Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-52026 State: PUBLISHED Published: 2024-01-12T00:00:00.000Z Last Updated: 2025-06-11T16:56:32.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOlink EX1800T V9.1.0cu.2112_B20220316 was discovered to contain a remote command execution (RCE) vulnerability via the telnet_enabled parameter of the setTelnetCfg interface Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://815yang.github.io/2023/12/11/EX1800T/2/TOTOlinkEX1800T_V9.1.0cu.2112_B2022031setTelnetCfg/
CVE ID: CVE-2023-52027 State: PUBLISHED Published: 2024-01-11T00:00:00.000Z Last Updated: 2025-06-17T15:12:00.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the NTPSyncWithHost function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://815yang.github.io/2023/12/23/a3700r/TOTOLINKA3700R_NTPSyncWithHost/
CVE ID: CVE-2023-52028 State: PUBLISHED Published: 2024-01-11T00:00:00.000Z Last Updated: 2025-06-20T16:33:09.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the setTracerouteCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://815yang.github.io/2023/12/04/a3700r/TOTOlink%20A3700R_setTracerouteCfg/
CVE ID: CVE-2023-52029 State: PUBLISHED Published: 2024-01-11T00:00:00.000Z Last Updated: 2025-06-20T16:33:48.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the setDiagnosisCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://815yang.github.io/2023/12/04/a3700r/TOTOlink%20A3700R%28setDiagnosisCfg%29/
CVE ID: CVE-2023-52030 State: PUBLISHED Published: 2024-01-11T00:00:00.000Z Last Updated: 2025-05-14T19:36:05.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the setOpModeCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://815yang.github.io/2023/12/04/a3700r/TOTOlink%20A3700R%28setOpModeCfg%29/
CVE ID: CVE-2023-52031 State: PUBLISHED Published: 2024-01-11T00:00:00.000Z Last Updated: 2025-06-03T14:26:05.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the UploadFirmwareFile function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://815yang.github.io/2023/12/04/a3700r/TOTOlink%20A3700R_UploadFirmwareFile/
CVE ID: CVE-2023-52032 State: PUBLISHED Published: 2024-01-11T00:00:00.000Z Last Updated: 2025-06-17T14:41:03.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOlink EX1200T V4.1.2cu.5232_B20210713 was discovered to contain a remote command execution (RCE) vulnerability via the "main" function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://815yang.github.io/2023/12/24/cve6/EX1200T_V4.1.2cu.5232_B20210713_downloadFlile/
CVE ID: CVE-2023-52038 State: PUBLISHED Published: 2024-01-24T00:00:00.000Z Last Updated: 2025-05-30T14:17:14.075Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415C80 function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Beckaf/vunl/blob/main/TOTOLINK/X6000R/1/1.md
CVE ID: CVE-2023-52039 State: PUBLISHED Published: 2024-01-24T00:00:00.000Z Last Updated: 2025-05-30T14:17:08.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415AA4 function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Beckaf/vunl/blob/main/TOTOLINK/X6000R/2/2.md
CVE ID: CVE-2023-52040 State: PUBLISHED Published: 2024-01-24T00:00:00 Last Updated: 2024-08-02T22:48:12.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_41284C function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Beckaf/vunl/blob/main/TOTOLINK/X6000R/3/3.md
CVE ID: CVE-2023-52041 State: PUBLISHED Published: 2024-01-16T00:00:00.000Z Last Updated: 2025-06-17T13:53:12.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary code via the sub_410118 function of the shttpd program. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kee02p.github.io/2024/01/13/CVE-2023-52041/
CVE ID: CVE-2023-52042 State: PUBLISHED Published: 2024-01-16T00:00:00 Last Updated: 2024-08-30T19:03:52.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in sub_4117F8 function in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the 'lang' parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kee02p.github.io/2024/01/13/CVE-2023-52042/
CVE ID: CVE-2023-52043 State: PUBLISHED Published: 2024-04-03T00:00:00 Last Updated: 2024-09-06T16:33:10.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in D-Link COVR 1100, 1102, 1103 AC1200 Dual-Band Whole-Home Mesh Wi-Fi System (Hardware Rev B1) truncates Wireless Access Point Passwords (WPA-PSK) allowing an attacker to gain unauthorized network access via weak authentication controls. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://exploots.github.io/posts/2024/01/18/d-link-covr-1102-vulnerability.html
