Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6106 State: REJECTED Published: N/A Last Updated: 2023-11-13T23:36:29.663Z Description: No description available.
CVE ID: CVE-2023-6107 State: REJECTED Published: N/A Last Updated: 2023-11-13T23:37:02.937Z Description: No description available.
CVE ID: CVE-2023-6109 State: PUBLISHED Published: 2023-11-14T06:39:41.417Z Last Updated: 2025-01-08T16:42:50.700Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: yourownprogrammer Products: YOP Poll Problem Types: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Description: The YOP Poll plugin for WordPress is vulnerable to a race condition in all versions up to, and including, 6.5.26. This is due to improper restrictions on the add() function. This makes it possible for unauthenticated attackers to place multiple votes on a single poll even when the poll is set to one vote per person. Additional Analyst No
tackers to place multiple votes on a single poll even when the poll is set to one vote per person. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/360b1927-a863-46be-ad11-3f6251c75a3c?source=cve - https://plugins.trac.wordpress.org/changeset/2959124/yop-poll/trunk/admin/models/votes.php
CVE ID: CVE-2023-6110 State: PUBLISHED Published: 2024-11-17T10:22:34.776Z Last Updated: 2024-12-05T20:30:27.043Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat OpenStack Platform 17.1 for RHEL 8, Red Hat OpenStack Platform 17.1 for RHEL 9, Red Hat OpenStack Platform 16.1, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.0, Red Hat OpenStack Platform 18.0 Problem Types: CWE-237 Description: A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials. Additional Analyst Notes: - CISA
other existing access rules which are not associated with any application credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:2737 - https://access.redhat.com/errata/RHSA-2024:2769 - https://access.redhat.com/security/cve/CVE-2023-6110 - https://bugzilla.redhat.com/show_bug.cgi?id=2212960 - https://code.engineering.redhat.com/gerrit/gitweb?p=python-openstackclient.git;a=commit;h=7a7c364bdd7b2cd2b56e73724110710a68d58abf - https://review.opendev.org/c/openstack/python-openstackclient/+/888697
CVE ID: CVE-2023-6111 State: PUBLISHED Published: 2023-11-14T14:05:35.216Z Last Updated: 2025-02-13T17:26:04.475Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Kernel Problem Types: CWE-416 Description: A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_trans_gc_catchall did not remove the catchall set element from the catchall_list when the argument sync is true, making it possible to free a catchall set element many times. We recommend upgrading past commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630. Additional Analyst Notes: - CVE Progra
mes. We recommend upgrading past commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93995bf4af2c5a99e2a87f0cd5ce547d31eb7630 - https://kernel.dance/93995bf4af2c5a99e2a87f0cd5ce547d31eb7630 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IG6IF3FUY7LVZJMFRPANAU4L4PSJ3ESQ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YQ7JVDEDZV5SNHG5EW7RHKK2ZN56HSGB/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3S55P23EYAW
K2ZN56HSGB/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3S55P23EYAWDHXZPJEVTGIRZZRICYI3Z/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OXWBKK7RTQOGGDLQGCZFS753VLGS2GD/
CVE ID: CVE-2023-6112 State: PUBLISHED Published: 2023-11-15T17:19:43.998Z Last Updated: 2025-02-13T17:26:05.052Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Navigation in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_14.html - https://crbug.com/1499298 - https://www.debian.org/security/2023/dsa-5556 - https://lists.fedoraproject.org/archives/list/package-annou
om/1499298 - https://www.debian.org/security/2023/dsa-5556 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWHRLW3GDNFBFSBHDD4QOPUPX7ORTUEC/ - https://security.gentoo.org/glsa/202311-11 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JHUI5HW7QXT3U74MJMTLUMF5REDO5HD5/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MN3JQGEC4EFQP3WTI33YBD3CLC3I7P4X/ - https://security.gentoo.org/glsa/202312-07 - http://packetstormsecurity.com/files/176721/Chrome-content-NavigationURLLoaderImpl-FallbackToNonInterceptedRequest-Heap-Use-After-Free.html - https://securi
