Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-3202 State: PUBLISHED Published: 2023-07-12T04:38:50.393Z Last Updated: 2024-10-22T19:17:21.160Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: inspireui Products: MStore API Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_firebase_server_key function. This makes it possible for unauthenticated attackers to update the firebase server key to push notification when order status changed via a forged request granted they can trick a site administrator into performing an action such as clickin
tatus changed via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b3612e-3c91-469b-98ef-fdb03b0ee9d9?source=cve - https://plugins.trac.wordpress.org/browser/mstore-api/trunk/mstore-api.php#L232 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925048%40mstore-api&new=2925048%40mstore-api&sfp_email=&sfph_mail=
CVE ID: CVE-2023-3203 State: PUBLISHED Published: 2023-06-14T01:47:48.730Z Last Updated: 2024-12-03T16:33:20.218Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: inspireui Products: MStore API Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_limit_product function. This makes it possible for unauthenticated attackers to update limit the number of product per category to use cache data in home screen via a forged request granted they can trick a site administrator into performing an action such as clicking o
ome screen via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1aed51a2-9fd4-43bb-b72d-ae8e51ee6e87?source=cve - https://plugins.trac.wordpress.org/browser/mstore-api/trunk/mstore-api.php#L222 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925048%40mstore-api&new=2925048%40mstore-api&sfp_email=&sfph_mail=
CVE ID: CVE-2023-3204 State: PUBLISHED Published: 2024-06-20T02:08:26.797Z Last Updated: 2024-08-02T06:48:08.148Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: extendthemes Products: Materialis Problem Types: CWE-862 Missing Authorization Description: The Materialis theme for WordPress is vulnerable to limited arbitrary options updates in versions up to, and including, 1.1.24. This is due to missing authorization checks on the companion_disable_popup() function called via an AJAX action. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to modify any option on the site to a numerical value. Additional Analyst
with minimal permissions such as subscribers, to modify any option on the site to a numerical value. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e05094-8344-4388-a703-518daf3d2948?source=cve - https://themes.trac.wordpress.org/browser/materialis/1.1.20/inc/companion.php#L45 - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=231816%40materialis&new=231816%40materialis&sfp_email=&sfph_mail=#file6
CVE ID: CVE-2023-3205 State: PUBLISHED Published: 2023-09-01T10:01:26.675Z Last Updated: 2025-11-20T04:07:03.335Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-1333 Description: An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/415067 - https:
A ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/415067 - https://hackerone.com/reports/2011464
CVE ID: CVE-2023-3206 State: PUBLISHED Published: 2023-06-12T15:00:05.574Z Last Updated: 2024-08-02T06:48:07.821Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Chengdu Products: VEC40G Problem Types: CWE-404 Description: A vulnerability classified as problematic was found in Chengdu VEC40G 3.0. Affected by this vulnerability is an unknown functionality of the file /send_order.cgi?parameter=restart. The manipulation of the argument restart with the input reboot leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231229 was assigned to this vulnerability. NOTE: The
s been disclosed to the public and may be used. The identifier VDB-231229 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231229 - https://vuldb.com/?ctiid.231229 - https://github.com/shulao2020/cve/blob/main/Flying%20Fish.md
CVE ID: CVE-2023-3207 State: REJECTED Published: N/A Last Updated: 2024-08-16T19:19:47.762Z Description: No description available.
CVE ID: CVE-2023-3208 State: PUBLISHED Published: 2023-06-12T15:00:07.028Z Last Updated: 2025-01-06T16:03:47.466Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: RoadFlow Products: Visual Process Engine .NET Core Mvc Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in RoadFlow Visual Process Engine .NET Core Mvc 2.13.3. Affected by this issue is some unknown functionality of the file /Log/Query?appid=0B736354-9473-4D66-B9C0-15CAC149EB05&tabid=tab_0B73635494734D66B9C015CAC149EB05 of the component Login. The manipulation of the argument sidx/sord leads to sql injection. The attack may be launched remotely. The exploit has been di
ipulation of the argument sidx/sord leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-231230 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.231230 - https://vuldb.com/?ctiid.231230 - https://github.com/yangxixx/vulhub/blob/master/activemq/RoadFlow.md
CVE ID: CVE-2023-3209 State: PUBLISHED Published: 2023-07-10T12:41:04.575Z Last Updated: 2024-11-08T18:21:41.341Z Vendors: Unknown Products: MStore API Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/970735f1-24bb-441c-89b6-5a0959246d6c
