Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-44763 State: PUBLISHED Published: 2023-10-10T00:00:00 Last Updated: 2024-08-02T20:07:33.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting (XSS). NOTE: the vendor's position is that a customer is supposed to know that "pdf" should be excluded from the allowed file types, even though pdf is one of the allowed file types in the default configuration. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sromanhu/ConcreteCMS-Arbitrary-file-upload-Thumbnail - https://www.concretecms.org/about/project-n
- https://github.com/sromanhu/ConcreteCMS-Arbitrary-file-upload-Thumbnail - https://www.concretecms.org/about/project-news/security/security-advisory-2023-10-25-concrete-cms-rejects-cve-2023-44763 - https://web.archive.org/web/20231026034159/https://documentation.concretecms.org/user-guide/editors-reference/dashboard/system-and-maintenance/files/allowed-file-types
CVE ID: CVE-2023-44764 State: PUBLISHED Published: 2023-10-06T00:00:00 Last Updated: 2024-08-02T20:07:33.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability in Concrete CMS before 9.2.3 exists via the Name parameter during installation (aka Site of Installation or Settings). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sromanhu/ConcreteCMS-Stored-XSS---Site_Installation - https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes
CVE ID: CVE-2023-44765 State: PUBLISHED Published: 2023-10-06T00:00:00 Last Updated: 2024-08-02T20:07:33.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability in Concrete CMS versions 8.5.12 and below, and 9.0 through 9.2.1 allows an attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sromanhu/ConcreteCMS-Stored-XSS---Associations - https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release
CVE ID: CVE-2023-44766 State: PUBLISHED Published: 2023-10-06T00:00:00 Last Updated: 2024-08-02T20:07:33.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings. NOTE: the vendor disputes this because this SEO-related header change can only be made by an admin, and allowing an admin to place JavaScript there is an intentional customization feature. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sromanhu/ConcreteCMS-Stored-XSS---SEO - https://www.concretecms.org/about/project-news
References: - https://github.com/sromanhu/ConcreteCMS-Stored-XSS---SEO - https://www.concretecms.org/about/project-news/security/security-advisory-2023-10-31-concrete-cms-rejects-cve-2023-44760-and-cve-2023-44766
CVE ID: CVE-2023-44767 State: PUBLISHED Published: 2023-10-24T00:00:00 Last Updated: 2024-09-11T18:17:48.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: A File upload vulnerability in RiteCMS 3.0 allows a local attacker to upload a SVG file with XSS content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/RiteCMS-File-Upload--XSS---Filemanager/blob/main/README.md
CVE ID: CVE-2023-44769 State: PUBLISHED Published: 2023-10-24T00:00:00 Last Updated: 2024-09-17T14:18:58.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Spare aliases from Alias. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/ZenarioCMS--Reflected-XSS---Alias/tree/main - https://github.com/sromanhu/CVE-2023-44769_ZenarioCMS--Reflected-XSS---Alias/tree/main
CVE ID: CVE-2023-44770 State: PUBLISHED Published: 2023-10-06T00:00:00 Last Updated: 2024-09-19T16:27:32.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows an attacker to execute arbitrary code via a crafted script to the Organizer - Spare alias. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/ZenarioCMS--Reflected-XSS---Organizer-Alias/blob/main/README.md
CVE ID: CVE-2023-44771 State: PUBLISHED Published: 2023-10-06T00:00:00 Last Updated: 2024-09-19T16:26:17.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Page Layout. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/ZenarioCMS--Stored-XSS---Page-Layout
CVE ID: CVE-2023-44793 State: REJECTED Published: N/A Last Updated: 2023-10-12T04:03:18.731261 Description: No description available.