/176721/Chrome-content-NavigationURLLoaderImpl-FallbackToNonInterceptedRequest-Heap-Use-After-Free.html - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-6113 State: PUBLISHED Published: 2024-01-01T14:18:58.931Z Last Updated: 2025-06-18T14:57:10.430Z Vendors: Unknown Products: WP STAGING WordPress Backup Plugin, WP STAGING Pro WordPress Backup Plugin Problem Types: CWE-200 Information Exposure Description: The WP STAGING WordPress Backup Plugin before 3.1.3 and WP STAGING Pro WordPress Backup Plugin before 5.1.3 do not prevent visitors from leaking key information about ongoing backups processes, allowing unauthenticated attackers to download said backups later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5a71049a-09a6-40ab-a4e8-44634869d4fb - http
ner: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5a71049a-09a6-40ab-a4e8-44634869d4fb - https://research.cleantalk.org/cve-2023-6113-wp-staging-unauth-sensitive-data-exposure-to-account-takeover-poc-exploit/
CVE ID: CVE-2023-6114 State: PUBLISHED Published: 2023-12-26T18:33:12.631Z Last Updated: 2024-08-02T08:21:17.333Z Vendors: Unknown Products: Duplicator, Duplicator Pro Problem Types: CWE-200 Information Exposure Description: The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files containing sensitive data. When directory listing is enabled in the web server, this allows unauthenticated attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the
ted attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the site. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5c5d41b9-1463-4a9b-862f-e9ee600ef8e1 - https://drive.google.com/file/d/1mpapFCqfZLv__EAM7uivrrl2h55rpi1V/view?usp=sharing
CVE ID: CVE-2023-6115 State: REJECTED Published: N/A Last Updated: 2023-11-13T23:29:48.822Z Description: No description available.
CVE ID: CVE-2023-6116 State: PUBLISHED Published: 2024-04-26T07:23:18.351Z Last Updated: 2024-08-02T08:21:17.445Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H) Vendors: Hanwha Vision Co., Ltd. Products: XRN-420S Problem Types: CWE-121 Description: Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the camera. An attacker could inject malicious into http request packets to execute arbitrary code. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www
s and workarounds. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hanwhavision.com/wp-content/uploads/2024/04/NVR-DVR-Vulnerability-Report-CVE-2023-6116.pdf
CVE ID: CVE-2023-6117 State: PUBLISHED Published: 2023-11-22T09:56:32.749Z Last Updated: 2024-08-28T08:20:42.805Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: M-Files Products: M-Files Server Problem Types: CWE-770 Description: A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API methods of the M-Files server before 23.11.13156.0 which allows attackers to execute DoS attacks. Additional Analyst Notes: - CVE Program Container: References: - https://product.m-files.com/security-advisories/cve-2023-6117/
CVE ID: CVE-2023-6118 State: PUBLISHED Published: 2023-11-23T14:24:24.001Z Last Updated: 2024-12-02T19:38:10.447Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Neutron Products: IP Camera Problem Types: CWE-25 Description: Path Traversal: '/../filedir' vulnerability in Neutron IP Camera allows Absolute Path Traversal.This issue affects IP Camera: before b1130.1.0.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0658
CVE ID: CVE-2023-6119 State: PUBLISHED Published: 2023-11-16T09:39:30.357Z Last Updated: 2024-08-02T08:21:17.404Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Trellix Products: GetSusp Problem Types: CWE-269 Description: An Improper Privilege Management vulnerability in Trellix GetSusp prior to version 5.0.0.27 allows a local, low privilege attacker to gain access to files that usually require a higher privilege level. This is caused by GetSusp not correctly protecting a directory that it creates during execution, allowing an attacker to take over file handles used by GetSusp. As this runs with high privileges, the attacker gains elevated permissions. The
take over file handles used by GetSusp. As this runs with high privileges, the attacker gains elevated permissions. The file handles are opened as read-only. Additional Analyst Notes: - CVE Program Container: References: - https://kcm.trellix.com/corporate/index?page=content&id=SB10412
