Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-41852 State: PUBLISHED Published: 2023-10-10T08:40:10.279Z Last Updated: 2024-09-17T19:40:01.571Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: MailMunch Products: MailMunch – Grow your Email List Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in MailMunch MailMunch – Grow your Email List plugin <= 3.1.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mailmunch/wordpress-mailmunch-grow-your-email-list-plugin-3-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-41853 State: PUBLISHED Published: 2023-10-10T08:43:39.531Z Last Updated: 2024-09-17T19:39:19.368Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WP iCal Availability Products: WP iCal Availability Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WP iCal Availability plugin <= 1.0.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-ical-availability/wordpress-wp-ical-availability-plugin-1-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-41854 State: PUBLISHED Published: 2023-10-10T08:46:38.712Z Last Updated: 2024-09-17T19:34:35.961Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Softaculous Ltd. Products: wpCentral Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Softaculous Ltd. WpCentral plugin <= 1.5.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-central/wordpress-wpcentral-plugin-1-5-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-41855 State: PUBLISHED Published: 2023-10-02T08:39:20.621Z Last Updated: 2024-09-20T15:23:10.485Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Regpacks Products: Regpack Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Regpacks Regpack plugin <= 0.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/regpack/wordpress-regpack-plugin-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-41856 State: PUBLISHED Published: 2023-10-02T08:42:00.693Z Last Updated: 2024-09-20T15:28:19.585Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: ClickToTweet.com Products: Click To Tweet Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ClickToTweet.Com Click To Tweet plugin <= 2.0.14 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/click-to-tweet/wordpress-click-to-tweet-plugin-2-0-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-41857 State: PUBLISHED Published: 2024-12-13T14:24:20.553Z Last Updated: 2024-12-13T19:08:09.141Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: ClickToTweet.com Products: Click To Tweet Problem Types: CWE-862 Description: Missing Authorization vulnerability in ClickToTweet.com Click To Tweet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Click To Tweet: from n/a through 2.0.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/click-to-tweet/vulnerability/wordpress-click-to-tweet-plugin-2-0-14-broken-access-control-vulnerability?_s_i
ress/plugin/click-to-tweet/vulnerability/wordpress-click-to-tweet-plugin-2-0-14-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-41858 State: PUBLISHED Published: 2023-10-10T08:50:47.217Z Last Updated: 2024-09-17T19:32:54.168Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Ashok Rane Products: Order Delivery Date for WP e-Commerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Ashok Rane Order Delivery Date for WP e-Commerce plugin <= 1.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/order-delivery-date/wordpress-order-delivery-date-for-wp-e-commerce-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-41859 State: PUBLISHED Published: 2023-10-02T08:49:27.338Z Last Updated: 2025-02-19T21:22:38.367Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Ashok Rane Products: Order Delivery Date for WP e-Commerce Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ashok Rane Order Delivery Date for WP e-Commerce plugin <= 1.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/order-delivery-date/wordpress-order-delivery-date-for-wp-e-commerce-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-41860 State: PUBLISHED Published: 2023-09-26T07:46:53.689Z Last Updated: 2024-09-23T20:02:18.476Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: TravelMap Products: Travel Map Problem Types: CWE-79 Description: Unauth. Cross-Site Scripting (XSS) vulnerability in TravelMap plugin <= 1.0.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/travelmap-blog/wordpress-travel-map-plugin-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-41861 State: PUBLISHED Published: 2023-09-26T07:41:45.190Z Last Updated: 2024-09-23T20:04:39.521Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Restrict Products: Restrict Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Restrict plugin <= 2.2.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/restricted-content/wordpress-restrict-membership-site-content-and-user-access-restrictions-for-wordpress-plugin-2-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-41862 State: PUBLISHED Published: 2024-12-13T14:24:21.131Z Last Updated: 2024-12-13T19:07:45.073Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Guido Products: VS Contact Form Problem Types: CWE-1390 Description: Weak Authentication vulnerability in Guido VS Contact Form allows Authentication Abuse.This issue affects VS Contact Form: from n/a through 14.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/very-simple-contact-form/vulnerability/wordpress-vs-contact-form-plugin-13-9-sum-captcha-bypass-vulnerability?_s_id=cve