CVE ID: CVE-2023-3210 State: PUBLISHED Published: 2023-09-01T10:31:06.983Z Last Updated: 2025-11-20T04:07:08.262Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-1333 Description: An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/415074 - https:
A ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/415074 - https://hackerone.com/reports/2011474
CVE ID: CVE-2023-3211 State: PUBLISHED Published: 2024-01-16T15:54:01.909Z Last Updated: 2025-06-11T16:48:54.966Z Vendors: Unknown Products: WordPress Database Administrator Problem Types: CWE-89 SQL Injection Description: The WordPress Database Administrator WordPress plugin through 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/873824f0-e8b1-45bd-8579-bc3c649a54e5/
CVE ID: CVE-2023-3212 State: PUBLISHED Published: 2023-06-23T00:00:00 Last Updated: 2024-08-02T06:48:08.292Z Vendors: n/a Products: Linux kernel (gfs2 file system) Problem Types: CWE-476 Description: A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2214348 - https://github.com/torvalds/linux/commit/504a10d9e46bc37b23d0a1ae2f28973
//bugzilla.redhat.com/show_bug.cgi?id=2214348 - https://github.com/torvalds/linux/commit/504a10d9e46bc37b23d0a1ae2f28973c8516e636 - https://www.debian.org/security/2023/dsa-5448 - https://www.debian.org/security/2023/dsa-5480 - https://security.netapp.com/advisory/ntap-20230929-0005/ - https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html - https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
CVE ID: CVE-2023-3213 State: PUBLISHED Published: 2023-10-04T01:52:39.357Z Last Updated: 2024-09-19T19:26:09.008Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: WPForms (Awesome Motive) Products: WP Mail SMTP Pro Problem Types: CWE-862 Missing Authorization Description: The WP Mail SMTP Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_print_page function in versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to disclose potentially sensitive email information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
tive email information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a813251b-a4c1-4b23-ad03-dcc1f4f19eb9?source=cve - https://wpmailsmtp.com/docs/how-to-view-recent-changes-to-the-wp-mail-smtp-plugin-changelog/
CVE ID: CVE-2023-3214 State: PUBLISHED Published: 2023-06-13T17:51:08.391Z Last Updated: 2025-05-05T15:55:51.870Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Autofill payments in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_13.html - https://crbug.com/1450568 - https://www.debian.org/security/2023/dsa-5428 - https://lists.fedoraproject.org/archives/list/pa
s://crbug.com/1450568 - https://www.debian.org/security/2023/dsa-5428 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O362DC3ZCFRXVHOXMPIL73YOWABQEUYD/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEH75UOM7FAXDUPC37YHP7ONL2HSDIJR/ - https://security.gentoo.org/glsa/202311-11 - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-3215 State: PUBLISHED Published: 2023-06-13T17:51:08.540Z Last Updated: 2025-05-05T15:55:40.793Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in WebRTC in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_13.html - https://crbug.com/1446274 - https://www.debian.org/security/2023/dsa-5428 - https://lists.fedoraproject.org/archives/list/package-announce@
446274 - https://www.debian.org/security/2023/dsa-5428 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O362DC3ZCFRXVHOXMPIL73YOWABQEUYD/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEH75UOM7FAXDUPC37YHP7ONL2HSDIJR/ - https://security.gentoo.org/glsa/202311-11 - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-3216 State: PUBLISHED Published: 2023-06-13T17:51:08.949Z Last Updated: 2025-05-05T15:55:31.159Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type confusion in V8 in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_13.html - https://crbug.com/1450114 - https://www.debian.org/security/2023/dsa-5428 - https://lists.fedoraproject.org/archives/list/package-announce@list
14 - https://www.debian.org/security/2023/dsa-5428 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O362DC3ZCFRXVHOXMPIL73YOWABQEUYD/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEH75UOM7FAXDUPC37YHP7ONL2HSDIJR/ - https://security.gentoo.org/glsa/202311-11 - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-3217 State: PUBLISHED Published: 2023-06-13T17:51:09.218Z Last Updated: 2025-05-05T15:55:21.764Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in WebXR in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_13.html - https://crbug.com/1450601 - https://www.debian.org/security/2023/dsa-5428 - https://lists.fedoraproject.org/archives/list/package-announce@l
50601 - https://www.debian.org/security/2023/dsa-5428 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O362DC3ZCFRXVHOXMPIL73YOWABQEUYD/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEH75UOM7FAXDUPC37YHP7ONL2HSDIJR/ - http://packetstormsecurity.com/files/173495/Chrome-device-OpenXrApiWrapper-InitSession-Heap-Use-After-Free.html - https://security.gentoo.org/glsa/202311-11 - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-3218 State: PUBLISHED Published: 2023-06-13T00:00:00 Last Updated: 2025-01-03T02:11:18.297Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: it-novum Products: it-novum/openitcockpit Problem Types: CWE-366 Description: Race Condition within a Thread in GitHub repository it-novum/openitcockpit prior to 4.6.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/94d50b11-20ca-46e3-9086-dd6836421675 - https://github.com/it-novum/openitcockpit/commit/2c2c243964dda97a82eddb3804e39f9665c574bb