CVE ID: CVE-2023-6120 State: PUBLISHED Published: 2023-12-09T06:52:00.170Z Last Updated: 2024-10-09T14:38:05.195Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N) Vendors: uscnanbu Products: Welcart e-Commerce Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Welcart e-Commerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.6 via the upload_certificate_file function. This makes it possible for administrators to upload .pem or .crt files to arbitrary locations on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
files to arbitrary locations on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2677cea6-d60d-4e10-afd7-e088a5592b19?source=cve - https://plugins.trac.wordpress.org/changeset/2992785/usc-e-shop/trunk/classes/paymentPaygent.class.php?contextall=1&old=2880236&old_path=%2Fusc-e-shop%2Ftrunk%2Fclasses%2FpaymentPaygent.class.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2999846%40usc-e-shop%2Ftrunk&old=2996147%40usc-e-shop%2Ftrunk&sfp_email=&sfph_mail=#file1
CVE ID: CVE-2023-6121 State: PUBLISHED Published: 2023-11-16T14:45:38.430Z Last Updated: 2025-11-06T20:01:43.127Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-125 Description: An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg). Additional Analyst Notes: - CISA
n kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:2394 - https://access.redhat.com/errata/RHSA-2024:2950 - https://access.redhat.com/errata/RHSA-2024:3138 - https://access.redhat.com/security/cve/CVE-2023-6121 - https://bugzilla.redhat.com/show_bug.cgi?id=2250043
CVE ID: CVE-2023-6122 State: PUBLISHED Published: 2023-12-21T13:53:57.101Z Last Updated: 2024-08-02T08:21:17.248Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: İstanbul Soft Informatics and Consultancy Limited Company Products: Softomi Gelişmiş C2C Pazaryeri Yazılımı Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in İstanbul Soft Informatics and Consultancy Limited Company Softomi Gelişmiş C2C Pazaryeri Yazılımı allows Reflected XSS.This issue affects Softomi Gelişmiş C2C Pazaryeri Yazılımı: before 12122023. Additional Analyst Notes: - CVE Program Container: References:
oftomi Gelişmiş C2C Pazaryeri Yazılımı: before 12122023. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-23-0724
CVE ID: CVE-2023-6123 State: PUBLISHED Published: 2024-02-15T21:04:29.089Z Last Updated: 2025-03-18T14:32:42.295Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OpenText Products: ALM Octane. Problem Types: Improper Neutralization Description: Improper Neutralization vulnerability affects OpenText ALM Octane version 16.2.100 and above. The vulnerability could result in a remote code execution attack. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://portal.microfocus.com/s/article/KM000026128?language=en_US
CVE ID: CVE-2023-6124 State: PUBLISHED Published: 2023-11-14T14:52:40.534Z Last Updated: 2024-09-03T15:02:37.650Z Severity: MEDIUM (CVSS 5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: salesagility Products: salesagility/suitecrm Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in GitHub repository salesagility/suitecrm prior to 7.14.2, 8.4.2, 7.12.14. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/aed4d8f3-ab9a-42fd-afea-b3ec288a148e - https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9
CVE ID: CVE-2023-6125 State: PUBLISHED Published: 2023-11-14T15:30:05.149Z Last Updated: 2025-01-08T16:16:30.749Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: salesagility Products: salesagility/suitecrm Problem Types: CWE-94 Description: Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/a9462f1e-9746-4380-8228-533ff2f64691 - https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9
CVE ID: CVE-2023-6126 State: PUBLISHED Published: 2023-11-14T15:51:44.501Z Last Updated: 2025-01-08T16:15:49.313Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: salesagility Products: salesagility/suitecrm Problem Types: CWE-94 Description: Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/e22a9be3-3273-42cb-bfcc-c67a1025684e - https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9
CVE ID: CVE-2023-6127 State: PUBLISHED Published: 2023-11-14T16:01:57.316Z Last Updated: 2024-08-30T19:22:19.569Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: salesagility Products: salesagility/suitecrm Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/bf10c72b-5d2e-4c9a-9bd6-d77bdf31027d - https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9
