Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6164 State: PUBLISHED Published: 2023-11-22T15:33:28.411Z Last Updated: 2024-08-02T08:21:17.824Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: mainwp Products: MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance Problem Types: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Description: The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘newColor’ parameter in all versions up to, and including, 4.5.1.2 due to insufficient input sanitization. This makes it possible for authenticated at
rsions up to, and including, 4.5.1.2 due to insufficient input sanitization. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary CSS values into the site tags. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/73980a90-bb17-46e4-a0ea-691f80500fe3?source=cve - https://plugins.trac.wordpress.org/changeset?old_path=/mainwp/tags/4.5.1.2&old=2996628&new_path=/mainwp/tags/4.5.1.3&new=2996628&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6165 State: PUBLISHED Published: 2024-01-29T14:44:28.461Z Last Updated: 2025-05-29T15:09:29.516Z Vendors: Unknown Products: Restrict Usernames Emails Characters Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Restrict Usernames Emails Characters WordPress plugin before 3.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/aba62286-9a82-4d5b-9b47-1fddde5da487/ - https://github.com/youki992/youki992.githu
s: - https://wpscan.com/vulnerability/aba62286-9a82-4d5b-9b47-1fddde5da487/ - https://github.com/youki992/youki992.github.io/blob/master/others/apply2.md
CVE ID: CVE-2023-6166 State: PUBLISHED Published: 2023-12-26T18:33:02.302Z Last Updated: 2024-08-02T08:21:17.653Z Vendors: Unknown Products: Quiz Maker Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e6155d9b-f6bb-4607-ad64-1976a8afe907
CVE ID: CVE-2023-6167 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:08.117Z Description: No description available.
CVE ID: CVE-2023-6173 State: PUBLISHED Published: 2024-03-27T12:05:17.320Z Last Updated: 2024-08-02T08:21:18.150Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TeoSOFT Software Products: TeoBASE Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeoSOFT Software TeoBASE allows SQL Injection.This issue affects TeoBASE: through 27032024. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-0238
CVE ID: CVE-2023-6174 State: PUBLISHED Published: 2023-11-16T11:30:40.728Z Last Updated: 2025-06-11T14:09:41.502Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Wireshark Foundation Products: Wireshark Problem Types: CWE-125 Description: SSH dissector crash in Wireshark 4.0.0 to 4.0.10 allows denial of service via packet injection or crafted capture file Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wireshark.org/security/wnpa-sec-2023-28.html - https://gitlab.com/wireshark/wireshark/-/issues/19369
CVE ID: CVE-2023-6175 State: PUBLISHED Published: 2024-03-26T07:30:49.763Z Last Updated: 2025-11-04T18:21:55.101Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Wireshark Foundation Products: Wireshark Problem Types: CWE-120 Description: NetScreen file parser crash in Wireshark 4.0.0 to 4.0.10 and 3.6.0 to 3.6.18 allows denial of service via crafted capture file Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wireshark.org/security/wnpa-sec-2023-29.html - https://gitlab.com/wireshark/wireshark/-/issues/19404
CVE ID: CVE-2023-6176 State: PUBLISHED Published: 2023-11-16T17:15:44.886Z Last Updated: 2025-11-06T20:01:46.558Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Description: A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific socket configuration, which could allow a local user to crash the system or escalate their privileges on the system. Additional Analyst Notes: - CVE Program Contai
ocal user to crash the system or escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:2394 - https://access.redhat.com/errata/RHSA-2024:2950 - https://access.redhat.com/errata/RHSA-2024:3138 - https://access.redhat.com/security/cve/CVE-2023-6176 - https://bugzilla.redhat.com/show_bug.cgi?id=2219359 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cfaa80c91f6f99b9342b6557f0f0e1143e434066
CVE ID: CVE-2023-6178 State: PUBLISHED Published: 2023-11-20T20:35:55.499Z Last Updated: 2024-08-02T08:21:17.809Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: Tenable Products: Nessus Agent Description: An arbitrary file write vulnerability exists where an authenticated attacker with privileges on the managing application could alter Nessus Rules variables to overwrite arbitrary files on the remote host, which could lead to a denial of service condition. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/tns-2023-41
