Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-45290 State: PUBLISHED Published: 2024-03-05T22:22:28.703Z Last Updated: 2025-02-13T17:14:02.493Z Vendors: Go standard library Products: net/textproto Problem Types: CWE-400: Uncontrolled Resource Consumption Description: When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix,
ng lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/issue/65383 - https://go.dev/cl/569341 - https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg - https://pkg.go.dev/vuln/GO-2024-2599 - https://security.netapp.com/advisory/ntap-20240329-0004/ - http://www.openwall.com/lists/oss-security/2024/03/08/4
CVE ID: CVE-2023-45292 State: PUBLISHED Published: 2023-12-11T21:51:16.055Z Last Updated: 2024-08-02T20:21:15.289Z Vendors: github.com/mojocn/base64Captcha Products: github.com/mojocn/base64Captcha Problem Types: CWE-305: Authentication Bypass by Primary Weakness Description: When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mojocn/base64Captcha/issues/120 - https://github
nalyst Notes: - CVE Program Container: References: - https://github.com/mojocn/base64Captcha/issues/120 - https://github.com/mojocn/base64Captcha/commit/9b11012caca58925f1e47c770f79f2fa47e3ad13 - https://github.com/mojocn/base64Captcha/commit/5ab86bd6f333aad3936f912fc52b411168dcd4a7 - https://pkg.go.dev/vuln/GO-2023-2386
CVE ID: CVE-2023-45303 State: PUBLISHED Published: 2023-10-06T00:00:00 Last Updated: 2024-09-19T18:41:34.903Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/settings endpoint). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://herolab.usd.de/security-advisories/usd-2023-0010/ - https://freemarker.apache.org/docs/api/freemarker/template/utility/Execu
lab.usd.de/security-advisories/usd-2023-0010/ - https://freemarker.apache.org/docs/api/freemarker/template/utility/Execute.html
CVE ID: CVE-2023-45311 State: PUBLISHED Published: 2023-10-06T00:00:00 Last Updated: 2024-11-26T21:45:11.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project (that depends on fsevents) distributes code that was obtained from that URL at a time when it was controlled by an adversary. NOTE: some sources feel that this means that no version is affected any longer, because the URL is not controlled by an adversary. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https
trolled by an adversary. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/fsevents/fsevents/compare/v1.2.10...v1.2.11 - https://github.com/atlassian/react-immutable-proptypes/blob/ddb9fa5194b931bf7528eb4f2c0a8c3434f70edd/package-lock.json#L153 - https://github.com/atlassian/moo/blob/56ccbdd41b493332bc2cd7a4097a5802594cdb9c/package-lock.json#L1901-L1902 - https://github.com/cloudflare/authr/blob/3f6129d97d06e61033a7f237d84e35e678db490f/ts/package-lock.json#L1512 - https://github.com/cloudflare/hugo-cloudflare-docs/blob/e0f7cfa195af8ef1bfa51a487be7d34ba298ed06/package-lock.json#L494 - https://github.com/cloudflare/redux-grim/blob/b652
lob/e0f7cfa195af8ef1bfa51a487be7d34ba298ed06/package-lock.json#L494 - https://github.com/cloudflare/redux-grim/blob/b652f99f95fb16812336073951adc5c5a93e2c23/package-lock.json#L266-L267 - https://github.com/cloudflare/serverless-cloudflare-workers/blob/e95e1e9c9770ed9a3d9480c1fa73e64391268354/package-lock.json#L737 - https://security.snyk.io/vuln/SNYK-JS-FSEVENTS-5487987
CVE ID: CVE-2023-45312 State: PUBLISHED Published: 2023-10-10T00:00:00 Last Updated: 2024-09-18T19:49:40.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the mtproto_proxy (aka MTProto proxy) component through 0.7.2 for Erlang, a low-privileged remote attacker can access an improperly secured default installation without authenticating and achieve remote command execution ability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40_sadshade/almost-2000-telegram-proxy-servers-are-potentially-vulnerable-to-rce-since-2018-742a455be16b
CVE ID: CVE-2023-45315 State: PUBLISHED Published: 2024-05-16T20:47:22.811Z Last Updated: 2024-08-02T20:21:15.403Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) Power Gadget software for Windwos Problem Types: denial of service, CWE-665 Description: Improper initialization in some Intel(R) Power Gadget software for Windwos all versions may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01037.html
CVE ID: CVE-2023-45316 State: PUBLISHED Published: 2023-12-12T08:23:17.299Z Last Updated: 2025-05-24T10:26:51.058Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H) Vendors: Mattermost Products: Mattermost Problem Types: CWE-352 Description: Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a telemetry run ID, allowing an attacker to use a path traversal payload that points to a different endpoint leading to a CSRF attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-45317 State: PUBLISHED Published: 2023-10-26T16:17:37.365Z Last Updated: 2025-01-16T21:28:15.955Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Sielco, Sielco Products: Analog FM transmitter, Radio Link Problem Types: CWE-352 Description: The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisor
lyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-08 - https://www.sielco.org/en/contacts
CVE ID: CVE-2023-45318 State: PUBLISHED Published: 2024-02-20T14:45:02.103Z Last Updated: 2025-11-04T18:17:44.895Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Silicon Labs, Weston Embedded Products: Gecko Platform, uC-HTTP Problem Types: CWE-122 Description: A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP git commit 80d4004. A specially crafted network packet can lead to arbitrary code execution. An attacker can send a malicious packet to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerab
al Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1843
CVE ID: CVE-2023-45319 State: PUBLISHED Published: 2023-11-08T15:43:58.737Z Last Updated: 2024-11-11T14:26:24.503Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Helix Products: Helix Core Problem Types: CWE-400 Description: In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the commit function was identified. Reported by Jason Geffner. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://perforce.com
CVE ID: CVE-2023-45320 State: PUBLISHED Published: 2024-05-16T20:47:27.184Z Last Updated: 2024-08-02T20:21:15.392Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) VTune(TM) Profiler software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path element in some Intel(R) VTune(TM) Profiler software before version 2024.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01034.html
CVE ID: CVE-2023-45321 State: PUBLISHED Published: 2023-10-25T14:16:41.097Z Last Updated: 2024-09-11T18:11:00.080Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Bosch Rexroth AG Products: ctrlX HMI Web Panel - WR21 (WR2107), ctrlX HMI Web Panel - WR21 (WR2110), ctrlX HMI Web Panel - WR21 (WR2115) Problem Types: CWE-319 Description: The Android Client application, when enrolled with the define method 1 (the user manually inserts the server ip address), use HTTP protocol to retrieve sensitive information (ip address and credentials to connect to a remote MQTT broker entity) instead of HTTPS and this feature is not configurable by the user. Due to the lack of e
to a remote MQTT broker entity) instead of HTTPS and this feature is not configurable by the user. Due to the lack of encryption of HTTP,this issue allows an attacker placed in the same subnet network of the HMI device to intercept username and password necessary to authenticate to the MQTT server responsible to implement the remote management protocol. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html
CVE ID: CVE-2023-45322 State: PUBLISHED Published: 2023-10-06T00:00:00.000Z Last Updated: 2025-11-03T20:36:02.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.gnome.org/GNOME/libxml2/-/issues/583 - https://gitlab.gnome.org/GNOME/libxml2/-/issues/344 - http:
ces: - https://gitlab.gnome.org/GNOME/libxml2/-/issues/583 - https://gitlab.gnome.org/GNOME/libxml2/-/issues/344 - http://www.openwall.com/lists/oss-security/2023/10/06/5
CVE ID: CVE-2023-45323 State: PUBLISHED Published: 2023-11-02T13:08:55.439Z Last Updated: 2024-09-17T13:11:28.757Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Food Ordering System Problem Types: CWE-89 Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'name' parameter of the routers/add-item.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/hann - https://projectw
VE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/hann - https://projectworlds.in/
CVE ID: CVE-2023-45324 State: REJECTED Published: 2023-11-02T13:11:35.366Z Last Updated: 2024-01-02T16:18:50.177Z Description: No description available.
CVE ID: CVE-2023-45325 State: PUBLISHED Published: 2023-11-02T13:12:58.449Z Last Updated: 2024-09-17T13:10:39.856Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Food Ordering System Problem Types: CWE-89 Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'address' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/hann - https://proj
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/hann - https://projectworlds.in/
CVE ID: CVE-2023-45326 State: REJECTED Published: 2023-11-02T13:14:13.530Z Last Updated: 2024-01-02T20:09:19.161Z Description: No description available.
CVE ID: CVE-2023-45327 State: REJECTED Published: 2023-11-02T13:15:36.249Z Last Updated: 2024-01-02T20:09:31.555Z Description: No description available.
CVE ID: CVE-2023-45328 State: REJECTED Published: 2023-11-02T13:16:36.004Z Last Updated: 2024-01-02T20:08:45.338Z Description: No description available.
CVE ID: CVE-2023-45329 State: REJECTED Published: 2023-11-02T13:18:42.114Z Last Updated: 2024-01-02T16:28:27.178Z Description: No description available.
CVE ID: CVE-2023-45330 State: REJECTED Published: 2023-11-02T13:19:29.176Z Last Updated: 2024-01-02T20:09:46.653Z Description: No description available.