CVE ID: CVE-2023-6128 State: PUBLISHED Published: 2023-11-14T16:11:04.630Z Last Updated: 2025-01-08T16:15:02.112Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: salesagility Products: salesagility/suitecrm Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/51406547-1961-45f2-a416-7f14fd775d2d - https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9
CVE ID: CVE-2023-6129 State: PUBLISHED Published: 2024-01-09T16:36:58.860Z Last Updated: 2025-06-20T15:28:07.908Z Vendors: OpenSSL Products: OpenSSL Problem Types: CWE-440 Description: Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL for PowerPC CPUs restores the content
equences. The POLY1305 MAC (message authentication code) implementation in OpenSSL for PowerPC CPUs restores the contents of vector registers in a different order than they are saved. Thus the contents of some of these vector registers are corrupted when returning to the caller. The vulnerable code is used only on newer PowerPC processors supporting the PowerISA 2.07 instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However
rs at all, to the worst consequences, where the attacker could get complete control of the application process. However unless the compiler uses the vector registers for storing pointers, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3. If this cipher is enabled on the server a malicious client can influence whether this AEAD cipher is used. This implies that TL
cipher is enabled on the server a malicious client can influence whether this AEAD cipher is used. This implies that TLS server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20240109.txt - https://github.com/openssl/openssl/commit/5b139f95c9a47a55a0c54100f3837b1eee942b04 - https://github.com/openssl/openssl/commit/f3fc5808fe9ff74042d639839610d03b8fdcc015 - https://github.com/openssl/openssl/commit/050d
hub.com/openssl/openssl/commit/f3fc5808fe9ff74042d639839610d03b8fdcc015 - https://github.com/openssl/openssl/commit/050d26383d4e264966fb83428e72d5d48f402d35
CVE ID: CVE-2023-6130 State: PUBLISHED Published: 2023-11-14T16:19:29.202Z Last Updated: 2024-08-30T18:34:42.366Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: salesagility Products: salesagility/suitecrm Problem Types: CWE-29 Description: Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/22a27be9-f016-4daf-9887-c77eb3e1dc74 - https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9
CVE ID: CVE-2023-6131 State: PUBLISHED Published: 2023-11-14T16:27:57.047Z Last Updated: 2024-08-30T18:31:54.604Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: salesagility Products: salesagility/suitecrm Problem Types: CWE-94 Description: Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/5fa50b25-f6b1-408c-99df-4442c86c563f - https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9
CVE ID: CVE-2023-6132 State: PUBLISHED Published: 2024-02-29T17:40:05.162Z Last Updated: 2024-08-22T18:02:51.796Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: AVEVA Products: AVEVA Edge Problem Types: CWE-427 Description: The vulnerability, if exploited, could allow a malicious entity with access to the file system to achieve arbitrary code execution and privilege escalation by tricking AVEVA Edge to load an unsafe DLL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-032-03 - https://www.aveva.com/en/support-and-success/cyber-security-updates/
CVE ID: CVE-2023-6133 State: PUBLISHED Published: 2023-11-15T06:40:46.339Z Last Updated: 2024-08-02T08:21:17.396Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: wpmudev Products: Forminator – Contact Form, Payment Form & Custom Form Builder Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_allowed_mime_types' function in versions up to, and including, 1.27.0. This makes it possible for authenticated attackers with administrator-level capabilities or above to upload arbitrary files on the affected s
e for authenticated attackers with administrator-level capabilities or above to upload arbitrary files on the affected site's server, but due to the htaccess configuration, remote code cannot be executed. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/13cfa202-ab90-46c0-ab53-00995bfdcaa3?source=cve - https://plugins.trac.wordpress.org/browser/forminator/tags/1.27.0/library/fields/upload.php#L356 - https://plugins.trac.wordpress.org/browser/forminator/tags/1.27.0/library/fields/upload.php#L372 - https://plugins.trac.wordpress.org/changeset/2995007/forminator/trunk/library/helpers/helper-fields.php#file0