Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ettings function. This makes it possible for unauthenticated attackers to modify virtual event settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6fcc3a82-f116-446e-9e5f-4f074e20403b?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3017939%40eventon-lite&new=3017939%40eventon-lite&sfp_email=&sfph_mail= - https://docs.myeventon.com/documentations/eventon-changelog/
CVE ID: CVE-2023-6245 State: PUBLISHED Published: 2023-12-08T14:26:09.331Z Last Updated: 2024-12-02T14:33:16.496Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Internet Computer Products: Candid Problem Types: CWE-835, CWE-1288, CWE-168, CWE-20 Description: The Candid library causes a Denial of Service while parsing a specially crafted payload with 'empty' data type. For example, if the payload is `record { * ; empty }` and the canister interface expects `record { * }` then the Rust candid decoder treats empty as an extra field required by the type. The problem with the type empty is that the candid Rust library wrongly categorizes empty as a recoverable err
the type. The problem with the type empty is that the candid Rust library wrongly categorizes empty as a recoverable error when skipping the field and thus causing an infinite decoding loop. Canisters using affected versions of candid are exposed to denial of service by causing the decoding to run indefinitely until the canister traps due to reaching maximum instruction limit per execution round. Repeated exposure to the payload will result in degraded performance of the canister. Note: Canisters written in Motoko are unaffected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dfinity/candid/pull/478 - https://internetcomputer.org/
ainer: - CISA ADP Vulnrichment: References: - https://github.com/dfinity/candid/pull/478 - https://internetcomputer.org/docs/current/references/candid-ref - https://github.com/dfinity/candid/blob/master/spec/Candid.md - https://github.com/dfinity/candid/security/advisories/GHSA-7787-p7x6-fq3j - https://internetcomputer.org/docs/current/references/ic-interface-spec
CVE ID: CVE-2023-6246 State: PUBLISHED Published: 2024-01-31T14:06:21.949Z Last Updated: 2025-02-13T17:26:15.198Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a, Red Hat, Fedora Products: glibc, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Fedora Problem Types: CWE-122 Description: A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is
unction was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://packetstormsecurity.com/files/176931/glibc-qsort-Out-Of-Bounds-Read-Write.html - http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html - http://seclists.org/fulldisclosure/2024/Feb/3 - http://seclists.org/fulldisclosure/2024/Feb/5 - https://access.redhat.com/security/cve/CVE-2023-6246 - https://bugzilla.redhat.com/s
sts.org/fulldisclosure/2024/Feb/5 - https://access.redhat.com/security/cve/CVE-2023-6246 - https://bugzilla.redhat.com/show_bug.cgi?id=2249053 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2FIH77VHY3KCRROCXOT6L27WMZXSJ2G/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWQ6BZJ6CV5UAW4VZSKJ6TO4KIW2KWAQ/ - https://security.gentoo.org/glsa/202402-01 - https://www.openwall.com/lists/oss-security/2024/01/30/6 - https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt - https://security.netapp.com/advisory/ntap-20240216-0007/
CVE ID: CVE-2023-6247 State: PUBLISHED Published: 2024-02-20T18:43:17.890Z Last Updated: 2024-10-28T00:05:34.713Z Vendors: OpenVPN Products: OpenVPN 3 Core Library Problem Types: CWE-476 Description: The PKCS#7 parser in OpenVPN 3 Core Library versions through 3.8.3 did not properly validate the parsed data, which would result in the application crashing. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.openvpn.net/openvpn/wiki/CVE-2023-6247
CVE ID: CVE-2023-6248 State: PUBLISHED Published: 2023-11-21T21:49:35.831Z Last Updated: 2024-10-17T18:01:16.523Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Digital Communications Technologies Products: Syrus4 IoT Telematics Gateway Problem Types: CWE-287, CWE-319, CWE-200, CWE-94 Description: The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attacker to execute code on any Syrus4 device connected to the cloud service. The MQTT server also leaks the location, video and diagnostic data from each connected device. An attacker who knows the IP address of the server is abl
ocation, video and diagnostic data from each connected device. An attacker who knows the IP address of the server is able to connect and perform the following operations: * Get location data of the vehicle the device is connected to * Send CAN bus messages via the ECU module ( https://syrus.digitalcomtech.com/docs/ecu-1 https://syrus.digitalcomtech.com/docs/ecu-1 ) * Immobilize the vehicle via the safe-immobilizer module ( https://syrus.digitalcomtech.com/docs/system-tools#safe-immobilization https://syrus.digitalcomtech.com/docs/system-tools#safe-immobilization ) * Get live video through the connected video camera * Send audio messages to the driver ( https://syrus.digitalcomtech.com/docs/s
