Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
tes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a6e687e9-6ffe-4457-8d57-3c03f657eb74?source=cve - https://plugins.trac.wordpress.org/browser/imagemapper/tags/1.2.6/imagemapper.php#L402
CVE ID: CVE-2023-5508 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:09.684Z Description: No description available.
CVE ID: CVE-2023-5509 State: PUBLISHED Published: 2023-11-20T18:55:10.363Z Last Updated: 2024-08-02T07:59:44.718Z Vendors: Unknown Products: Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any Theme Problem Types: CWE-862 Missing Authorization Description: The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the actions. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3b33c262-e7f0-4310-b26d-4727d7c25c9d
CVE ID: CVE-2023-5510 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:12.036Z Description: No description available.
CVE ID: CVE-2023-5511 State: PUBLISHED Published: 2023-10-11T00:00:19.827Z Last Updated: 2024-09-18T15:52:55.124Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: snipe Products: snipe/snipe-it Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/43206801-9862-48da-b379-e55e341d78bf - https://github.com/snipe/snipe-it/commit/6d55d782806c9660e9e65dc5250faacb5d0033ed
CVE ID: CVE-2023-5512 State: PUBLISHED Published: 2023-12-15T16:03:00.260Z Last Updated: 2025-11-20T04:10:43.439Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-94 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when specific HTML encoding is used for file names leading for incorrect representation in the UI. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/427827 - https
ional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/427827 - https://hackerone.com/reports/2194607
CVE ID: CVE-2023-5513 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:11.264Z Description: No description available.
CVE ID: CVE-2023-5514 State: PUBLISHED Published: 2023-11-01T02:40:53.285Z Last Updated: 2025-02-27T20:36:52.539Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Hitachi Energy Products: eSOMS Problem Types: CWE-209 Description: The response messages received from the eSOMS report generation using certain parameter queries with full file path can be abused for enumerating the local file system structure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000175&languageCode=en&Preview=true
CVE ID: CVE-2023-5515 State: PUBLISHED Published: 2023-11-01T02:49:08.085Z Last Updated: 2025-02-27T20:36:46.218Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Hitachi Energy Products: eSOMS Problem Types: CWE-200 Description: The responses for web queries with certain parameters disclose internal path of resources. This information can be used to learn internal structure of the application and to further plot attacks against web servers and deployed web applications. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000175&languageCode=en&Preview=true
CVE ID: CVE-2023-5516 State: PUBLISHED Published: 2023-11-01T02:54:21.225Z Last Updated: 2025-02-27T20:36:39.830Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Hitachi Energy Products: eSOMS Problem Types: CWE-200 Description: Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information about the underlying technology and other sensitive information details. The website unintentionally reveals sensitive information including technical details like version Info, endpoints, backend server, Internal IP. etc., which can potentially expose additional attack surface containing other
, endpoints, backend server, Internal IP. etc., which can potentially expose additional attack surface containing other interesting vulnerabilities. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000175&languageCode=en&Preview=true
CVE ID: CVE-2023-5517 State: PUBLISHED Published: 2024-02-13T14:04:54.389Z Last Updated: 2025-02-13T17:25:39.556Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND 9 Description: A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect <domain>;` is configured, and - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. Additional Analyst Note
.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.isc.org/docs/cve-2023-5517 - http://www.openwall.com/lists/oss-security/2024/02/13/1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/ - https://lists.fedorapr
rchives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/ - https://security.netapp.com/advisory/ntap-20240503-0006/
CVE ID: CVE-2023-5519 State: PUBLISHED Published: 2023-10-31T13:54:44.499Z Last Updated: 2025-04-23T16:10:12.271Z Vendors: Unknown Products: EventPrime Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ce564628-3d15-4bc5-8b8e-60b71786ac19
CVE ID: CVE-2023-5520 State: PUBLISHED Published: 2023-10-11T11:56:06.789Z Last Updated: 2024-09-18T15:46:12.905Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: gpac Products: gpac/gpac Problem Types: CWE-125 Description: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/681e42d0-18d4-4ebc-aba0-c5b0f77ac74a - https://github.com/gpac/gpac/commit/5692dc729491805e0e5f55c21d50ba1e6b19e88e
CVE ID: CVE-2023-5521 State: PUBLISHED Published: 2023-10-11T12:00:01.900Z Last Updated: 2024-09-18T15:45:25.017Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: tiann Products: tiann/kernelsu Problem Types: CWE-863 Description: Incorrect Authorization in GitHub repository tiann/kernelsu prior to v0.6.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/d438eff7-4e24-45e0-bc75-d3a5b3ab2ea1 - https://github.com/tiann/kernelsu/commit/a22959beae1aad96b1f72710a5daadf529c41bda
