Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-24997 State: PUBLISHED Published: 2023-02-01T14:49:44.930Z Last Updated: 2025-03-26T14:33:30.143Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick https://github.com/apache/inlong/pull/7223 https://github.com/apache/inlong/pull/7223 to solve it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/nxvtxq7oxhwyzo9ty2hqz8rvh5r7ngd8
CVE ID: CVE-2023-24998 State: PUBLISHED Published: 2023-02-20T15:57:07.372Z Last Updated: 2025-11-03T21:47:24.224Z Vendors: Apache Software Foundation Products: Apache Commons FileUpload, Apache Tomcat Problem Types: CWE-770 Description: Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org
must be explicitly configured. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoy - http://www.openwall.com/lists/oss-security/2023/05/22/1 - https://security.gentoo.org/glsa/202305-37 - https://www.debian.org/security/2023/dsa-5522 - https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html
CVE ID: CVE-2023-24999 State: PUBLISHED Published: 2023-03-10T23:12:47.638Z Last Updated: 2025-03-03T20:46:23.638Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: HashiCorp Products: Vault, Vault Enterprise Problem Types: CWE-863 Description: HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-20
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2023-07-vault-fails-to-verify-if-approle-secretid-belongs-to-role-during-a-destroy-operation/51305 - https://security.netapp.com/advisory/ntap-20230505-0001/
CVE ID: CVE-2023-25000 State: PUBLISHED Published: 2023-03-30T00:17:46.230Z Last Updated: 2025-02-13T16:44:28.625Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: HashiCorp Products: Vault, Vault Enterprise Problem Types: CWE-208 Description: HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9. Additional Analyst Notes: - CVE Progra
e effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2023-10-vault-vulnerable-to-cache-timing-attacks-during-seal-and-unseal-operations/52078 - https://security.netapp.com/advisory/ntap-20230526-0008/
CVE ID: CVE-2023-25001 State: PUBLISHED Published: 2023-06-27T00:00:00 Last Updated: 2024-12-05T14:15:39.218Z Vendors: n/a Products: Navisworks Problem Types: Use-after-free vulnerability Description: A maliciously crafted SKP file in Autodesk Navisworks 2023 and 2022 be used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0002
CVE ID: CVE-2023-25002 State: PUBLISHED Published: 2023-06-27T00:00:00 Last Updated: 2024-12-05T14:39:41.206Z Vendors: n/a Products: Multiple Problem Types: Use-after-free vulnerability Description: A maliciously crafted SKP file in Autodesk products is used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0002
CVE ID: CVE-2023-25003 State: PUBLISHED Published: 2023-06-23T00:00:00 Last Updated: 2024-12-05T17:10:10.146Z Vendors: n/a Products: AutoCAD, Maya Problem Types: out-of-bound read write / read Description: A maliciously crafted pskernel.dll file in Autodesk AutoCAD 2023 and Maya 2022 may be used to trigger out-of-bound read write / read vulnerabilities. Exploitation of this vulnerability may lead to code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0009
CVE ID: CVE-2023-25004 State: PUBLISHED Published: 2023-06-27T00:00:00 Last Updated: 2024-12-05T14:40:18.983Z Vendors: n/a Products: Autodesk products Problem Types: Integer Overflow Description: A maliciously crafted pskernel.dll file in Autodesk products is used to trigger integer overflow vulnerabilities. Exploitation of these vulnerabilities may lead to code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0009
CVE ID: CVE-2023-25005 State: PUBLISHED Published: 2023-05-12T00:00:00.000Z Last Updated: 2025-01-27T17:43:10.771Z Vendors: n/a Products: Autodesk InfraWorks Problem Types: Resource Injection Description: A maliciously crafted DLL file can be forced to read beyond allocated boundaries in Autodesk InfraWorks 2023, and 2021 when parsing the DLL files could lead to a resource injection vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0006
CVE ID: CVE-2023-25006 State: PUBLISHED Published: 2023-05-12T00:00:00.000Z Last Updated: 2025-01-24T19:58:11.319Z Vendors: n/a Products: Autodesk 3ds Max USD Plugin Problem Types: Use-After-Free Description: A malicious actor may convince a user to open a malicious USD file that may trigger a use-after-free vulnerability which could result in code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0008
CVE ID: CVE-2023-25007 State: PUBLISHED Published: 2023-05-12T00:00:00.000Z Last Updated: 2025-01-24T19:57:19.910Z Vendors: n/a Products: Autodesk 3ds Max USD Plugin Problem Types: Uninitialized Pointer Description: A malicious actor may convince a user to open a malicious USD file that may trigger an uninitialized pointer which could result in code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0008
CVE ID: CVE-2023-25008 State: PUBLISHED Published: 2023-05-12T00:00:00.000Z Last Updated: 2025-01-24T19:56:19.365Z Vendors: n/a Products: Autodesk 3ds Max USD Plugin Problem Types: Out-of-bound Read Description: A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds read vulnerability which could result in code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0008
CVE ID: CVE-2023-25009 State: PUBLISHED Published: 2023-05-12T00:00:00.000Z Last Updated: 2025-01-24T19:55:30.927Z Vendors: n/a Products: Autodesk 3ds Max USD Plugin Problem Types: Out-of-bound Write Description: A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds write vulnerability which could result in code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0008