e video through the connected video camera * Send audio messages to the driver ( https://syrus.digitalcomtech.com/docs/system-tools#apx-tts https://syrus.digitalcomtech.com/docs/system-tools#apx-tts ) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.digitalcomtech.com/product/syrus-4g-iot-telematics-gateway/
CVE ID: CVE-2023-6249 State: PUBLISHED Published: 2024-02-18T07:27:13.399Z Last Updated: 2024-08-02T08:21:18.165Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-704 Description: Signed to unsigned conversion esp32_ipm_send Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-32f5-3p9h-2rqc
CVE ID: CVE-2023-6250 State: PUBLISHED Published: 2023-12-26T18:33:11.036Z Last Updated: 2024-08-02T08:21:18.094Z Vendors: Unknown Products: BestWebSoft's Like & Share Problem Types: CWE-287 Improper Authentication Description: The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tag Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6cad602b-7414-4867-8ae2-f0b846c4c8f0
CVE ID: CVE-2023-6251 State: PUBLISHED Published: 2023-11-24T08:16:23.663Z Last Updated: 2024-08-02T08:21:18.099Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-352 Description: Cross-site Request Forgery (CSRF) in Checkmk < 2.2.0p15, < 2.1.0p37, <= 2.0.0p39 allow an authenticated attacker to delete user-messages for individual users. Additional Analyst Notes: - CVE Program Container: References: - https://checkmk.com/werk/16224
CVE ID: CVE-2023-6252 State: PUBLISHED Published: 2023-11-22T13:45:10.950Z Last Updated: 2024-08-02T08:21:18.095Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Chameleon Power Products: Chameleon Power Problem Types: CWE-35 Description: Path traversal vulnerability in Chalemelon Power framework, affecting the getImage parameter. This vulnerability could allow a remote user to read files located on the server and gain access to sensitive information such as configuration files. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/path-traversal-vulnerability-chameleon-power-products
CVE ID: CVE-2023-6253 State: PUBLISHED Published: 2023-11-22T11:22:58.159Z Last Updated: 2025-02-13T17:26:15.761Z Vendors: Fortra Products: Digital Guardian Agent Problem Types: CWE-922 Description: A saved encryption key in the Uninstaller in Digital Guardian's Agent before version 7.9.4 allows a local attacker to retrieve the uninstall key and remove the software by extracting the uninstaller key from the memory of the uninstaller file. Additional Analyst Notes: - CVE Program Container: References: - https://www.fortra.com/security - https://r.sec-consult.com/fortra - http://seclists.org/fulldisclosure/2023/Nov/14 - http://packetstormsecurity.com/files/175956/Fortra-Digital-Guardian-Agent-
p://seclists.org/fulldisclosure/2023/Nov/14 - http://packetstormsecurity.com/files/175956/Fortra-Digital-Guardian-Agent-Uninstaller-Cross-Site-Scripting-UninstallKey-Cached.html
CVE ID: CVE-2023-6254 State: PUBLISHED Published: 2023-11-27T09:44:00.273Z Last Updated: 2024-10-15T17:45:11.912Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: OTRS AG Products: OTRS Problem Types: CWE-522 Description: A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server response- This issue affects OTRS: from 8.0.X through 8.0.37. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-advisory-2023-11/
CVE ID: CVE-2023-6255 State: PUBLISHED Published: 2024-02-15T15:52:03.063Z Last Updated: 2025-04-24T15:14:11.335Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Utarit Information Technologies Products: SoliPay Mobile App Problem Types: CWE-798 Description: Use of Hard-coded Credentials vulnerability in Utarit Information Technologies SoliPay Mobile App allows Read Sensitive Strings Within an Executable.This issue affects SoliPay Mobile App: before 5.0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-0104
CVE ID: CVE-2023-6257 State: PUBLISHED Published: 2024-04-11T05:00:02.030Z Last Updated: 2025-03-26T20:47:15.800Z Vendors: Unknown Products: Inline Related Posts Problem Types: CWE-862 Missing Authorization Description: The Inline Related Posts WordPress plugin before 3.6.0 is missing authorization in an AJAX action to ensure that users are allowed to see the content of the posts displayed, allowing any authenticated user, such as subscriber to retrieve the content of password protected posts Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/19a86448-8d7c-4f02-9290-d9f93810e6e1/
