Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-5998 State: PUBLISHED Published: 2023-11-07T18:45:03.305Z Last Updated: 2024-09-04T15:21:07.265Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: gpac Products: gpac/gpac Problem Types: CWE-125 Description: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3.0-DEV. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/ea02a231-b688-422b-a881-ef415bcf6113 - https://github.com/gpac/gpac/commit/db74835944548fc3bdf03121b0e012373bdebb3e
CVE ID: CVE-2023-5999 State: REJECTED Published: N/A Last Updated: 2023-11-13T20:27:00.000Z Description: No description available.
CVE ID: CVE-2023-6000 State: PUBLISHED Published: 2024-01-01T14:18:56.633Z Last Updated: 2025-06-18T14:55:45.937Z Vendors: Unknown Products: Popup Builder Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/cdb3a8bd-4ee0-4ce0-9029-0490273bcfc8 - https://wpscan.com/blog/stored-xss-fixed-in-popup-builder-4-2-3/
CVE ID: CVE-2023-6001 State: PUBLISHED Published: 2023-11-07T23:25:16.135Z Last Updated: 2024-09-17T13:03:52.610Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: YugabyteDB Products: YugabyteDB Anywhere Problem Types: CWE-200 Description: Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.yugabyte.com/
CVE ID: CVE-2023-6002 State: PUBLISHED Published: 2023-11-07T23:56:50.729Z Last Updated: 2024-09-17T13:03:18.141Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: YugabyteDB Products: YugabyteDB Problem Types: CWE-117 Description: YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.yugabyte.com/
CVE ID: CVE-2023-6004 State: PUBLISHED Published: 2024-01-03T17:01:38.672Z Last Updated: 2025-11-07T00:19:08.335Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 7 Problem Types: CWE-74 Description: A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
the hostname parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:2504 - https://access.redhat.com/errata/RHSA-2024:3233 - https://access.redhat.com/security/cve/CVE-2023-6004 - https://bugzilla.redhat.com/show_bug.cgi?id=2251110 - https://www.libssh.org/security/advisories/CVE-2023-6004.txt
CVE ID: CVE-2023-6005 State: PUBLISHED Published: 2024-01-16T15:57:01.802Z Last Updated: 2025-06-20T17:21:14.381Z Vendors: Unknown Products: EventON Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fa4eea26-0611-4fa8-a947-f78ddf46a56a/
CVE ID: CVE-2023-6006 State: PUBLISHED Published: 2023-11-14T04:04:03.280Z Last Updated: 2025-01-08T16:44:47.456Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PaperCut Products: PaperCut NG, PaperCut MF Problem Types: CWE-250 Description: This vulnerability potentially allows local attackers to escalate privileges on affected installations of PaperCut NG. An attacker must have local write access to the C Drive. In addition, Print Archiving must be enabled or the attacker needs to encounter a misconfigured system. This vulnerability does not apply to PaperCut NG installs that have Print Archiving enabled and configured as per the recommended set up procedure
t apply to PaperCut NG installs that have Print Archiving enabled and configured as per the recommended set up procedure. This specific flaw exists within the pc-pdl-to-image process. The process loads an executable from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM Note: This CVE has been rescored with a "Privileges Required (PR)" rating of low, and “Attack Complexity (AC)” rating of low, reflecting the worst-case scenario where an Administrator has granted local login access to standard network users on the host server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
standard network users on the host server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.papercut.com/kb/Main/Security-Bulletin-November-2023/
CVE ID: CVE-2023-6007 State: PUBLISHED Published: 2023-11-22T15:33:25.681Z Last Updated: 2024-08-02T08:14:25.142Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: UserPro - Community and User Profile WordPress Plugin Problem Types: CWE-862 Missing Authorization Description: The UserPro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.1.1. This makes it possible for unauthenticated attackers to add, modify, or delete user meta and plugin options. Additional Analyst Notes: - CVE Program Container: Refer
tackers to add, modify, or delete user meta and plugin options. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6c4f8798-c0f9-4d05-808e-375864a0ad95?source=cve - https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681
CVE ID: CVE-2023-6008 State: PUBLISHED Published: 2023-11-22T15:33:38.202Z Last Updated: 2024-08-02T08:14:25.134Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: n/a Products: UserPro - Community and User Profile WordPress Plugin Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to add, modify, or delete user meta and plugin options. Additional Analyst Notes: - CVE Program Container: References:
to add, modify, or delete user meta and plugin options. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ed6e2b9e-3d70-4c07-a779-45164816b89c?source=cve - https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681
CVE ID: CVE-2023-6009 State: PUBLISHED Published: 2023-11-22T15:33:37.741Z Last Updated: 2025-06-10T13:29:30.208Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: UserPro - Community and User Profile WordPress Plugin Problem Types: CWE-266 Incorrect Privilege Assignment Description: The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restriction on the 'userpro_update_user_profile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a pr
mal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e8bed9c0-dae3-405e-a946-5f28a3c30851?source=cve - https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681 - http://packetstormsecurity.com/files/175871/WordPress-UserPro-5.1.x-Password-Reset-Authentication-Bypass-Escalation.html
CVE ID: CVE-2023-6010 State: REJECTED Published: N/A Last Updated: 2023-11-13T23:40:24.212Z Description: No description available.
