:07:05.947Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: wickedplugins Products: Wicked Folders Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_add_folder function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking
this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/08c0ea6c-7e2f-482f-b30c-0e3bcd992159 - https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&
CVE ID: CVE-2023-0725 State: PUBLISHED Published: 2023-02-08T01:08:04.185Z Last Updated: 2025-01-13T17:06:54.445Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: wickedplugins Products: Wicked Folders Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_clone_folder function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicki
ke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/80797183-c69f-4dce-a2e0-52a395ceffaa - https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrun
s.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-0726 State: PUBLISHED Published: 2023-02-08T01:13:16.695Z Last Updated: 2025-01-13T17:05:48.402Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: wickedplugins Products: Wicked Folders Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_edit_folder function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clickin
e this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/51b88442-3961-42e2-8ff4-7726819a7f0f - https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk
CVE ID: CVE-2023-0727 State: PUBLISHED Published: 2023-02-07T22:49:27.218Z Last Updated: 2025-01-13T17:08:35.912Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: wickedplugins Products: Wicked Folders Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_delete_folder function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as click
oke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/62b56928-7125-4211-b233-07b5b51881c1 - https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftru
ss.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-0728 State: PUBLISHED Published: 2023-02-07T21:05:27.894Z Last Updated: 2025-01-13T17:09:04.080Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: wickedplugins Products: Wicked Folders Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_folder function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clickin
e this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/43b43802-f301-4748-98b9-eea78a249355 - https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk
CVE ID: CVE-2023-0729 State: PUBLISHED Published: 2023-06-09T05:33:28.156Z Last Updated: 2024-12-20T23:37:04.409Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: wickedplugins Products: Wicked Folders Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_sort_order function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as cli
nvoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ae8dbf54-ea62-4901-b34f-079b708ca0b5?source=cve - https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-
.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-0730 State: PUBLISHED Published: 2023-02-07T22:50:04.610Z Last Updated: 2025-01-13T17:08:26.470Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: wickedplugins Products: Wicked Folders Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_folder_order function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as c
invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4104f69f-b185-498a-aabf-2126ffb94ab3 - https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2
CVE ID: CVE-2023-0731 State: PUBLISHED Published: 2023-02-07T22:48:28.550Z Last Updated: 2025-01-13T17:08:45.446Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: carlosmoreirapt Products: Interactive Geo Maps Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Interactive Geo Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the action content parameter in versions up to, and including, 1.5.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with editor level and above permis
aping on user supplied attributes. This makes it possible for authenticated attackers with editor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/95ce515a-377c-49b4-8d1b-7ac22769c759 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2861473%40interactive-geo-maps%2Ftrunk&old=2857078%40interactive-geo-maps%2Ftrunk&sfp_email=&sfph_mail=#file4
CVE ID: CVE-2023-0732 State: PUBLISHED Published: 2023-02-07T19:59:29.885Z Last Updated: 2025-03-25T14:11:01.357Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Eyewear Shop Problem Types: CWE-79 Description: A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is the function registration of the file oews/classes/Users.php of the component POST Request Handler. The manipulation of the argument firstname/middlename/lastname/email/contact leads to cross site scripting. The attack can be launched remotely. The identifier VDB-220369 was assigned to this vulnerability. Ad
ss site scripting. The attack can be launched remotely. The identifier VDB-220369 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.220369 - https://vuldb.com/?ctiid.220369
CVE ID: CVE-2023-0733 State: PUBLISHED Published: 2023-05-30T07:49:10.677Z Last Updated: 2025-01-10T21:07:32.716Z Vendors: Unknown Products: Newsletter Popup Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fed1e184-ff56-44fe-9876-d17c0156447a
CVE ID: CVE-2023-0734 State: PUBLISHED Published: 2023-03-05T00:00:00.000Z Last Updated: 2025-03-06T16:29:59.398Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: wallabag Products: wallabag/wallabag Problem Types: CWE-285 Description: Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/a296324c-6925-4f5f-a729-39b0d73d5b8b - https://github.com/wallabag/wallabag/commit/acd285dcbb71b595e6320bb1d0d3a44cdf646ac0
CVE ID: CVE-2023-0735 State: PUBLISHED Published: 2023-02-07T00:00:00.000Z Last Updated: 2025-03-25T14:34:06.344Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: wallabag Products: wallabag/wallabag Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/8bc78cb1-b10b-4152-842e-ceb999fc5508 - https://github.com/wallabag/wallabag/commit/268372dbbdd7ef87b84617fdebf95d0a86caf7dc