CVE ID: CVE-2023-6258 State: PUBLISHED Published: 2024-01-30T16:55:18.733Z Last Updated: 2025-06-17T21:29:17.985Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a, Fedora Products: pkcs11-provider, Fedora Problem Types: CWE-1300 Description: A security vulnerability has been identified in the pkcs11-provider, which is associated with Public-Key Cryptography Standards (PKCS#11). If exploited successfully, this vulnerability could result in a Bleichenbacher-like security flaw, potentially enabling a side-channel attack on PKCS#1 1.5 decryption. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.co
on. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2251062 - https://github.com/latchset/pkcs11-provider/pull/308
CVE ID: CVE-2023-6259 State: PUBLISHED Published: 2024-02-19T21:28:01.273Z Last Updated: 2024-08-22T13:49:14.128Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Brivo Products: ACS100, ACS300 Problem Types: CWE-522, CWE-284 Description: Insufficiently Protected Credentials, : Improper Access Control vulnerability in Brivo ACS100, ACS300 allows Password Recovery Exploitation, Bypassing Physical Security.This issue affects ACS100, ACS300: from 5.2.4 before 6.2.4.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sra.io/advisories/ - https://support.brivo.com/l/en/article/g82txdwepa-brivo-firmware-release-notes#b
erences: - https://sra.io/advisories/ - https://support.brivo.com/l/en/article/g82txdwepa-brivo-firmware-release-notes#brivo_firmware_release_6_2_4_3
CVE ID: CVE-2023-6260 State: PUBLISHED Published: 2024-02-19T21:30:20.947Z Last Updated: 2024-08-02T08:28:20.371Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Brivo Products: ACS100, ACS300 Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Brivo ACS100, ACS300 allows OS Command Injection, Bypassing Physical Security.This issue affects ACS100 (Network Adjacent Access), ACS300 (Physical Access): from 5.2.4 before 6.2.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sra.io/advisories/ - https://support.brivo.com/l
- CISA ADP Vulnrichment: - CVE Program Container: References: - https://sra.io/advisories/ - https://support.brivo.com/l/en/article/g82txdwepa-brivo-firmware-release-notes#brivo_firmware_release_6_2_4_3
CVE ID: CVE-2023-6263 State: PUBLISHED Published: 2023-11-22T17:56:56.711Z Last Updated: 2024-08-02T08:28:20.362Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Network Optix Products: NxCloud Problem Types: CWE-290 Description: An issue was discovered by IPVM team in Network Optix NxCloud before 23.1.0.40440. It was possible to add a fake VMS server to NxCloud by using the exact identification of a legitimate VMS server. As result, it was possible to retrieve authorization headers from legitimate users when the legitimate client connects to the fake VMS server. Additional Analyst Notes: - CVE Program Container: References: - https://networkoptix.atlassian.ne
the fake VMS server. Additional Analyst Notes: - CVE Program Container: References: - https://networkoptix.atlassian.net/wiki/spaces/CHS/blog/2023/09/22/3074195467/vulnerability+2023-09-21+-+Server+Spoofing
CVE ID: CVE-2023-6264 State: PUBLISHED Published: 2023-11-22T18:39:21.629Z Last Updated: 2024-08-02T08:28:20.199Z Vendors: Devolutions Products: Server Description: Information leak in Content-Security-Policy header in Devolutions Server 2023.3.7.0 allows an unauthenticated attacker to list the configured Devolutions Gateways endpoints. Additional Analyst Notes: - CVE Program Container: References: - https://devolutions.net/security/advisories/DEVO-2023-0020/
CVE ID: CVE-2023-6265 State: PUBLISHED Published: 2023-11-22T19:47:07.692Z Last Updated: 2024-08-02T08:28:20.179Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: DrayTek Products: Vigor2960 Problem Types: CWE-22 Description: ** UNSUPPORTED WHEN ASSIGNED ** Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' parameter allowing an authenticated attacker with access to the web management interface to delete arbitrary files. Vigor2960 is no longer supported. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xxy1126/Vuln/blob/main/Draytek/4.md - https://www.dr
st Notes: - CVE Program Container: References: - https://github.com/xxy1126/Vuln/blob/main/Draytek/4.md - https://www.draytek.com/products/vigor2960/ - https://www.draytek.com/about/newsroom/2021/2021/end-of-life-notification-vigor2960
CVE ID: CVE-2023-6266 State: PUBLISHED Published: 2024-01-11T08:32:27.689Z Last Updated: 2025-06-17T21:09:12.937Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: migrate Products: Backup Migration Problem Types: CWE-200 Information Exposure Description: The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMI_BACKUP case of the handle_downloading function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to download back-up files which can contain sensitive information such as user passwords, PII, database credentials, and much