CVE ID: CVE-2023-52044 State: PUBLISHED Published: 2024-10-31T00:00:00 Last Updated: 2024-11-01T15:43:38.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no restriction for uploading files with the .php8 extension. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Studio-42/elFinder/issues/3615
CVE ID: CVE-2023-52045 State: PUBLISHED Published: 2024-10-31T00:00:00 Last Updated: 2024-11-01T17:16:55.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: Studio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting (XSS) vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Studio-42/elFinder/issues/3617
CVE ID: CVE-2023-52046 State: PUBLISHED Published: 2024-01-25T00:00:00.000Z Last Updated: 2025-05-30T14:15:54.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability (XSS) in webmin v.2.105 and earlier allows a remote attacker to execute arbitrary code via a crafted payload to the "Execute cron job as" tab Input field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Acklee/webadmin_xss/blob/main/xss.md
CVE ID: CVE-2023-52047 State: PUBLISHED Published: 2024-02-28T00:00:00 Last Updated: 2024-08-13T20:06:58.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dedecms v5.7.112 was discovered to contain a Cross-Site Request Forgery (CSRF) in the file manager. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/chongfujun/test/blob/main/2023-52047.docx
CVE ID: CVE-2023-52048 State: PUBLISHED Published: 2024-02-28T00:00:00 Last Updated: 2024-11-26T15:45:37.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: RuoYi v4.7.8 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/notice/. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/chongfujun/test/blob/main/2023-52048.docx
CVE ID: CVE-2023-52059 State: PUBLISHED Published: 2024-02-13T00:00:00.000Z Last Updated: 2025-05-09T18:16:08.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Gestsup v3.2.46 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description text field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gestsup.fr/index.php?page=download&channel=beta&version=3.2.46&type=patch - https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2023-52059/README.md
CVE ID: CVE-2023-52060 State: PUBLISHED Published: 2024-02-13T00:00:00.000Z Last Updated: 2025-03-13T19:58:38.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in Gestsup v3.2.46 allows attackers to arbitrarily edit user profile information via a crafted request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gestsup.fr/index.php?page=download&channel=beta&version=3.2.46&type=patch - https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2023-52060/README.md
CVE ID: CVE-2023-52064 State: PUBLISHED Published: 2024-01-10T00:00:00.000Z Last Updated: 2025-06-03T14:28:35.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the $keywords parameter at /core/admin/copyfrom.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wuzhicms/wuzhicms/issues/208 - https://gist.github.com/n0Sleeper/544b38c95715b13efadab329692c8aea
CVE ID: CVE-2023-52066 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-11-04T19:02:58.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: http.zig commit 76cf5 was discovered to contain a CRLF injection vulnerability via the url parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/karlseguin/http.zig/issues/25
CVE ID: CVE-2023-52068 State: PUBLISHED Published: 2024-01-16T00:00:00.000Z Last Updated: 2025-06-17T15:11:10.928Z Vendors: n/a Products: n/a Problem Types: n/a Description: kodbox v1.43 was discovered to contain a cross-site scripting (XSS) vulnerability via the operation and login logs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.mo60.cn/index.php/archives/Kodbox_Stored_Xss.html_Password_Kodbox_Stored_Xss1
CVE ID: CVE-2023-52069 State: PUBLISHED Published: 2024-01-17T00:00:00.000Z Last Updated: 2025-06-02T15:06:47.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: kodbox v1.49.04 was discovered to contain a cross-site scripting (XSS) vulnerability via the URL parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.mo60.cn/index.php/archives/Kodbox_Stored_Xss_2.html_Password_Xss_2 - https://blog.mo60.cn/index.php/archives/Kodbox_Stored_Xss_2.html
CVE ID: CVE-2023-52070 State: PUBLISHED Published: 2024-04-10T00:00:00 Last Updated: 2024-08-16T15:10:09.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the 'setSeriesNeedle(int index, int type)' method. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://jfreechart.com - http://jfreeorg.com - https://gist
CVE Program Container: - CISA ADP Vulnrichment: References: - http://jfreechart.com - http://jfreeorg.com - https://gist.github.com/LLM4IG/f55de46e65fb5a19b7815adb36fd858b
CVE ID: CVE-2023-52071 State: REJECTED Published: N/A Last Updated: 2024-02-23T08:12:51.640297 Description: No description available.