CVE ID: CVE-2023-6179 State: PUBLISHED Published: 2023-11-17T17:03:32.853Z Last Updated: 2024-09-04T19:05:03.199Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Honeywell Products: ProWatch Problem Types: CWE-732 Description: Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folder(s). A(n) attacker could potentially exploit this vulnerability, leading to a standard user to have arbitrary system code execution. Honeywell recommends updating to the most recent version of this product, service or offering (Pro-watch 6.0.2, 6.0, 5.5.2,5.0.5). Additional Analyst Notes: - CVE Program Container:
his product, service or offering (Pro-watch 6.0.2, 6.0, 5.5.2,5.0.5). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://buildings.honeywell.com/us/en/brands/our-brands/security/support-and-resources/product-resources/eol-and-security-notices - https://www.honeywell.com/us/en/product-security
CVE ID: CVE-2023-6180 State: PUBLISHED Published: 2023-12-05T15:02:40.007Z Last Updated: 2024-08-02T08:21:17.825Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Cloudflare Products: tokio-boring Problem Types: CWE-400, CWE-404 Description: The tokio-boring library in version 4.0.0 is affected by a memory leak issue that can lead to excessive resource consumption and potential DoS by resource exhaustion. The set_ex_data function used by the library did not deallocate memory used by pre-existing data in memory each time after completing a TLS connection causing the program to consume more resources with each new connection. Additional Analyst Notes: - CVE Pro
S connection causing the program to consume more resources with each new connection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cloudflare/boring/security/advisories/GHSA-pjrj-h4fg-6gm4
CVE ID: CVE-2023-6181 State: PUBLISHED Published: 2023-12-11T05:17:05.043Z Last Updated: 2024-08-02T08:21:17.796Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: An oversight in BCB handling of reboot reason that allows for persistent code execution Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/docs/security/bulletin/chromecast/2023-12-01
CVE ID: CVE-2023-6184 State: PUBLISHED Published: 2024-01-18T01:04:15.120Z Last Updated: 2025-06-02T15:04:27.473Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: Cloud Software Group Products: Citrix Session Recording Problem Types: CWE-913 Description: Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scripting Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.citrix.com/article/CTX583930/citrix-session-recording-security-bulletin-for-cve20236184
CVE ID: CVE-2023-6185 State: PUBLISHED Published: 2023-12-11T11:52:06.388Z Last Updated: 2025-02-13T17:26:08.159Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H) Vendors: The Document Foundation Products: LibreOffice Description: Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugins. In affected versions the filename of the embedded video is not sufficiently escaped when passed to GStreamer enabling an attacker to run arbitrary gstreamer plugins depending on what plugins are installed on the target system. Additional Analyst Notes: - CVE Program Container: - CISA
depending on what plugins are installed on the target system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.libreoffice.org/about-us/security/advisories/cve-2023-6185 - https://www.debian.org/security/2023/dsa-5574 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QB7UB6CTWQUDOE657OVVRSDYUY3IPBJG/ - https://lists.debian.org/debian-lts-announce/2023/12/msg00026.html
CVE ID: CVE-2023-6186 State: PUBLISHED Published: 2023-12-11T11:56:40.349Z Last Updated: 2025-02-13T17:26:08.751Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H) Vendors: The Document Foundation Products: LibreOffice Description: Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without warning. In affected versions LibreOffice supports hyperlinks with macro or similar built-in command targets that can be executed when activated without warning the user. Additional Analyst Notes: - CVE Program Container: References: - https://www.libreoffice.org/about-us/security/advisories/cve-2023-6186 - http
es: - CVE Program Container: References: - https://www.libreoffice.org/about-us/security/advisories/cve-2023-6186 - https://www.debian.org/security/2023/dsa-5574 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QB7UB6CTWQUDOE657OVVRSDYUY3IPBJG/ - https://lists.debian.org/debian-lts-announce/2023/12/msg00026.html