CVE ID: CVE-2023-45331 State: REJECTED Published: 2023-11-02T13:21:52.472Z Last Updated: 2024-01-02T16:30:54.366Z Description: No description available.
CVE ID: CVE-2023-45332 State: REJECTED Published: 2023-11-02T13:22:34.723Z Last Updated: 2024-01-02T16:31:53.950Z Description: No description available.
CVE ID: CVE-2023-45333 State: REJECTED Published: 2023-11-02T13:23:50.739Z Last Updated: 2024-01-02T16:32:46.267Z Description: No description available.
CVE ID: CVE-2023-45334 State: PUBLISHED Published: 2023-11-02T13:24:51.598Z Last Updated: 2024-09-17T13:09:43.134Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Food Ordering System Problem Types: CWE-89 Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'status' parameter of the routers/edit-orders.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/hann - https://pro
: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/hann - https://projectworlds.in/
CVE ID: CVE-2023-45335 State: REJECTED Published: 2023-11-02T13:25:30.082Z Last Updated: 2024-01-02T16:34:24.923Z Description: No description available.
CVE ID: CVE-2023-45336 State: PUBLISHED Published: 2023-11-02T13:26:16.010Z Last Updated: 2024-08-02T20:21:16.203Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Food Ordering System Problem Types: CWE-89 Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of the routers/router.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/hann - https://projectworlds.in/
CVE ID: CVE-2023-45337 State: REJECTED Published: 2023-11-02T13:29:27.081Z Last Updated: 2024-01-02T16:35:46.396Z Description: No description available.
CVE ID: CVE-2023-45338 State: PUBLISHED Published: 2023-11-02T14:01:11.776Z Last Updated: 2024-09-12T19:40:05.171Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Food Ordering System Problem Types: CWE-89 Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the routers/add-ticket.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/hann - https://projectw
CVE ID: CVE-2023-45339 State: REJECTED Published: 2023-11-02T13:35:39.239Z Last Updated: 2024-01-02T16:37:09.644Z Description: No description available.
CVE ID: CVE-2023-45340 State: PUBLISHED Published: 2023-11-02T13:38:56.311Z Last Updated: 2024-08-02T20:21:16.367Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Food Ordering System Problem Types: CWE-89 Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'phone' parameter of the routers/details-router.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/hann - https://projectworlds.in/
CVE ID: CVE-2023-45341 State: PUBLISHED Published: 2023-11-02T13:58:33.567Z Last Updated: 2025-06-12T14:32:18.454Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Food Ordering System Problem Types: CWE-89 Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_price' parameter of the routers/menu-router.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/hann - https://pr
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/hann - https://projectworlds.in/
CVE ID: CVE-2023-45342 State: PUBLISHED Published: 2023-11-02T13:47:58.195Z Last Updated: 2024-08-02T20:21:15.954Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Food Ordering System Problem Types: CWE-89 Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'phone' parameter of the routers/register-router.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/hann - https://projectworlds.in/
CVE ID: CVE-2023-45343 State: PUBLISHED Published: 2023-11-02T13:59:16.838Z Last Updated: 2024-08-02T20:21:16.474Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Food Ordering System Problem Types: CWE-89 Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'ticket_id' parameter of the routers/ticket-message.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/hann - https://projectworlds.in/
CVE ID: CVE-2023-45344 State: PUBLISHED Published: 2023-11-02T13:57:07.765Z Last Updated: 2024-09-17T13:09:07.695Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Food Ordering System Problem Types: CWE-89 Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_balance' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/hann - https://
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/hann - https://projectworlds.in/
CVE ID: CVE-2023-45345 State: PUBLISHED Published: 2023-11-02T14:02:52.659Z Last Updated: 2024-09-12T19:39:01.831Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Food Ordering System Problem Types: CWE-89 Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_deleted' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/hann - https://
CVE ID: CVE-2023-45346 State: PUBLISHED Published: 2023-11-02T14:03:34.706Z Last Updated: 2024-09-12T19:38:06.224Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Food Ordering System Problem Types: CWE-89 Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_role' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/hann - https://pro
CVE ID: CVE-2023-45347 State: PUBLISHED Published: 2023-11-02T14:04:17.696Z Last Updated: 2024-09-12T19:37:16.684Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Food Ordering System Problem Types: CWE-89 Description: Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_verified' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/hann - https:/
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/hann - https://projectworlds.in/
CVE ID: CVE-2023-45348 State: PUBLISHED Published: 2023-10-14T09:46:44.563Z Last Updated: 2025-02-13T17:14:03.098Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-200 Description: Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the "expose_config" option is set to "non-sensitive-only". The `expose_config` option is False by default. It is recommended to upgrade to a version that is not affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/34712 - https://lists.apache