CVE ID: CVE-2023-52072 State: PUBLISHED Published: 2024-01-08T00:00:00.000Z Last Updated: 2025-04-17T18:29:15.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/userconfig_updagte. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zouyang0714/cms/blob/main/2.md
CVE ID: CVE-2023-52073 State: PUBLISHED Published: 2024-01-08T00:00:00.000Z Last Updated: 2025-06-03T14:39:06.345Z Vendors: n/a Products: n/a Problem Types: n/a Description: FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/config_footer_updagte. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zouyang0714/cms/blob/main/3.md
CVE ID: CVE-2023-52074 State: PUBLISHED Published: 2024-01-08T00:00:00.000Z Last Updated: 2025-06-13T16:06:38.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component system/site/webconfig_updagte. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zouyang0714/cms/blob/main/1.md
CVE ID: CVE-2023-52075 State: PUBLISHED Published: 2023-12-27T19:49:39.515Z Last Updated: 2024-09-09T17:58:49.149Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ReVanced Products: revanced-api Problem Types: CWE-755 Description: ReVanced API proxies requests needed to feed the ReVanced Manager and website with data. Up to and including commit 71f81f7f20cd26fd707335bca9838fa3e7df20d2, ReVanced API lacks error caching causing rate limit to be triggered thus increasing server load. This causes a denial of service for all users using the API. It is recommended to implement proper error caching. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnri
t is recommended to implement proper error caching. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ReVanced/revanced-api/security/advisories/GHSA-852x-grxp-8p3q
CVE ID: CVE-2023-52076 State: PUBLISHED Published: 2024-01-25T15:30:12.398Z Last Updated: 2025-06-17T21:19:29.316Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L) Vendors: mate-desktop Products: atril Problem Types: CWE-24, CWE-25, CWE-27, CWE-22 Description: Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite
r opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mate-desktop/atril/security/advisories/GHSA-6mf6-mxpc-jc37 - https://github.com/mate-desktop/atril/commit/e70b21c815418a1e6ebedf6d8d31b8477c03ba50 - https://github.com/mate-desktop/atril/releases/tag/v1.26.2 - https://lists.debian.org/debian-lts-announce/2024/06/msg00003.html
CVE ID: CVE-2023-52077 State: PUBLISHED Published: 2023-12-27T18:45:50.408Z Last Updated: 2024-08-02T22:48:12.128Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: nexryai Products: nexkey Problem Types: CWE-863 Description: Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs. This allows malicious third-party apps to perform operations such as updating server settings, as well as compromise object storage and email server credentials. This issue has been patched in 12.23Q4.5. Additional Analyst Notes: - CVE
e object storage and email server credentials. This issue has been patched in 12.23Q4.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nexryai/nexkey/security/advisories/GHSA-pjj7-7hcj-9cpc - https://github.com/mei23/misskey-v12/commit/78173e376f14fcc1987b02196f5538bf5b18225c - https://github.com/misskey-dev/misskey/commit/5150053275594278e9eb23e72d98b16593c4c230 - https://github.com/nexryai/nexkey/commit/a4e4c9c47c5f84ec7ccd309bde59d4ae5d7e5a98
CVE ID: CVE-2023-52079 State: PUBLISHED Published: 2023-12-28T15:20:20.728Z Last Updated: 2024-08-27T14:59:13.839Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: kriszyp Products: msgpackr Problem Types: CWE-674, CWE-754 Description: msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1. Exploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitig
the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kriszyp/msgpackr/security/advisories/GHSA-7hpj-7hhx-2fgx - https://github.com/kriszyp/msgpackr/commit/18f44f8800e2261341cdf489d1ba1e35a0133602