CVE ID: CVE-2023-6187 State: PUBLISHED Published: 2023-11-18T01:54:35.162Z Last Updated: 2024-08-02T08:21:17.808Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: strangerstudios Products: Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads to insufficient file type validation in the 'pmpro_paypalexpress_session_vars_for_user_fields' function in versions up to, and including, 2.12.3. This makes it possible for authenticated attackers with subscriber privileges or
versions up to, and including, 2.12.3. This makes it possible for authenticated attackers with subscriber privileges or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if 2Checkout (deprecated since version 2.6) or PayPal Express is set as the payment method and a custom user field is added that is only visible at profile, and not visible at checkout according to its settings. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5979f2eb-2ca8-4b06-814c-c4236bb81af0?source=cve - https://plugins.trac.wordpress.org/browser/paid-memberships-pr
ties/id/5979f2eb-2ca8-4b06-814c-c4236bb81af0?source=cve - https://plugins.trac.wordpress.org/browser/paid-memberships-pro/tags/2.12.3/includes/fields.php#L564 - https://www.paidmembershipspro.com/pmpro-update-2-12-4/ - https://plugins.trac.wordpress.org/changeset/2997319/paid-memberships-pro/tags/2.12.4/includes/functions.php - https://plugins.trac.wordpress.org/changeset/2997319/paid-memberships-pro/tags/2.12.4/includes/fields.php
CVE ID: CVE-2023-6188 State: PUBLISHED Published: 2023-11-17T17:31:04.595Z Last Updated: 2024-09-04T19:00:28.881Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: GetSimpleCMS Problem Types: CWE-94 Description: A vulnerability was found in GetSimpleCMS 3.3.16/3.4.0a. It has been rated as critical. This issue affects some unknown processing of the file /admin/theme-edit.php. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-245735. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
ulnerability is VDB-245735. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.245735 - https://vuldb.com/?ctiid.245735 - https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1358 - https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1352
CVE ID: CVE-2023-6189 State: PUBLISHED Published: 2023-11-22T09:56:44.563Z Last Updated: 2024-08-28T08:17:57.402Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: M-Files Products: M-Files Server Problem Types: CWE-280 Description: Missing access permissions checks in the M-Files server before 23.11.13156.0 allow attackers to perform data write and export jobs using the M-Files API methods. Additional Analyst Notes: - CVE Program Container: References: - https://product.m-files.com/security-advisories/cve-2023-6189/
CVE ID: CVE-2023-6190 State: PUBLISHED Published: 2023-12-27T14:36:35.559Z Last Updated: 2024-11-27T12:44:12.922Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: İzmir Katip Çelebi University Products: University Information Management System Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in İzmir Katip Çelebi University University Information Management System allows Absolute Path Traversal.This issue affects University Information Management System: before 30.11.2023. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.g
30.11.2023. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0736
CVE ID: CVE-2023-6191 State: PUBLISHED Published: 2024-03-29T11:40:07.917Z Last Updated: 2024-08-27T16:03:59.364Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Egehan Security Products: WebPDKS Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Egehan Security WebPDKS allows SQL Injection.This issue affects WebPDKS: through 20240329. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-0253
CVE ID: CVE-2023-6193 State: PUBLISHED Published: 2023-12-12T13:32:03.183Z Last Updated: 2024-08-02T08:21:17.737Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Cloudflare Products: quiche Problem Types: CWE-400 Description: quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consumption. QUIC path validation (RFC 9000 Section 8.2) requires that the recipient of a PATH_CHALLENGE frame responds by sending a PATH_RESPONSE. An unauthenticated remote attacker can exploit the vulnerability by sending PATH_CHALLENGE frames and manipulating the connection (e.g. by