CVE ID: CVE-2023-41863 State: PUBLISHED Published: 2023-09-25T18:46:18.509Z Last Updated: 2024-09-23T20:05:00.135Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Pepro Dev. Group Products: PeproDev CF7 Database Problem Types: CWE-79 Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Pepro Dev. Group PeproDev CF7 Database plugin <= 1.7.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/pepro-cf7-database/wordpress-peprodev-cf7-database-plugin-1-7-0-unauthenticated-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-41864 State: PUBLISHED Published: 2024-04-18T08:12:49.046Z Last Updated: 2024-08-02T19:09:49.280Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Pepro Dev. Group Products: PeproDev CF7 Database Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Pepro Dev. Group PeproDev CF7 Database.This issue affects PeproDev CF7 Database: from n/a through 1.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/pepro-cf7-database/wordpress-peprodev-cf7-database-plugin-1-8-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-41865 State: PUBLISHED Published: 2024-12-13T14:24:21.676Z Last Updated: 2024-12-13T19:07:25.448Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: bqworks Products: Slider Pro Problem Types: CWE-862 Description: Missing Authorization vulnerability in bqworks Slider Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slider Pro: from n/a through 4.8.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/sliderpro/vulnerability/wordpress-slider-pro-plugin-4-8-6-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-41866 State: PUBLISHED Published: 2024-12-13T14:24:22.197Z Last Updated: 2024-12-16T17:57:00.726Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Team Plugins360 Products: Automatic YouTube Gallery Problem Types: CWE-862 Description: Missing Authorization vulnerability in Team Plugins360 Automatic YouTube Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automatic YouTube Gallery: from n/a through 2.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/automatic-youtube-gallery/vulnerability/wordpress-automatic-youtube-gallery-pl
/patchstack.com/database/wordpress/plugin/automatic-youtube-gallery/vulnerability/wordpress-automatic-youtube-gallery-plugin-2-3-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-41867 State: PUBLISHED Published: 2023-09-25T18:41:54.912Z Last Updated: 2024-09-23T20:05:20.185Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: AcyMailing Newsletter Team Products: AcyMailing Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AcyMailing Newsletter Team AcyMailing plugin <= 8.6.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/acymailing/wordpress-acymailing-plugin-8-6-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-41868 State: PUBLISHED Published: 2023-09-25T18:37:31.048Z Last Updated: 2024-09-23T20:06:10.922Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Ram Ratan Maurya, Codestag Products: StagTools Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ram Ratan Maurya, Codestag StagTools plugin <= 2.3.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/stagtools/wordpress-stagtools-plugin-2-3-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-41869 State: PUBLISHED Published: 2024-12-13T14:24:22.710Z Last Updated: 2024-12-16T17:55:48.935Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Alex Volkov Products: WP Accessibility Helper (WAH) Problem Types: CWE-862 Description: Missing Authorization vulnerability in Alex Volkov WP Accessibility Helper (WAH) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Accessibility Helper (WAH): from n/a through 0.6.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-accessibility-helper/vulnerability/wordpress-wp-accessibility-helper-