CVE ID: CVE-2023-44794 State: PUBLISHED Published: 2023-10-25T00:00:00 Last Updated: 2024-09-12T14:31:44.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dromara/Sa-Token/issues/515
CVE ID: CVE-2023-44796 State: PUBLISHED Published: 2023-11-17T00:00:00 Last Updated: 2024-08-02T20:07:33.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a remote attacker to escalate privileges via a crafted script to the _generaloptions_panel.php component. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LimeSurvey/LimeSurvey/pull/3483 - https://github.com/limesurvey/limesurvey/commit/135511073c51c332613dd7fad9a8ca0aad34a3fe - https://github.com/Hebing123/CVE-2023-44796/issues/1 - https://github.com/Hebing123/cve/issues/4
CVE ID: CVE-2023-44807 State: PUBLISHED Published: 2023-10-06T00:00:00 Last Updated: 2024-09-19T16:24:51.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the cancelPing function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/Archerber/bug_submit/blob/main/D-Link/DIR-820l/bug2.md
CVE ID: CVE-2023-44808 State: PUBLISHED Published: 2023-10-16T00:00:00 Last Updated: 2024-09-16T18:40:36.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_4507CC function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Archerber/bug_submit/blob/main/D-Link/DIR-820l/bug3.md
CVE ID: CVE-2023-44809 State: PUBLISHED Published: 2023-10-16T00:00:00 Last Updated: 2024-09-16T18:37:27.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link device DIR-820L 1.05B03 is vulnerable to Insecure Permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Archerber/bug_submit/blob/main/D-Link/DIR-820l/bug1.md
CVE ID: CVE-2023-44811 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-09-19T15:35:50.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the admin Password Change Function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ahrixia/CVE-2023-44811
CVE ID: CVE-2023-44812 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-09-19T15:45:27.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the admin_redirect_url parameter of the user login function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ahrixia/CVE-2023-44812
CVE ID: CVE-2023-44813 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-09-19T15:44:21.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ahrixia/CVE-2023-44813
CVE ID: CVE-2023-44821 State: PUBLISHED Published: 2023-10-09T00:00:00.000Z Last Updated: 2025-11-04T18:17:28.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory consumption). NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new input arrives for a long-running process, does not ship with functionality to link it into another application as a library, and does not have realistic use cases in which an adversary controls the entire command line. Additional Analyst
ibrary, and does not have realistic use cases in which an adversary controls the entire command line. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kohler/gifsicle/issues/195 - https://github.com/kohler/gifsicle/issues/65 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WLTXJS6AIKPGVOAJ7EYC4HL3NEG6CGF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3I6Z7VAHUYX3Q4DULJ76NFD2CIFZJYH5/
CVE ID: CVE-2023-44824 State: PUBLISHED Published: 2023-10-17T00:00:00 Last Updated: 2024-09-16T15:17:59.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Expense Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted file uploaded to the sign-up.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://abstracted-howler-727.notion.site/Vulnerability-Description-ccc2e6489a0d43859c61a7982e649da1 - https://abstracted-howler-727.notion.site/CVE-2023-44824-ab76909b4a0e477b87aa8d0ca4aa4ca7 - https://gist.github.com/Muscial/e46c4e4031d25a3684cda124dfc45d96
CVE ID: CVE-2023-44826 State: PUBLISHED Published: 2023-10-10T00:00:00 Last Updated: 2024-09-19T14:33:04.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in ZenTaoPMS v.18.6 allows a local attacker to obtain sensitive information via a crafted script. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jacyyang52/chandaoxss/
CVE ID: CVE-2023-44827 State: PUBLISHED Published: 2023-10-10T00:00:00 Last Updated: 2024-09-19T14:11:51.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execute arbitrary code via a crafted script to the Office Conversion Settings function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://spotted-topaz-6aa.notion.site/Zentao-Authorized-Remote-Code-Execution-Vulnerability-CVE-2023-44827-be731cbe8607496cae35c08cb9ba2436
CVE ID: CVE-2023-44828 State: PUBLISHED Published: 2023-10-05T00:00:00 Last Updated: 2024-09-19T19:16:53.345Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the CurrentPassword parameter in the CheckPasswdSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/CheckPasswdSettings_CurrentPassword
CVE ID: CVE-2023-44829 State: PUBLISHED Published: 2023-10-05T00:00:00 Last Updated: 2024-09-19T19:15:58.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the AdminPassword parameter in the SetDeviceSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetDeviceSettings_AdminPassword
CVE ID: CVE-2023-44830 State: PUBLISHED Published: 2023-10-05T00:00:00 Last Updated: 2024-09-19T19:14:55.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the EndTime parameter in the SetParentsControlInfo function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetParentsControlInfo_EndTime