CVE ID: CVE-2023-3219 State: PUBLISHED Published: 2023-07-10T12:41:20.078Z Last Updated: 2025-02-13T16:50:23.754Z Vendors: Unknown Products: EventON Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/72d80887-0270-4987-
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/72d80887-0270-4987-9739-95b1a178c1fd - http://packetstormsecurity.com/files/173992/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object-Reference.html
CVE ID: CVE-2023-3220 State: PUBLISHED Published: 2023-06-20T00:00:00.000Z Last Updated: 2025-03-11T14:28:13.664Z Vendors: n/a Products: Linux kernel Problem Types: CWE-476 Description: An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() and will cause the NULL Pointer Dereference. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93340e10b9c5fc86730d149636e0aa8b47bb5a34
CVE ID: CVE-2023-3221 State: PUBLISHED Published: 2023-09-04T12:31:30.699Z Last Updated: 2024-09-30T18:47:09.349Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: AlfnRU Products: Password Recovery Plugin Problem Types: CWE-204 Description: User enumeration vulnerability in Password Recovery plugin 1.2 version for Roundcube, which could allow a remote attacker to create a test script against the password recovery function to enumerate all users in the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-roundcube-password-recovery-plugin
CVE ID: CVE-2023-3222 State: PUBLISHED Published: 2023-09-04T12:49:47.169Z Last Updated: 2024-09-30T18:46:16.475Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: AlfnRU Products: Password Recovery Plugin Problem Types: CWE-640 Description: Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote attacker to change an existing user´s password by adding a 6-digit numeric token. An attacker could create an automatic script to test all possible values because the platform has no limit on the number of requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichmen
atform has no limit on the number of requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-roundcube-password-recovery-plugin
CVE ID: CVE-2023-3223 State: PUBLISHED Published: 2023-09-27T13:54:44.682Z Last Updated: 2024-08-02T06:48:07.955Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Fuse 7.12.1, Red Hat JBoss Enterprise Application Platform 7.1.0, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9, Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7, Red Hat Single Sign-On 7.6.5, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, RHEL-8 based Middleware Containers, Red Hat build of Quarkus, Red Hat Data Grid 8,
ed Hat Single Sign-On 7.6 for RHEL 9, RHEL-8 based Middleware Containers, Red Hat build of Quarkus, Red Hat Data Grid 8, Red Hat Decision Manager 7, Red Hat Integration Camel K, Red Hat Integration Service Registry, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Fuse 6, Red Hat OpenStack Platform 13 (Queens) Operational Tools, Red Hat Process Automation 7, Red Hat support for Spring Boot Problem Types: CWE-789 Description: A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If
ror due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:4505 - https://access.redhat.com/errata/RHSA-2023:4506 - https://access.redhat.com/errata/RHSA-2023:4507 - https://access.redhat.com/errata/RHSA-2023:4509 - https://access.redhat.com/errata/RHSA-2023:4918 - https://access.redhat.com/errata/RHSA-2023:4919 - https://access.redhat.com/errata/RHSA-2023:4920
rata/RHSA-2023:4918 - https://access.redhat.com/errata/RHSA-2023:4919 - https://access.redhat.com/errata/RHSA-2023:4920 - https://access.redhat.com/errata/RHSA-2023:4921 - https://access.redhat.com/errata/RHSA-2023:4924 - https://access.redhat.com/errata/RHSA-2023:7247 - https://access.redhat.com/security/cve/CVE-2023-3223 - https://bugzilla.redhat.com/show_bug.cgi?id=2209689 - https://security.netapp.com/advisory/ntap-20231027-0004/
CVE ID: CVE-2023-3224 State: PUBLISHED Published: 2023-06-13T00:00:00 Last Updated: 2025-01-03T02:10:07.186Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: nuxt Products: nuxt/nuxt Problem Types: CWE-94 Description: Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/1eb74fd8-0258-4c1f-a904-83b52e373a87 - https://github.com/nuxt/nuxt/commit/65a8f4eb3ef1b249a95fd59e323835a96428baff
CVE ID: CVE-2023-3225 State: PUBLISHED Published: 2023-07-10T12:41:13.941Z Last Updated: 2024-11-12T17:02:57.826Z Vendors: Unknown Products: Float menu Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Float menu WordPress plugin before 5.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3c76d0f4-2ea8-433d-afb2-e35e45630899
CVE ID: CVE-2023-3226 State: PUBLISHED Published: 2023-09-25T15:56:52.128Z Last Updated: 2024-08-02T06:48:08.186Z Vendors: Unknown Products: Popup Builder Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Popup Builder WordPress plugin before 4.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/941a9aa7-f4b2-474a-84d9-9a74c99079e2