nload back-up files which can contain sensitive information such as user passwords, PII, database credentials, and much more. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/08801f53-3c57-41a3-a637-4b52637cc612?source=cve - https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.5/includes/initializer.php#L972 - https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.5/includes/initializer.php#L1048 - https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/initializer.php#L1065
CVE ID: CVE-2023-6267 State: PUBLISHED Published: 2024-01-25T18:12:44.771Z Last Updated: 2025-11-20T07:08:53.747Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: Red Hat Products: Red Hat build of Quarkus 2.13.9.Final, Red Hat build of Quarkus 3.2.9.Final, Red Hat build of OptaPlanner 8, Red Hat Fuse 7, Red Hat Integration Camel K 1, Red Hat Integration Camel Quarkus 2 Problem Types: CWE-755 Description: A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not hap
nsume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:0494 - https://access.redhat.com/errata/RHSA-2024:0495 - https://access.redhat.com/security/cve/CVE-2023-6267 - https://bugzilla.redhat.com/show_bug.cgi?id=2251155
CVE ID: CVE-2023-6268 State: PUBLISHED Published: 2023-12-26T18:33:04.704Z Last Updated: 2024-08-02T08:28:20.193Z Vendors: Unknown Products: JSON Content Importer Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/15b9ab48-c038-4f2e-b823-1e374baae985
CVE ID: CVE-2023-6269 State: PUBLISHED Published: 2023-12-05T07:35:19.472Z Last Updated: 2025-02-13T17:26:16.336Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Atos Unify Products: OpenScape Session Border Controller (SBC), OpenScape Branch, OpenScape BCF Problem Types: CWE-88 Description: An argument injection vulnerability has been identified in the administrative web interface of the Atos Unify OpenScape products "Session Border Controller" (SBC) and "Branch", before version V10 R3.4.0, and OpenScape "BCF" before versions V10R10.12.00 and V10R11.05.02. This allows an unauthenticated attacker to gain root access to the appliance via SSH (scope change) a
and V10R11.05.02. This allows an unauthenticated attacker to gain root access to the appliance via SSH (scope change) and also bypass authentication for the administrative interface and gain access as an arbitrary (administrative) user. Additional Analyst Notes: - CVE Program Container: References: - https://networks.unify.com/security/advisories/OBSO-2310-01.pdf - https://r.sec-consult.com/unifyroot - http://seclists.org/fulldisclosure/2023/Dec/16 - http://packetstormsecurity.com/files/176194/Atos-Unify-OpenScape-Authentication-Bypass-Remote-Code-Execution.html
CVE ID: CVE-2023-6270 State: PUBLISHED Published: 2024-01-04T17:01:51.165Z Last Updated: 2025-11-20T18:08:29.004Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-416 Description: A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a denial of service condition or p
ee on the struct and the access through the `skbtxq` global queue. This could lead to a denial of service condition or potential code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-6270 - https://bugzilla.redhat.com/show_bug.cgi?id=2256786
CVE ID: CVE-2023-6271 State: PUBLISHED Published: 2024-01-01T14:18:55.067Z Last Updated: 2025-06-11T16:41:10.999Z Vendors: Unknown Products: Backup Migration Problem Types: CWE-200 Information Exposure Description: The Backup Migration WordPress plugin before 1.3.6 stores in-progress backups information in easy to find, publicly-accessible files, which may allow attackers monitoring those to leak sensitive information from the site's backups. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7ac217db-f332-404b-a265-6dc86fe747b9 - https://research.cleantalk.org/cve-2023-6271-backup-migration-unauth-sensitive-data-exposur
332-404b-a265-6dc86fe747b9 - https://research.cleantalk.org/cve-2023-6271-backup-migration-unauth-sensitive-data-exposure-to-full-control-of-the-site-poc-exploit
CVE ID: CVE-2023-6272 State: PUBLISHED Published: 2023-12-18T20:07:55.945Z Last Updated: 2024-08-02T08:28:20.359Z Vendors: Unknown Products: tml-2fa Problem Types: CWE-307 Improper Restriction of Excessive Authentication Attempts Description: The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, which shouldn't be too long, as the 2FA codes are 6 digits. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a03243ea-fee7-46e4-8037-a228afc5297a
CVE ID: CVE-2023-6273 State: PUBLISHED Published: 2023-12-06T09:07:24.345Z Last Updated: 2024-10-10T18:31:23.836Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Permissions, Privileges, and Access Controls Description: Permission management vulnerability in the module for disabling Sound Booster. Successful exploitation of this vulnerability may cause features to perform abnormally. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2023/12/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-0000001758430245