CVE ID: CVE-2023-5522 State: PUBLISHED Published: 2023-10-17T09:41:14.833Z Last Updated: 2024-09-05T19:58:49.574Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-400 Description: Mattermost Mobile fails to limit the maximum number of Markdown elements in a post allowing an attacker to send a post with hundreds of emojis to a channel and freeze the mobile app of users when viewing that particular channel. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-5523 State: PUBLISHED Published: 2023-10-20T06:40:29.555Z Last Updated: 2024-08-28T18:31:19.837Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: M-Files Products: Web Companion Problem Types: CWE-829 Description: Execution of downloaded content flaw in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://product.m-files.com/security-advisories/cve-2023-5523/
CVE ID: CVE-2023-5524 State: PUBLISHED Published: 2023-10-20T06:41:56.499Z Last Updated: 2024-08-28T18:32:12.041Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: M-Files Products: Web Companion Problem Types: CWE-434 Description: Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution via specific file types Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://product.m-files.com/security-advisories/cve-2023-5524/
CVE ID: CVE-2023-5525 State: PUBLISHED Published: 2023-11-27T16:22:06.971Z Last Updated: 2024-10-01T14:33:32.532Z Vendors: Unknown Products: Limit Login Attempts Reloaded Problem Types: CWE-862 Missing Authorization Description: The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the `toggle_auto_update` AJAX action, allowing any user with a valid nonce to toggle the auto-update status of the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/654bad15-1c88-446a-b28b-5a412cc0399d
CVE ID: CVE-2023-5527 State: PUBLISHED Published: 2024-06-18T05:38:13.533Z Last Updated: 2024-08-02T07:59:44.824Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: strategy11team Products: Business Directory Plugin – Easy Listing Directories for WordPress Problem Types: CWE-1236 Improper Neutralization of Formula Elements in a CSV File Description: The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv-exporter.php file. This allows authenticated attackers, with author-level permissions and above, to embed untrusted input into CSV files exported by administrators, which can resu
h author-level permissions and above, to embed untrusted input into CSV files exported by administrators, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ed037e94-68b4-4efc-9d1a-fffc4aff1c45?source=cve - https://plugins.trac.wordpress.org/browser/business-directory-plugin/trunk/includes/admin/class-csv-exporter.php - https://plugins.trac.wordpress.org/browser/business-directory-plugin/trunk/includes/admin/helpers/csv/class-csv-exporter.php - https://plugins.trac.word
rg/browser/business-directory-plugin/trunk/includes/admin/helpers/csv/class-csv-exporter.php - https://plugins.trac.wordpress.org/changeset/3102475/business-directory-plugin/trunk/includes/admin/helpers/csv/class-csv-exporter.php
CVE ID: CVE-2023-5528 State: PUBLISHED Published: 2023-11-14T20:32:08.411Z Last Updated: 2024-09-06T14:18:44.918Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Kubernetes Products: kubelet Problem Types: CWE-20 Description: A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kubernetes/kubernetes/issues/121879 - https://groups.google.com/g/kubernetes-
ontainer: References: - https://github.com/kubernetes/kubernetes/issues/121879 - https://groups.google.com/g/kubernetes-security-announce/c/SL_d4NR8pzA
CVE ID: CVE-2023-5529 State: PUBLISHED Published: 2025-05-15T20:08:58.829Z Last Updated: 2025-05-16T18:34:08.484Z Vendors: Unknown Products: Advanced Page Visit Counter Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Advanced Page Visit Counter WordPress plugin before 8.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/095c9c35-2618-4f90-8435-a3c34f0bb7f1/
CVE ID: CVE-2023-5530 State: PUBLISHED Published: 2023-11-06T20:41:40.862Z Last Updated: 2024-08-02T07:59:44.902Z Vendors: Unknown Products: Ninja Forms Contact Form Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored XSS attacks. Only users with the unfiltered_html capability can perform this, and such users are already allowed to use JS in posts/comments etc however the vendor acknowledged and fixed the issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability
ed and fixed the issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a642f313-cc3e-4d75-b207-1dceb6a7fbae - https://ninjaforms.com/blog/saturday-drive-x-edition/
CVE ID: CVE-2023-5531 State: PUBLISHED Published: 2023-10-12T05:30:34.818Z Last Updated: 2025-02-05T19:16:44.432Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: nik00726 Products: Thumbnail Slider With Lightbox Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the delete functionality. This makes it possible for unauthenticated attackers to delete image lightboxes via a forged request granted they can trick a site administrator into performing an
attackers to delete image lightboxes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/055b7ed5-268a-485e-ac7d-8082dc9fb2ad?source=cve - https://wordpress.org/plugins/wp-responsive-slider-with-lightbox/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1263536%40wp-responsive-slider-with-lightbox&new=1263536%40wp-responsive-slider-with-lightbox&sfp_email=&sfph_mail=