CVE ID: CVE-2023-52080 State: PUBLISHED Published: 2024-04-29T00:00:00 Last Updated: 2024-08-02T22:48:12.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: IEIT NF5280M6 UEFI firmware through 8.4 has a pool overflow vulnerability, caused by improper use of the gRT->GetVariable() function. Attackers with access to local NVRAM variables can exploit this by modifying these variables on SPI Flash, resulting in memory data being tampered with. When critical data in memory data is tampered with,a crash may occur. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://ieisystem.com - https://support.ieisystem.com/lcjtww/psirt/security-advisori
VE Program Container: References: - https://ieisystem.com - https://support.ieisystem.com/lcjtww/psirt/security-advisories/2751271/index.html
CVE ID: CVE-2023-52081 State: PUBLISHED Published: 2023-12-28T15:34:17.132Z Last Updated: 2024-08-02T22:48:12.133Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: ewen-lbh Products: ffcss Problem Types: CWE-176, CWE-74 Description: ffcss is a CLI interface to apply and configure Firefox CSS themes. Prior to 0.2.0, the function `lookupPreprocess()` is meant to apply some transformations to a string by disabling characters in the regex `[-_ .]`. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex `[-_ .]`. The `lookupPreprocess()` can be easily bypassed wi
validation and re-introduce all the characters in the regex `[-_ .]`. The `lookupPreprocess()` can be easily bypassed with equivalent Unicode characters like U+FE4D (﹍), which would result in the omitted U+005F (_), for instance. The `lookupPreprocess()` function is only ever used to search for themes loosely (case insensitively, while ignoring dashes, underscores and dots), so the actual security impact is classified as low. This vulnerability is fixed in 0.2.0. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ewen-lbh/ffcss/security/advisories/GHSA-wpmx-564x-h2mh - https://github.com/ewen-lbh/ffcss/commit/f9c491874b858a32fc
com/ewen-lbh/ffcss/security/advisories/GHSA-wpmx-564x-h2mh - https://github.com/ewen-lbh/ffcss/commit/f9c491874b858a32fcae15045f169fd7d02f90dc
CVE ID: CVE-2023-52082 State: PUBLISHED Published: 2023-12-28T15:46:24.291Z Last Updated: 2024-11-27T15:32:17.641Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: LycheeOrg Products: Lychee Problem Types: CWE-89 Description: Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the `.env` settings set to DB_LOG_SQL=true and DB_LOG_SQL_EXPLAIN=true. The defaults settings of Lychee are safe. The patch is provided on version 5.0.2. To work around this issue, disable SQL EXPLAIN logging. Additional Analyst Notes: - CVE Program Container:
ersion 5.0.2. To work around this issue, disable SQL EXPLAIN logging. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-rjwv-5j3m-p5x4 - https://github.com/LycheeOrg/Lychee/commit/33354a2ce7cf700cc4ee537b7b8b94dfc1e84ad4
CVE ID: CVE-2023-52083 State: PUBLISHED Published: 2023-12-28T22:11:55.494Z Last Updated: 2024-08-02T22:48:12.132Z Severity: LOW (CVSS 2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: wintercms Products: winter Problem Types: CWE-79 Description: Winter is a free, open-source content management system. Prior to 1.2.4, users with the `media.manage_media` permission can upload files to the Media Manager and rename them after uploading. Previously, media manager files were only sanitized on upload, not on renaming, which could have allowed a stored XSS attack. This issue has been patched in v1.2.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/winter
e has been patched in v1.2.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wintercms/winter/security/advisories/GHSA-4wvw-75qh-fqjp - https://github.com/wintercms/winter/commit/2969daeea8dee64d292dbaa3778ea251e2a7e491
CVE ID: CVE-2023-52084 State: PUBLISHED Published: 2023-12-28T22:15:59.952Z Last Updated: 2025-04-17T20:27:13.689Z Severity: LOW (CVSS 2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: wintercms Products: winter Problem Types: CWE-79 Description: Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be rendered unescaped in the backend form, potentially allowing for a stored XSS attack. This issue has been patched in v1.2.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wintercms/winter/security/a
st Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wintercms/winter/security/advisories/GHSA-43w4-4j3c-jx29 - https://github.com/wintercms/winter/commit/517f65dfae679b57575b047de13c5af48915a5ba