ttps://patchstack.com/database/wordpress/plugin/wp-accessibility-helper/vulnerability/wordpress-wp-accessibility-helper-wah-plugin-0-6-2-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-41870 State: PUBLISHED Published: 2024-12-13T14:24:23.236Z Last Updated: 2024-12-16T17:54:56.397Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Themeum Products: WP Crowdfunding Problem Types: CWE-862 Description: Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-crowdfunding/vulnerability/wordpress-wp-crowdfunding-plugin-2-1-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-41871 State: PUBLISHED Published: 2023-09-25T18:31:51.946Z Last Updated: 2024-09-23T19:42:50.650Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Poll Maker Team Products: Poll Maker Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Poll Maker Team Poll Maker plugin <= 4.7.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/poll-maker/wordpress-poll-maker-best-wordpress-poll-plugin-plugin-4-7-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-41872 State: PUBLISHED Published: 2023-09-25T01:05:25.048Z Last Updated: 2024-09-23T20:06:39.247Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Xtemos Products: WoodMart Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xtemos WoodMart plugin <= 7.2.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woodmart/wordpress-woodmart-theme-7-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-41873 State: PUBLISHED Published: 2024-12-13T14:24:23.763Z Last Updated: 2024-12-16T17:51:58.239Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: miniOrange Products: SAML SP Single Sign On Problem Types: CWE-862 Description: Missing Authorization vulnerability in miniOrange SAML SP Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SAML SP Single Sign On: from n/a through 5.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/miniorange-saml-20-single-sign-on/vulnerability/wordpress-saml-single-sign-on-sso-login-plugin-5-
abase/wordpress/plugin/miniorange-saml-20-single-sign-on/vulnerability/wordpress-saml-single-sign-on-sso-login-plugin-5-0-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-41874 State: PUBLISHED Published: 2023-09-25T00:42:59.942Z Last Updated: 2024-09-23T20:06:59.058Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Tyche Softwares Products: Order Delivery Date for WooCommerce Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Tyche Softwares Order Delivery Date for WooCommerce plugin <= 3.20.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/order-delivery-date-for-woocommerce/wordpress-order-delivery-date-for-woocommerce-plugin-3-20-0-reflected-cross-site-scripting-xss-
ery-date-for-woocommerce/wordpress-order-delivery-date-for-woocommerce-plugin-3-20-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-41875 State: PUBLISHED Published: 2024-12-13T14:24:24.307Z Last Updated: 2024-12-16T17:38:44.510Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: wpdirectorykit.com Products: WP Directory Kit Problem Types: CWE-862 Description: Missing Authorization vulnerability in wpdirectorykit.com WP Directory Kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through 1.2.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpdirectorykit/vulnerability/wordpress-wp-directory-kit-plugin-1-2-6-broken-access-control-vulnerab
ase/wordpress/plugin/wpdirectorykit/vulnerability/wordpress-wp-directory-kit-plugin-1-2-6-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-41876 State: PUBLISHED Published: 2023-10-10T08:53:25.955Z Last Updated: 2024-09-17T19:32:33.595Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Hardik Kalathiya Products: WP Gallery Metabox Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Hardik Kalathiya WP Gallery Metabox plugin <= 1.0.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-gallery-metabox/wordpress-wp-gallery-metabox-plugin-1-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-41877 State: PUBLISHED Published: 2024-03-20T14:27:34.308Z Last Updated: 2024-08-02T19:09:49.319Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: geoserver Products: geoserver Problem Types: CWE-22 Description: GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A path traversal vulnerability in versions 2.23.4 and prior requires GeoServer Administrator with access to the admin console to misconfigure the Global Settings for log file location to an arbitrary location. The admin console GeoServer Logs page provides a preview of these contents. As this issue requires GeoServer administ
n. The admin console GeoServer Logs page provides a preview of these contents. As this issue requires GeoServer administrators access, often representing a trusted party, the vulnerability has not received a patch as of time of publication. As a workaround, a system administrator responsible for running GeoServer can use the `GEOSERVER_LOG_FILE` setting to override any configuration option provided by the Global Settings page. The `GEOSERVER_LOG_LOCATION` parameter can be set as system property, environment variables, or servlet context parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/geoserver/geoserver/security/advisor
- CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/geoserver/geoserver/security/advisories/GHSA-8g7v-vjrc-x4g5 - https://docs.geoserver.org/latest/en/user/configuration/globalsettings.html#log-location
CVE ID: CVE-2023-41878 State: PUBLISHED Published: 2023-09-26T22:53:27.060Z Last Updated: 2024-09-23T19:26:22.214Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: metersphere Products: metersphere Problem Types: CWE-798 Description: MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance testing. The Selenium VNC config used in Metersphere is using a weak password by default, attackers can login to vnc and obtain high permissions. This issue has been addressed in version 2.10.7 LTS. Users are advised to upgrade. There are no known workarounds for this vulnerabi
as been addressed in version 2.10.7 LTS. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/metersphere/metersphere/security/advisories/GHSA-88vv-6rm4-59h9 - https://github.com/metersphere/installer/commit/02dd31c0951a225eaad99eda560e3eb91ba3001d
CVE ID: CVE-2023-41879 State: PUBLISHED Published: 2023-09-11T21:14:28.597Z Last Updated: 2024-09-26T16:55:58.992Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: OpenMage Products: magento-lts Problem Types: CWE-330 Description: Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protect_code". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-force attack. Exposing each order would require a separate brute force attack. This issue has been patched in versions 19.5.1 and 20.1.1. Additional Analyst Notes: - CVE Program Co
rute force attack. This issue has been patched in versions 19.5.1 and 20.1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenMage/magento-lts/security/advisories/GHSA-9358-cpvx-c2qp - https://github.com/OpenMage/magento-lts/commit/2a2a2fb504247e8966f8ffc2e17d614be5d43128 - https://github.com/OpenMage/magento-lts/commit/31e74ac5d670b10001f88f038046b62367f15877 - https://github.com/OpenMage/magento-lts/releases/tag/v19.5.1 - https://github.com/OpenMage/magento-lts/releases/tag/v20.1.1
CVE ID: CVE-2023-41880 State: PUBLISHED Published: 2023-09-15T19:43:41.850Z Last Updated: 2024-09-24T18:13:31.648Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: bytecodealliance Products: wasmtime Problem Types: CWE-193 Description: Wasmtime is a standalone runtime for WebAssembly. Wasmtime versions from 10.0.0 to versions 10.02, 11.0.2, and 12.0.1 contain a miscompilation of the WebAssembly `i64x2.shr_s` instruction on x86_64 platforms when the shift amount is a constant value that is larger than 32. Only x86_64 is affected so all other targets are not affected by this. The miscompilation results in the instruction producing an incorrect result, namely the l
gets are not affected by this. The miscompilation results in the instruction producing an incorrect result, namely the low 32-bits of the second lane of the vector are derived from the low 32-bits of the second lane of the input vector instead of the high 32-bits. The primary impact of this issue is that any WebAssembly program using the `i64x2.shr_s` with a constant shift amount larger than 32 may produce an incorrect result. This issue is not an escape from the WebAssembly sandbox. Execution of WebAssembly guest programs will still behave correctly with respect to memory sandboxing and isolation from the host. Wasmtime considers non-spec-compliant behavior as a security issue nonetheless.
sandboxing and isolation from the host. Wasmtime considers non-spec-compliant behavior as a security issue nonetheless. This issue was discovered through fuzzing of Wasmtime's code generator Cranelift. Wasmtime versions 10.0.2, 11.0.2, and 12.0.2 are all patched to no longer have this miscompilation. This issue only affects x86_64 hosts and the only workaround is to either scan for this pattern in wasm modules which is nontrivial or to disable the SIMD proposal for WebAssembly. Users prior to 10.0.0 are unaffected by this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bytecodealliance/wasmtime/security/advisories/GH
am Container: - CISA ADP Vulnrichment: References: - https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gw5p-q8mj-p7gh - https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gw5p-q8mj-p7gh#:~:text=Mailing%20list%20announcement - https://github.com/bytecodealliance/wasmtime/pull/6372 - https://github.com/bytecodealliance/wasmtime/commit/8d7eda15b0badcbea83a7aac2d08f80788b59240 - https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.wasm_simd