CVE ID: CVE-2023-44831 State: PUBLISHED Published: 2023-10-05T00:00:00 Last Updated: 2024-09-19T19:13:52.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Type parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetWLanRadioSettings_Type
CVE ID: CVE-2023-44832 State: PUBLISHED Published: 2023-10-05T00:00:00 Last Updated: 2024-09-19T19:12:50.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the MacAddress parameter in the SetWanSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetWanSettings_MacAddress
CVE ID: CVE-2023-44833 State: PUBLISHED Published: 2023-10-05T00:00:00 Last Updated: 2024-09-19T19:11:23.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the GuardInt parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetWLanRadioSettings_GuardInt
CVE ID: CVE-2023-44834 State: PUBLISHED Published: 2023-10-05T00:00:00 Last Updated: 2024-09-19T19:10:21.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the StartTime parameter in the SetParentsControlInfo function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetParentsControlInfo_%20StartTime
CVE ID: CVE-2023-44835 State: PUBLISHED Published: 2023-10-05T00:00:00 Last Updated: 2024-09-19T19:09:25.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Mac parameter in the SetParentsControlInfo function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetParentsControlInfo_Mac
CVE ID: CVE-2023-44836 State: PUBLISHED Published: 2023-10-05T00:00:00 Last Updated: 2024-09-19T19:08:20.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the SSID parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetWLanRadioSettings_SSID
CVE ID: CVE-2023-44837 State: PUBLISHED Published: 2023-10-05T00:00:00 Last Updated: 2024-09-19T19:06:55.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Password parameter in the SetWanSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetWanSettings_Password
CVE ID: CVE-2023-44838 State: PUBLISHED Published: 2023-10-05T00:00:00 Last Updated: 2024-09-19T17:55:21.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the TXPower parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetWLanRadioSettings_TXPower
CVE ID: CVE-2023-44839 State: PUBLISHED Published: 2023-10-05T00:00:00 Last Updated: 2024-09-19T17:47:55.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Encryption parameter in the SetWLanRadioSecurity function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/bugfinder0/public_bug/tree/main/dlink/dir823g/SetWLanRadioSecurity_Encryption
CVE ID: CVE-2023-44846 State: PUBLISHED Published: 2023-10-10T00:00:00 Last Updated: 2024-09-19T14:31:25.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ notify.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.csdn.net/2301_79997870/article/details/133365547?spm=1001.2014.3001.5501 - https://blog.csdn.net/2301_79997870/article/details/133661890?spm=1001.2014.3001.5502
CVE ID: CVE-2023-44847 State: PUBLISHED Published: 2023-10-10T00:00:00 Last Updated: 2024-09-19T14:29:46.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ Weixin.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.csdn.net/2301_79997870/article/details/133661890?spm=1001.2014.3001.5502
CVE ID: CVE-2023-44848 State: PUBLISHED Published: 2023-10-10T00:00:00 Last Updated: 2024-09-19T14:02:05.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_template.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.csdn.net/2301_79997870/article/details/133661890?spm=1001.2014.3001.5502
CVE ID: CVE-2023-44852 State: PUBLISHED Published: 2024-04-12T00:00:00.000Z Last Updated: 2025-03-26T20:26:39.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the c_set_traps_decode function in the acu_web file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://pine-amphibian-9b9.notion.site/ENG-SAILOR-Ku-Software-XSS-SNMP-traps-82fcaaf379ba4a4cbc16143c6da6c258
CVE ID: CVE-2023-44853 State: PUBLISHED Published: 2024-04-12T00:00:00 Last Updated: 2024-08-02T20:07:33.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: \An issue was discovered in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the sub_219C4 function in the acu_web file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://pine-amphibian-9b9.notion.site/SAILOR-Ku-Software-RCE-and-Privilege-Escalation-Diagnostics-report-0f3923d0ed434705b7ed4a6174218c2b?pvs=4
CVE ID: CVE-2023-44854 State: PUBLISHED Published: 2024-04-12T00:00:00 Last Updated: 2024-12-03T15:53:07.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the c_set_rslog_decode function in the acu_web file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://pine-amphibian-9b9.notion.site/ENG-SAILOR-Ku-Software-XSS-Remote-syslog-131b8031c9f74600aa3279c7d733d624
CVE ID: CVE-2023-44855 State: PUBLISHED Published: 2024-04-12T00:00:00 Last Updated: 2024-08-02T20:07:33.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019 allows a remote attacker to execute arbitrary code via a crafted script to the rdiag, sender, and recipients parameters of the sub_219C4 function in the acu_web file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://pine-amphibian-9b9.notion.site/ENG-SAILOR-Ku-Software-XSS-Diagnostics-report-019462dcebf6428da34dd7daee21583b
CVE ID: CVE-2023-44856 State: PUBLISHED Published: 2024-04-12T00:00:00 Last Updated: 2024-11-01T14:41:52.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the rstat, sender, and recipients' parameters of the sub_21D24 function in the acu_web file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://pine-amphibian-9b9.notion.site/ENG-SAILOR-Ku-Software-XSS-Statistics-report-e97364c9d09449cf8869417e7187e997