CVE ID: CVE-2023-25010 State: PUBLISHED Published: 2023-04-17T00:00:00.000Z Last Updated: 2025-02-06T15:27:25.812Z Vendors: n/a Products: Autodesk Maya USD Plugin Problem Types: Uninitialized Variable Description: A malicious actor may convince a victim to open a malicious USD file that may trigger an uninitialized variable which may result in code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0003
CVE ID: CVE-2023-25011 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-03-19T15:47:33.268Z Vendors: NEC Corporation Products: PC settings tool Problem Types: Missing Authentication for Critical Function Description: PC settings tool Ver10.1.26.0 and earlier, PC settings tool Ver11.0.22.0 and earlier allows a attacker to write to the registry as administrator privileges with standard user privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jpn.nec.com/security-info/secinfo/nv23-001_en.html
CVE ID: CVE-2023-25012 State: PUBLISHED Published: 2023-02-01T00:00:00.000Z Last Updated: 2025-05-05T16:05:05.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED controllers remain registered for too long. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/oss-sec/2023/q1/53 - https://lore.kernel.org/all/20230125-hid-unregister-leds-v1-1-9a5192dcef16%40diag.uniroma1.it/ - http://www.openwall.com/lists/oss-security/2023/02/02/1 - https://lists.debian.org/debian-lts-announce/2023/05/ms
.it/ - http://www.openwall.com/lists/oss-security/2023/02/02/1 - https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html - http://www.openwall.com/lists/oss-security/2023/11/05/1 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=76ca8da989c7d97a7f76c75d475fe95a584439d7 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=27d2a2fd844ec7da70d19fabb482304fd1e0595b - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9fefb6201c4f8dd9f58c581b2a66e5cde2895ea2 - https://bugzilla.suse.com/show_bug.cgi?id=1207560
CVE ID: CVE-2023-25013 State: PUBLISHED Published: 2023-02-02T00:00:00.000Z Last Updated: 2025-03-26T17:41:06.402Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AC:L/AV:N/A:L/C:L/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to set the password of all frontend users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://typo3.org/help/security-advisories - https://typo3.org/security/advisory/typo3-ext-sa-2023-001
CVE ID: CVE-2023-25014 State: PUBLISHED Published: 2023-02-02T00:00:00.000Z Last Updated: 2025-03-26T17:37:06.843Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AC:L/AV:N/A:L/C:L/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to delete all frontend users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://typo3.org/help/security-advisories - https://typo3.org/security/advisory/typo3-ext-sa-2023-001
CVE ID: CVE-2023-25015 State: PUBLISHED Published: 2023-02-02T00:00:00.000Z Last Updated: 2025-03-26T17:35:33.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ankane/clockwork_web/issues/4 - https://github.com/ankane/clockwork_web/compare/v0.1.1...v0.1.2 - https://github.com/ankane/clockwork_web/commit/ec2896503ee231588547c2fad4cb93a94e78f857
CVE ID: CVE-2023-25016 State: PUBLISHED Published: 2023-02-06T00:00:00.000Z Last Updated: 2025-03-25T18:23:32.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.couchbase.com/tags/security - https://docs.couchbase.com/server/current/release-notes/relnotes.html - https://www.couchbase.com/alerts/
CVE ID: CVE-2023-25017 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T15:52:52.829Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Rifartek Products: IOT Wall Problem Types: CWE-863 Description: RIFARTEK IOT Wall has a vulnerability of incorrect authorization. An authenticated remote attacker with general user privilege is allowed to perform specific privileged function to access and modify all sensitive data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6962-34ac1-1.html
CVE ID: CVE-2023-25018 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T15:51:13.502Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Rifartek Products: IOT Wall Problem Types: CWE-79 Description: RIFARTEK IOT Wall transportation function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can inject JavaScript to perform reflected XSS (Reflected Cross-site scripting) attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6963-7d2ee-1.html
CVE ID: CVE-2023-25019 State: PUBLISHED Published: 2023-08-30T11:51:48.807Z Last Updated: 2024-09-24T19:23:44.121Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Premio Products: Chaty Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Premio Chaty plugin <= 3.0.9 versions Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/chaty/wordpress-chaty-plugin-3-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-25020 State: PUBLISHED Published: 2023-04-07T11:08:01.901Z Last Updated: 2025-01-10T18:58:53.177Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Kiboko Labs Products: Arigato Autoresponder and Newsletter Problem Types: CWE-79 Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/bft-autoresponder/wordpress-arigato-autoresponder-and-newsletter-plugin-2-7-1-1-cross-site-scripting-xss-2?_s_id=cve