CVE ID: CVE-2023-6011 State: PUBLISHED Published: 2023-11-22T09:06:44.398Z Last Updated: 2025-06-10T13:38:40.893Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: DECE Software Products: Geodi Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DECE Software Geodi allows Stored XSS.This issue affects Geodi: before 8.0.0.27396. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0650
CVE ID: CVE-2023-6012 State: PUBLISHED Published: 2023-11-08T10:36:42.719Z Last Updated: 2024-09-17T13:01:40.923Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Lanaccess Products: ONSAFE MonitorHM Problem Types: CWE-20 Description: An improper input validation vulnerability has been found in Lanaccess ONSAFE MonitorHM affecting version 3.7.0. This vulnerability could lead a remote attacker to exploit the checkbox element and perform remote code execution, compromising the entire infrastructure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-input-data-vali
ner: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-input-data-validation-lanaccess-onsafe-monitorhm-web-console
CVE ID: CVE-2023-6013 State: PUBLISHED Published: 2023-11-16T16:07:17.441Z Last Updated: 2024-11-27T17:07:42.783Z Severity: CRITICAL (CVSS 9.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: h2oai Products: h2oai/h2o-3 Problem Types: CWE-79 Description: H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/9881569f-dc2a-437e-86b0-20d4b70ae7af
CVE ID: CVE-2023-6014 State: PUBLISHED Published: 2023-11-16T21:07:36.577Z Last Updated: 2024-09-04T20:22:09.674Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: mlflow Products: mlflow/mlflow Problem Types: CWE-598 Description: An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/3e64df69-ddc2-463e-9809-d07c24dc1de4
CVE ID: CVE-2023-6015 State: PUBLISHED Published: 2023-11-16T16:06:11.032Z Last Updated: 2024-08-02T08:21:17.131Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: mlflow Products: mlflow/mlflow Problem Types: CWE-22 Description: MLflow allowed arbitrary files to be PUT onto the server. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/43e6fb72-676e-4670-a225-15d6836f65d3
CVE ID: CVE-2023-6016 State: PUBLISHED Published: 2023-11-16T16:06:24.520Z Last Updated: 2024-08-02T08:21:17.117Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: h2oai Products: h2oai/h2o-3 Problem Types: CWE-94 Description: An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/83dd17ec-053e-453c-befb-7d6736bf1836
CVE ID: CVE-2023-6017 State: PUBLISHED Published: 2023-11-16T16:07:01.811Z Last Updated: 2024-08-02T08:21:17.158Z Severity: HIGH (CVSS 8.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: h2oai Products: h2oai/h2o-3 Problem Types: CWE-840 Description: H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/6a69952f-a1ba-4dee-9d8c-e87f52508b58
CVE ID: CVE-2023-6018 State: PUBLISHED Published: 2023-11-16T16:05:14.579Z Last Updated: 2024-08-02T08:21:17.069Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: mlflow Products: mlflow/mlflow Problem Types: CWE-78 Description: An attacker can overwrite any file on the server hosting MLflow without any authentication. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/7cf918b5-43f4-48c0-a371-4d963ce69b30
CVE ID: CVE-2023-6019 State: PUBLISHED Published: 2023-11-16T16:12:07.652Z Last Updated: 2024-08-02T08:21:17.025Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ray-project Products: ray-project/ray Problem Types: CWE-78 Description: A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023 Additional Analyst Notes: - CVE Program Contain
-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023 Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/d0290f3c-b302-4161-89f2-c13bb28b4cfe
CVE ID: CVE-2023-6020 State: PUBLISHED Published: 2023-11-16T21:07:33.774Z Last Updated: 2024-08-02T08:21:17.152Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ray-project Products: ray-project/ray Problem Types: CWE-862 Description: LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/83dd8619-6dc3-4c98-8f1b-e620fedcd1f6
CVE ID: CVE-2023-6021 State: PUBLISHED Published: 2023-11-16T16:11:42.969Z Last Updated: 2024-11-27T17:07:03.555Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ray-project Products: ray-project/ray Problem Types: CWE-29 Description: LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/5039c045-f
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/5039c045-f986-4cbc-81ac-370fe4b0d3f8
CVE ID: CVE-2023-6022 State: PUBLISHED Published: 2023-11-16T16:07:33.744Z Last Updated: 2024-08-02T08:21:17.081Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: prefecthq Products: prefecthq/prefect Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository prefecthq/prefect prior to 2.16.5. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/dab47d99-551c-4355-9ab1-c99cb90235af - https://github.com/prefecthq/prefect/commit/227dfcc7e3374c212a4bcd68b14e090b1c02d9d3
CVE ID: CVE-2023-6023 State: PUBLISHED Published: 2023-11-16T16:03:08.827Z Last Updated: 2024-08-02T08:21:17.027Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: vertaai Products: vertaai/modeldb Problem Types: CWE-29 Description: An attacker can read any file on the filesystem on the server hosting ModelDB through an LFI in the artifact_path URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/644ab868-db6d-4685-ab35-1a897632d2ca
CVE ID: CVE-2023-6026 State: PUBLISHED Published: 2023-11-30T13:37:23.292Z Last Updated: 2024-08-02T08:21:17.179Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PHPMemcachedAdmin Products: PHPMemcachedAdmin Problem Types: CWE-22 Description: A Path traversal vulnerability has been reported in elijaa/phpmemcachedadmin affecting version 1.3.0. This vulnerability allows an attacker to delete files stored on the server due to lack of proper verification of user-supplied input. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpmemcachedadmin
CVE ID: CVE-2023-6027 State: PUBLISHED Published: 2023-11-30T13:38:43.344Z Last Updated: 2024-08-02T08:21:17.157Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: PHPMemcachedAdmin Products: PHPMemcachedAdmin Problem Types: CWE-79 Description: A critical flaw has been identified in elijaa/phpmemcachedadmin affecting version 1.3.0, specifically related to a stored XSS vulnerability. This vulnerability allows malicious actors to insert a carefully crafted JavaScript payload. The issue arises from improper encoding of user-controlled entries in the "/pmcadmin/configure.php" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.i
the "/pmcadmin/configure.php" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpmemcachedadmin
CVE ID: CVE-2023-6028 State: PUBLISHED Published: 2024-02-05T17:33:34.785Z Last Updated: 2024-08-02T08:21:17.060Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: B&R Industrial Automation Products: Automation Runtime Problem Types: CWE-79 Description: A reflected cross-site scripting (XSS) vulnerability exists in the SVG version of System Diagnostics Manager of B&R Automation Runtime versions <= G4.93 that enables a remote attacker to execute arbitrary JavaScript code in the context of the attacked user’s browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.br-automation.com/fileadmin/SA23P018
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.br-automation.com/fileadmin/SA23P018_SDM_Web_interface_vulnerable_to_XSS-1d75bee8.pdf
CVE ID: CVE-2023-6029 State: PUBLISHED Published: 2024-01-15T15:10:39.546Z Last Updated: 2025-06-11T16:36:14.297Z Vendors: Unknown Products: EazyDocs Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The EazyDocs WordPress plugin before 2.3.6 does not have authorization and CSRF checks when handling documents and does not ensure that they are documents from the plugin, allowing unauthenticated users to delete arbitrary posts, as well as add and delete documents/sections. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7a0aaf85-8130-4fd7-8f09-f8edc929597e
CVE ID: CVE-2023-6030 State: PUBLISHED Published: 2025-05-15T20:09:05.301Z Last Updated: 2025-05-16T18:30:18.530Z Vendors: Unknown Products: LogDash Activity Log Problem Types: CWE-89 SQL Injection Description: The LogDash Activity Log WordPress plugin before 1.1.4 hooks the wp_login_failed function (from src/Hooks/Users.php) in order to log failed login attempts to the database but it doesn't escape the username when it perform some SQL request leading to a SQL injection vulnerability which can be exploited using time-based technique by unauthenticated attacker Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b658e403-006c-4555-b1b2-3603e44f4
Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b658e403-006c-4555-b1b2-3603e44f4411/
CVE ID: CVE-2023-6032 State: PUBLISHED Published: 2023-11-15T03:54:35.655Z Last Updated: 2024-08-02T08:21:17.146Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Schneider Electric Products: Galaxy VS, Galaxy VL Problem Types: CWE-22 Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause a file system enumeration and file download when an attacker navigates to the Network Management Card via HTTPS. Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-318-03&p_enDocType=Security+and+Safety+Notice&p_
es: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-318-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-318-03.pdf
CVE ID: CVE-2023-6033 State: PUBLISHED Published: 2023-12-01T07:01:38.124Z Last Updated: 2025-11-20T04:11:08.273Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-79 Description: Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/431201 - https://hackerone.com/reports/2236039
CVE ID: CVE-2023-6034 State: REJECTED Published: N/A Last Updated: 2023-11-13T23:39:52.077Z Description: No description available.
CVE ID: CVE-2023-6035 State: PUBLISHED Published: 2023-12-11T19:22:37.842Z Last Updated: 2024-08-02T08:21:17.100Z Vendors: Unknown Products: EazyDocs Problem Types: CWE-89 SQL Injection Description: The EazyDocs WordPress plugin before 2.3.4 does not properly sanitize and escape "data" parameter before using it in an SQL statement via an AJAX action, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/44f5a29a-05f9-40d2-80f2-6fb2bda60d79
CVE ID: CVE-2023-6036 State: PUBLISHED Published: 2024-02-12T16:06:00.820Z Last Updated: 2025-05-06T18:50:16.358Z Vendors: Unknown Products: Web3 Problem Types: CWE-287 Improper Authentication Description: The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handle_auth_request' and 'hadle_login_request'. This makes it possible for non authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7f30ab2
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7f30ab20-805b-422c-a9a5-21d39c570ee4/