CVE ID: CVE-2023-5532 State: PUBLISHED Published: 2023-11-07T11:01:46.139Z Last Updated: 2025-02-05T18:50:44.255Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: spikefinned Products: ImageMapper Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to missing or incorrect nonce validation on the 'imgmap_save_area_title' function. This makes it possible for unauthenticated attackers to update the post title and inject malicious JavaScript via a forged request, granted they can trick a site administrator into pe
the post title and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bbb67f02-87e8-4ca3-8a9d-6663a700ab5b?source=cve - https://plugins.trac.wordpress.org/browser/imagemapper/tags/1.2.6/imagemapper.php#L894
CVE ID: CVE-2023-5533 State: PUBLISHED Published: 2023-10-20T07:29:26.096Z Last Updated: 2025-02-05T19:05:32.088Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: quantumcloud Products: AI ChatBot Problem Types: CWE-862 Missing Authorization Description: The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versions up to, and including, 4.8.9 as well as 4.9.2. This makes it possible for unauthenticated attackers to perform some of those actions that were intended for higher privileged users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
s that were intended for higher privileged users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a9db002f-ff41-493a-87b1-5f0b4b07cfc2?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2977505%40chatbot%2Ftrunk&old=2967435%40chatbot%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-5534 State: PUBLISHED Published: 2023-10-20T07:29:22.943Z Last Updated: 2025-02-05T19:06:12.789Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: quantumcloud Products: AI ChatBot Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.9 and 4.9.2. This is due to missing or incorrect nonce validation on the corresponding functions. This makes it possible for unauthenticated attackers to invoke those functions via a forged request granted they can trick a site administrator into performing an action such as clicki
hose functions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/846bd929-45cd-4e91-b232-ae16dd2b12a0?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2977505%40chatbot%2Ftrunk&old=2967435%40chatbot%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-5535 State: PUBLISHED Published: 2023-10-11T19:12:21.957Z Last Updated: 2025-02-13T17:25:40.139Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-416 Description: Use After Free in GitHub repository vim/vim prior to v9.0.2010. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/2c2d85a7-1171-4014-bf7f-a2451745861f - https://github.com/vim/vim/commit/41e6f7d6ba67b61d911f9b1d76325cd79224753d - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDDWD25AZIHBAA44HQT75OWLQ5UMDKU3/ - https://lists.fedora
/archives/list/package-announce@lists.fedoraproject.org/message/VDDWD25AZIHBAA44HQT75OWLQ5UMDKU3/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VGTVLUV7UCXXCZAIQIUCLG6JXAVYT3HE/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XPT7NMYJRLBPIALGSE24UWTY6F774GZW/
CVE ID: CVE-2023-5536 State: PUBLISHED Published: 2023-12-12T01:51:08.849Z Last Updated: 2024-08-02T07:59:44.785Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: Canonical Products: Ubuntu Server Description: A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalate their privilege to root without requiring a sudo password. Additional Analyst Notes: - CVE Program Container: References: - https://discourse.ubuntu.com/t/easy-multi-user-lxd-setup/26215/4 - https://ubuntu.com/security/CVE-2023-5536 - https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/1829071 - https://cve.mitre.org/
/ubuntu.com/security/CVE-2023-5536 - https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/1829071 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5536
CVE ID: CVE-2023-5537 State: PUBLISHED Published: 2023-11-22T15:33:21.567Z Last Updated: 2024-08-02T07:59:44.943Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: jose-lazo Products: Delete Usermetas Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Delete Usermeta plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing nonce validation on the delumet_options_page() function. This makes it possible for unauthenticated attackers to remove user meta for arbitrary users via a forged request granted they can trick a site administrator into performing an action such as
a for arbitrary users via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/23b46e5b-ce1e-4215-921c-edea7fd6c56a?source=cve - https://plugins.trac.wordpress.org/browser/delete-usermetas/trunk/delete-usermetas.php#L57 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2979918%40delete-usermetas&new=2979918%40delete-usermetas&sfp_email=&sfph_mail=
CVE ID: CVE-2023-5538 State: PUBLISHED Published: 2023-10-18T04:32:21.682Z Last Updated: 2025-02-05T19:15:32.630Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: burningx Products: mpOperationLogs Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses a
ible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bc5f1b00-acee-4dc8-acd7-2d3f3493f253?source=cve - https://plugins.trac.wordpress.org/browser/mpoperationlogs/trunk/common.php#L10 - https://plugins.trac.wordpress.org/browser/mpoperationlogs/trunk/template/ipslist_td.php - https://github.com/juweihuitao/MpOperationLogs/