remote attacker can exploit the vulnerability by sending PATH_CHALLENGE frames and manipulating the connection (e.g. by restricting the peer's congestion window size) so that PATH_RESPONSE frames can only be sent at the slower rate than they are received; leading to storage of path validation data in an unbounded queue. Quiche versions greater than 0.19.0 address this problem. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cloudflare/quiche/security/advisories/GHSA-w3vp-jw9m-f9pm - https://datatracker.ietf.org/doc/html/rfc9000#section-8.2
CVE ID: CVE-2023-6194 State: PUBLISHED Published: 2023-12-11T14:04:51.680Z Last Updated: 2024-08-02T08:21:17.798Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Eclipse Foundation Products: Eclipse Memory Analyzer (tools.mat) Problem Types: CWE-611 Description: In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition (DTD) references to external entities. This means that if a user chooses to use a malicious report definition XML file containing an external entity reference to generate a report then Eclipse Memory Analyzer may access external files or URLs defined via a DTD in the repor
rence to generate a report then Eclipse Memory Analyzer may access external files or URLs defined via a DTD in the report definition. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.eclipse.org/security/cve-assignement/-/issues/15 - https://bugs.eclipse.org/bugs/show_bug.cgi?id=582631 - https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/169
CVE ID: CVE-2023-6195 State: PUBLISHED Published: 2025-01-30T23:45:10.780Z Last Updated: 2025-02-18T18:59:19.527Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-918 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.5 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. GitLab was vulnerable to Server Side Request Forgery when an attacker uses a malicious URL in the markdown image value when importing a GitHub repository. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issu
repository. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/432276 - https://hackerone.com/reports/2249268
CVE ID: CVE-2023-6196 State: PUBLISHED Published: 2023-11-20T14:34:21.461Z Last Updated: 2024-08-29T20:46:36.885Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Audio Merchant Products: Audio Merchant Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due to missing or incorrect nonce validation on the function audio_merchant_add_audio_file function. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performin
ated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/06513dfe-f263-48b7-ba01-2c205247095b?source=cve - https://plugins.trac.wordpress.org/browser/audio-merchant/trunk/audio-merchant.php#L1298
CVE ID: CVE-2023-6197 State: PUBLISHED Published: 2023-11-20T14:34:22.011Z Last Updated: 2024-08-29T20:45:26.855Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Audio Merchant Products: Audio Merchant Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due to missing or incorrect nonce validation on the audio_merchant_save_settings function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a si
ackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d7911337-57fa-4268-8366-d37ff13fae86?source=cve - https://plugins.trac.wordpress.org/browser/audio-merchant/trunk/audio-merchant.php#L951
CVE ID: CVE-2023-6198 State: PUBLISHED Published: 2024-06-25T01:34:56.567Z Last Updated: 2024-08-02T08:21:18.118Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L) Vendors: Baicells Products: Snap Router Problem Types: CWE-798 Description: Use of Hard-coded Credentials vulnerability in Baicells Snap Router BaiCE_BMI on EP3011 (User Passwords modules) allows unauthorized access to the device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.baicells.com
CVE ID: CVE-2023-6199 State: PUBLISHED Published: 2023-11-20T22:21:04.992Z Last Updated: 2025-05-19T14:02:54.810Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: BookStack Products: BookStack Problem Types: CWE-918 Description: Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/imagination/ - https://www.bookstackapp.com/blog/bookstack-release-v23-10-3/
CVE ID: CVE-2023-6200 State: PUBLISHED Published: 2024-01-28T12:19:24.885Z Last Updated: 2025-06-05T19:45:49.317Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a, Red Hat, Fedora Products: kernel, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Virtualization 4, Fedora Problem Types: CWE-362 Description: A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send an ICMPv6 router advertisement packet, causing arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
nt packet, causing arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-6200 - https://bugzilla.redhat.com/show_bug.cgi?id=2250377 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dade3f6a1e4e