CVE ID: CVE-2023-25021 State: PUBLISHED Published: 2023-05-08T11:48:22.317Z Last Updated: 2025-02-19T21:31:44.205Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: FareHarbor Products: FareHarbor for WordPress Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in FareHarbor FareHarbor for WordPress plugin <= 3.6.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/fareharbor/wordpress-fareharbor-for-wordpress-plugin-3-6-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-25022 State: PUBLISHED Published: 2023-04-07T10:40:07.890Z Last Updated: 2025-01-10T19:00:57.630Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Kiboko Labs Products: Watu Quiz Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Watu Quiz plugin <= 3.3.8 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/watu/wordpress-watu-quiz-plugin-3-3-8-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-25023 State: PUBLISHED Published: 2023-04-07T10:36:41.065Z Last Updated: 2025-01-10T19:02:59.833Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Saleswonder.biz Products: Webinar ignition Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saleswonder.Biz Webinar ignition plugin <= 2.14.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/webinar-ignition/wordpress-webinarignition-plugin-2-14-2-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-25024 State: PUBLISHED Published: 2023-04-07T10:51:04.822Z Last Updated: 2025-01-10T18:59:22.389Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Icegram Products: Icegram Collect Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Icegram Icegram Collect plugin <= 1.3.8 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/icegram-rainmaker/wordpress-icegram-collect-easy-form-lead-collection-and-subscription-plugin-plugin-1-3-8-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-25025 State: PUBLISHED Published: 2023-10-04T13:24:21.886Z Last Updated: 2024-08-02T14:49:00.235Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Chetan Gole Products: WP-CopyProtect [Protect your blog posts] Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole WP-CopyProtect [Protect your blog posts] plugin <= 3.1.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-copyprotect/wordpress-wp-copyprotect-protect-your-blog-posts-plugin-3-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-25026 State: PUBLISHED Published: 2024-12-09T11:31:39.295Z Last Updated: 2024-12-09T18:42:25.632Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: PayPal Products: PayPal Brasil para WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in PayPal PayPal Brasil para WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayPal Brasil para WooCommerce: from n/a through 1.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/paypal-brasil-para-woocommerce/vulnerability/wordpress-paypal-brasil-para-woocomm
tchstack.com/database/wordpress/plugin/paypal-brasil-para-woocommerce/vulnerability/wordpress-paypal-brasil-para-woocommerce-plugin-1-4-2-broken-access-control?_s_id=cve
CVE ID: CVE-2023-25027 State: PUBLISHED Published: 2023-04-07T10:46:24.610Z Last Updated: 2025-01-10T19:00:40.030Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Kiboko Labs Products: Chained Quiz Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Chained Quiz plugin <= 1.3.2.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/chained-quiz/wordpress-chained-quiz-plugin-1-3-2-5-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-25028 State: PUBLISHED Published: 2023-05-24T16:42:41.114Z Last Updated: 2024-10-10T18:57:32.807Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: chuyencode Products: CC Custom Taxonomy Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in chuyencode CC Custom Taxonomy plugin <= 1.0.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/cc-custom-taxonmy/wordpress-cc-custom-taxonomy-plugin-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-25029 State: PUBLISHED Published: 2023-05-26T13:46:52.366Z Last Updated: 2024-11-08T18:42:19.602Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: utahta Products: WP Social Bookmarking Light Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in utahta WP Social Bookmarking Light plugin <= 2.0.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-social-bookmarking-light/wordpress-wp-social-bookmarking-light-plugin-2-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-25030 State: PUBLISHED Published: 2024-06-12T09:39:50.041Z Last Updated: 2024-08-02T11:11:43.454Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Buy Me a Coffee Products: Buy Me a Coffee Problem Types: CWE-862 Description: Missing Authorization vulnerability in Buy Me a Coffee.This issue affects Buy Me a Coffee: from n/a through 3.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/buymeacoffee/wordpress-buy-me-a-coffee-plugin-3-7-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-25031 State: PUBLISHED Published: 2023-04-07T11:01:41.539Z Last Updated: 2025-01-10T18:59:09.356Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Kiboko Labs Products: Arigato Autoresponder and Newsletter Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/bft-autoresponder/wordpress-arigato-autoresponder-and-newsletter-plugin-2-7-1-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-25032 State: PUBLISHED Published: 2023-10-24T11:37:04.760Z Last Updated: 2024-09-10T17:44:46.524Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Print, PDF, & Email by PrintFriendly Products: Print, PDF, Email by PrintFriendly Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Print, PDF, Email by PrintFriendly plugin <= 5.5.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/printfriendly/wordpress-print-pdf-email-by-printfriendly-plugin-5-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve