Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-47071 State: PUBLISHED Published: 2023-11-17T10:55:41.896Z Last Updated: 2024-08-02T21:01:22.672Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: After Effects Problem Types: CWE-125 Description: Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.ado
a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/after_effects/apsb23-66.html
CVE ID: CVE-2023-47072 State: PUBLISHED Published: 2023-11-17T10:55:41.125Z Last Updated: 2024-09-04T19:53:51.354Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Adobe Products: After Effects Problem Types: CWE-824 Description: Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
on in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/after_effects/apsb23-66.html
CVE ID: CVE-2023-47073 State: PUBLISHED Published: 2023-11-17T10:55:38.290Z Last Updated: 2024-09-16T18:59:42.129Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: After Effects Problem Types: CWE-787 Description: Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/af
lyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/after_effects/apsb23-66.html
CVE ID: CVE-2023-47074 State: PUBLISHED Published: 2023-12-13T09:30:09.506Z Last Updated: 2025-05-22T18:10:17.215Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-125 Description: Adobe Illustrator versions 28.0 (and earlier) and 27.9 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst
r. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://helpx.adobe.com/security/products/illustrator/apsb23-68.html
CVE ID: CVE-2023-47075 State: PUBLISHED Published: 2023-12-13T09:30:08.696Z Last Updated: 2024-08-02T21:01:22.652Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-416 Description: Adobe Illustrator versions 28.0 (and earlier) and 27.9 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/illustrator/apsb23-68.html
CVE ID: CVE-2023-47076 State: PUBLISHED Published: 2023-12-13T09:38:39.633Z Last Updated: 2024-11-25T21:05:25.788Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Adobe Products: InDesign Desktop Problem Types: CWE-476 Description: Adobe InDesign versions 19.0 (and earlier) and 17.4.2 (and earlier) are affected by a NULL Pointer Dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnri
action in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/indesign/apsb23-70.html
CVE ID: CVE-2023-47077 State: PUBLISHED Published: 2023-12-13T09:38:38.816Z Last Updated: 2024-08-02T21:01:22.616Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: InDesign Desktop Problem Types: CWE-125 Description: Adobe InDesign versions 19.0 (and earlier) and 17.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adob
a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/indesign/apsb23-70.html
CVE ID: CVE-2023-47078 State: PUBLISHED Published: 2023-12-13T13:10:20.107Z Last Updated: 2024-08-02T21:01:22.559Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Dimension Problem Types: CWE-125 Description: Adobe Dimension versions 3.4.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/dimensi
CVE ID: CVE-2023-47079 State: PUBLISHED Published: 2023-12-13T13:10:22.486Z Last Updated: 2024-08-02T21:01:22.684Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Dimension Problem Types: CWE-125 Description: Adobe Dimension versions 3.4.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/dimensi
CVE ID: CVE-2023-47080 State: PUBLISHED Published: 2023-12-13T13:15:59.384Z Last Updated: 2024-08-02T21:01:22.659Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-125 Description: Adobe Substance 3D Stager versions 2.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/secur
st open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/substance3d_stager/apsb23-73.html
CVE ID: CVE-2023-47081 State: PUBLISHED Published: 2023-12-13T13:15:58.605Z Last Updated: 2025-05-22T18:16:35.500Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-125 Description: Adobe Substance 3D Stager versions 2.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
st open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_stager/apsb23-73.html
CVE ID: CVE-2023-47090 State: PUBLISHED Published: 2023-10-30T00:00:00 Last Updated: 2024-09-09T20:30:00.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is 2.2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nats-io/nats-server/security/advisories/GHSA-fr2g-9hjm-wr23 - https://www.openwall.com/lists/oss-security/2023/10/13/
om/nats-io/nats-server/security/advisories/GHSA-fr2g-9hjm-wr23 - https://www.openwall.com/lists/oss-security/2023/10/13/2 - http://www.openwall.com/lists/oss-security/2023/10/30/1
CVE ID: CVE-2023-47091 State: PUBLISHED Published: 2023-12-25T00:00:00.000Z Last Updated: 2025-04-23T16:12:37.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Stormshield Network Security (SNS) SNS 4.3.13 through 4.3.22 before 4.3.23, SNS 4.6.0 through 4.6.9 before 4.6.10, and SNS 4.7.0 through 4.7.1 before 4.7.2. An attacker can overflow the cookie threshold, making an IPsec connection impossible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisories.stormshield.eu - https://advisories.stormshield.eu/2023-024/
CVE ID: CVE-2023-47092 State: REJECTED Published: N/A Last Updated: 2024-01-18T20:43:35.381580 Description: No description available.
CVE ID: CVE-2023-47093 State: PUBLISHED Published: 2023-12-20T00:00:00 Last Updated: 2024-08-02T21:01:22.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.21, 4.4.0 through 4.6.8, and 4.7.0. Sending a crafted ICMP packet may lead to a crash of the ASQ engine. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.stormshield.eu/2023-031/
CVE ID: CVE-2023-47094 State: PUBLISHED Published: 2023-10-31T00:00:00 Last Updated: 2024-09-05T18:10:43.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability in the Account Plans tab of System Settings in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Plan name field while editing Account plan details. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pavanughade43/Virtualmin-7.7/blob/main/CVE-2023-47094
CVE ID: CVE-2023-47095 State: PUBLISHED Published: 2023-10-31T00:00:00 Last Updated: 2024-09-05T18:09:02.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability in the Custom fields of Edit Virtual Server under System Customization in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Batch Label field while details of Virtual Server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pavanughade43/Virtualmin-7.7/blob/main/CVE-2023-47095
CVE ID: CVE-2023-47096 State: PUBLISHED Published: 2023-10-31T00:00:00 Last Updated: 2024-09-05T18:07:31.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross-Site Scripting (XSS) vulnerability in the Cloudmin Services Client under System Setting in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Cloudmin services master field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pavanughade43/Virtualmin-7.7/blob/main/CVE-2023-47096
CVE ID: CVE-2023-47097 State: PUBLISHED Published: 2023-10-31T00:00:00 Last Updated: 2024-09-05T18:05:50.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability in the Server Template under System Setting in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Template name field while creating server templates. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pavanughade43/Virtualmin-7.7/blob/main/CVE-2023-47097
CVE ID: CVE-2023-47098 State: PUBLISHED Published: 2023-10-31T00:00:00 Last Updated: 2024-09-05T18:04:40.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability in the Manage Extra Admins under Administration Options in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the real name or description field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pavanughade43/Virtualmin-7.7/blob/main/CVE-2023-47098
CVE ID: CVE-2023-47099 State: PUBLISHED Published: 2023-10-31T00:00:00 Last Updated: 2024-09-05T18:03:02.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability in the Create Virtual Server in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via Description field while creating the Virtual server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pavanughade43/Virtualmin-7.7/blob/main/CVE-2023-47099
CVE ID: CVE-2023-47100 State: REJECTED Published: 2023-12-02T00:00:00.000Z Last Updated: 2025-10-07T17:35:46.790Z Description: No description available.
CVE ID: CVE-2023-47101 State: PUBLISHED Published: 2023-10-30T00:00:00 Last Updated: 2024-09-09T20:32:04.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: The installer (aka openvpn-client-installer) in Securepoint SSL VPN Client before 2.0.40 allows local privilege escalation during installation or repair. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cyvisory.group/advisory/CYADV-2023-012 - https://sourceforge.net/p/securepoint/news/2023/08/2040-is-now-available/
CVE ID: CVE-2023-47102 State: PUBLISHED Published: 2023-11-07T00:00:00.000Z Last Updated: 2025-09-29T13:50:34.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: UrBackup Server 2.5.31 allows brute-force enumeration of user accounts because a failure message confirms that a username is not valid. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://quantiano.github.io/cve-2023-47102/ - https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-47102
CVE ID: CVE-2023-47104 State: PUBLISHED Published: 2023-10-30T00:00:00 Last Updated: 2024-09-09T20:34:10.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign) in titles, messages, and other input data. NOTE: this issue exists because of an incomplete fix for CVE-2020-36767, which only considered single and double quote characters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/servo/servo/issues/25498#issuecomment-703527082 - https://sourceforge.net/p/tinyfiledialogs/code/ci/ac9f9f6d8cdf45ca8d9b4cf1f20
ervo/issues/25498#issuecomment-703527082 - https://sourceforge.net/p/tinyfiledialogs/code/ci/ac9f9f6d8cdf45ca8d9b4cf1f201ee472301e114/
CVE ID: CVE-2023-47105 State: PUBLISHED Published: 2024-09-18T00:00:00 Last Updated: 2024-09-18T18:18:37.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: exec.CommandContext in Chaosblade 0.3 through 1.7.3, when server mode is used, allows OS command execution via the cmd parameter without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/chaosblade-io/chaosblade/blob/0a07380c9899febb2b544132783b376b44226cca/exec/os/executor.go#L68 - https://narrow-oatmeal-0c0.notion.site/ChaosBlade-Remote-Command-Execution-CVE-2023-47105-4f5459046488436caaec2bced6ff26d7