CVE ID: CVE-2023-0736 State: PUBLISHED Published: 2023-02-07T00:00:00.000Z Last Updated: 2025-03-25T14:32:06.358Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: wallabag Products: wallabag/wallabag Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/7e6f9614-6a96-4295-83f0-06a240be844e - https://github.com/wallabag/wallabag/commit/4e023bddc3622ba5e901cc14a261fcb98d955cd7
CVE ID: CVE-2023-0737 State: PUBLISHED Published: 2024-11-15T10:53:21.745Z Last Updated: 2024-11-20T22:30:58.342Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: wallabag Products: wallabag/wallabag Problem Types: CWE-352 Description: wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. This issue is fixed in version 2.5.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/4ba20fe7-4061-4dfb-ab2f-ecaf110641a5 - https://github.com/wallabag/wallabag/commit/268372dbbdd7ef87b84617fdebf95d0a86caf7dc
CVE ID: CVE-2023-0738 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-13T16:02:01.027Z Vendors: n/a Products: OrangeScrum Problem Types: Reflected cross-site scripting (XSS) Description: OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Orangescrum/orangescrum/ - https://fluidattacks.com/advisories/eilish/
CVE ID: CVE-2023-0739 State: PUBLISHED Published: 2023-02-08T00:00:00.000Z Last Updated: 2025-03-25T15:48:08.227Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: answerdev Products: answerdev/answer Problem Types: CWE-362 Description: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitHub repository answerdev/answer prior to 1.0.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/93d7fac9-50be-4624-9096-45b89fbfd4ae - https://github.com/answerdev/answer/commit/1ee34b884b905d14d4db457563176b77a974b992
CVE ID: CVE-2023-0740 State: PUBLISHED Published: 2023-02-08T00:00:00.000Z Last Updated: 2025-03-25T15:17:26.746Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: answerdev Products: answerdev/answer Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/answerdev/answer/commit/c3001de52af91f09c96e701facbce0b9fa0c98ad - https://huntr.dev/bounties/802ee76d-fe01-482b-a9a4-34699a7c9110
CVE ID: CVE-2023-0741 State: PUBLISHED Published: 2023-02-08T00:00:00.000Z Last Updated: 2025-03-25T15:10:05.475Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: answerdev Products: answerdev/answer Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - DOM in GitHub repository answerdev/answer prior to 1.0.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/78233bfa-871d-45e1-815f-dee73e397809 - https://github.com/answerdev/answer/commit/c3001de52af91f09c96e701facbce0b9fa0c98ad
CVE ID: CVE-2023-0742 State: PUBLISHED Published: 2023-02-08T00:00:00.000Z Last Updated: 2025-03-25T15:02:35.413Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: answerdev Products: answerdev/answer Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/answerdev/answer/commit/c3001de52af91f09c96e701facbce0b9fa0c98ad - https://huntr.dev/bounties/d73a2c03-7035-453b-9c04-c733ace65544
CVE ID: CVE-2023-0743 State: PUBLISHED Published: 2023-02-08T00:00:00.000Z Last Updated: 2025-03-25T14:52:51.889Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: answerdev Products: answerdev/answer Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Generic in GitHub repository answerdev/answer prior to 1.0.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/366cf8bb-19f6-4388-b089-d0a260efd863 - https://github.com/answerdev/answer/commit/860b1a3bd8cfaa8827e6e6f50ab1d98fa4c2c816
CVE ID: CVE-2023-0744 State: PUBLISHED Published: 2023-02-08T00:00:00.000Z Last Updated: 2025-03-25T14:49:06.360Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: answerdev Products: answerdev/answer Problem Types: CWE-284 Description: Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/35a0e12f-1d54-4fc0-8779-6a4949b7c434 - https://github.com/answerdev/answer/commit/c1fa2b13f6b547b96da60b23350bbe2b29de542d - http://packetstormsecurity.com/files/171733/Answerdev-1.0.3-Account-Takeover.html
CVE ID: CVE-2023-0745 State: PUBLISHED Published: 2023-02-09T16:08:57.723Z Last Updated: 2025-03-24T18:33:37.528Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: YugabyteDB Products: YugabyteDB Anywhere Problem Types: CWE-23 Description: The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary files through the backup upload endpoint by using path traversal characters. This vulnerability is associated with program files PlatformReplicationManager.Java. This issue affects YugabyteDB Anywhere: from 2.0.0.0 through 2.13.0.0 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.yuga
ough 2.13.0.0 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.yugabyte.com/
CVE ID: CVE-2023-0746 State: PUBLISHED Published: 2023-03-10T00:00:00.000Z Last Updated: 2025-02-27T19:03:17.762Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Gigamon Products: GigaVUE-FM Problem Types: CWE-79 Description: The help page in GigaVUE-FM, when using GigaVUE-OS software version 5.0 202, does not require an authenticated user. An attacker could enforce a user into inserting malicious JavaScript code into the URI, that could lead to a Reflected Cross site Scripting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe-cert.es/en/early-warning/ics-advisories/xss-vulnerability-gigavue-fm
CVE ID: CVE-2023-0747 State: PUBLISHED Published: 2023-02-08T00:00:00.000Z Last Updated: 2025-03-25T14:01:28.233Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: btcpayserver Products: btcpayserver/btcpayserver Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/7830b9b4-af2e-44ef-8b00-ee2491d4e7ff - https://github.com/btcpayserver/btcpayserver/pull/4567/commits/d4e464ad4ef0cbbf61751e70f77865de325dd6cf
CVE ID: CVE-2023-0748 State: PUBLISHED Published: 2023-02-08T00:00:00.000Z Last Updated: 2025-03-25T14:00:39.825Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: btcpayserver Products: btcpayserver/btcpayserver Problem Types: CWE-601 Description: Open Redirect in GitHub repository btcpayserver/btcpayserver prior to 1.7.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/1a0403b6-9ec9-4587-b559-b1afba798c86 - https://github.com/btcpayserver/btcpayserver/pull/4575/commits/c2cfa17e9619046b43987627b8429541d2834109