CVE ID: CVE-2023-47106 State: PUBLISHED Published: 2023-12-04T20:26:36.710Z Last Updated: 2024-08-02T21:01:22.591Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: traefik Products: traefik Problem Types: CWE-20 Description: Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another frontend proxy like Nginx, it can be used to bypass frontend proxy URI-based access control re
is combined with another frontend proxy like Nginx, it can be used to bypass frontend proxy URI-based access control restrictions. This vulnerability has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/traefik/traefik/security/advisories/GHSA-fvhj-4qfh-q2hm - https://datatracker.ietf.org/doc/html/rfc7230#section-5.3.1 - https://github.com/traefik/traefik/releases/tag/v2.10.6 - https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5
CVE ID: CVE-2023-47107 State: PUBLISHED Published: 2023-11-08T15:39:50.472Z Last Updated: 2024-09-04T14:12:29.755Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: THM-Health Products: PILOS Problem Types: CWE-20, CWE-640 Description: PILOS is an open source front-end for BigBlueButton servers with a built-in load balancer. The password reset component deployed within PILOS uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to PILOS users when so that it points to the attackers server thereby disclosing the password reset token if/when the link is followed. This only affect
oints to the attackers server thereby disclosing the password reset token if/when the link is followed. This only affects local user accounts and requires the password reset option to be enabled. This issue has been patched in version 2.3.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/THM-Health/PILOS/security/advisories/GHSA-mc6f-fj9h-5735
CVE ID: CVE-2023-47108 State: PUBLISHED Published: 2023-11-10T18:31:33.730Z Last Updated: 2025-10-28T18:22:47.393Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: open-telemetry Products: opentelemetry-go-contrib Problem Types: CWE-770 Description: OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address
rver's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing `otelgrpc.WithMeterProvider` option with `noop.NewMeterProvider`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-8pgv-569h-w5rw - https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4322 - https://github.com/open
ies/GHSA-8pgv-569h-w5rw - https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4322 - https://github.com/open-telemetry/opentelemetry-go-contrib/commit/04c5dcbb5b35f14b4e6793b245919c72addbc7d0 - https://github.com/open-telemetry/opentelemetry-go-contrib/commit/b44dfc9092b157625a5815cb437583cee663333b - https://github.com/open-telemetry/opentelemetry-go-contrib/blob/9d4eb7e7706038b07d33f83f76afbe13f53d171d/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go#L327 - https://github.com/open-telemetry/opentelemetry-go-contrib/blob/instrumentation/google.golang.org/grpc/otelgrpc/v0.45.0/instrumentation/google.golang.org/grpc/otelgrpc/config.go#L138 - https://pkg.go.dev/go.ope
ang.org/grpc/otelgrpc/v0.45.0/instrumentation/google.golang.org/grpc/otelgrpc/config.go#L138 - https://pkg.go.dev/go.opentelemetry.io/otel/metric/noop#NewMeterProvider
CVE ID: CVE-2023-47109 State: PUBLISHED Published: 2023-11-08T21:37:53.660Z Last Updated: 2024-09-04T14:04:42.048Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H) Vendors: PrestaShop Products: blockreassurance Problem Types: CWE-285 Description: PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a block in blockreassurance module, a BO user can modify the http request and give the path of any file in the project instead of an image. When deleting the block from the BO, the file will be deleted. It is possible to make the website completely unavailable by removing
g the block from the BO, the file will be deleted. It is possible to make the website completely unavailable by removing index.php for example. This issue has been patched in version 5.1.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PrestaShop/blockreassurance/security/advisories/GHSA-83j2-qhx2-p7jc - https://github.com/PrestaShop/blockreassurance/commit/2d0e97bebf795690caffe33c1ab23a9bf43fcdfa - https://github.com/PrestaShop/blockreassurance/commit/eec00da564db4c1804b0a0d1e3d9f7ec4e27d823 - https://github.com/PrestaShop/blockreassurance/releases/tag/v5.1.4
CVE ID: CVE-2023-47110 State: PUBLISHED Published: 2023-11-09T15:24:15.247Z Last Updated: 2024-09-04T13:17:49.680Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H) Vendors: PrestaShop Products: blockreassurance Problem Types: CWE-284 Description: blockreassurance adds an information block aimed at offering helpful information to reassure customers that their store is trustworthy. An ajax function in module blockreassurance allows modifying any value in the configuration table. This vulnerability has been patched in version 5.1.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PrestaShop/blockreassurance/s
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PrestaShop/blockreassurance/security/advisories/GHSA-xfm3-hjcc-gv78