Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
am Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/34712 - https://lists.apache.org/thread/sy4l5d6tn58hr8r61r2fkt1f0qock9z9 - http://www.openwall.com/lists/oss-security/2023/10/23/2
CVE ID: CVE-2023-45349 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-09-19T15:39:47.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.34.7, 4000 Assistant V10 R1.42.0, 4000 Assistant V10 R0, 4000 Manager V10 R1 before V10 R1.34.7, 4000 Manager V10 R1.42.0, and 4000 Manager V10 R0 expose sensitive information that may allow lateral movement to the backup system via AShbr. This is also known as OSFOURK-23722. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://networks.unify.com/security/advisories/OBSO-2306-01.pdf - https://www.news.de/technik/856969401/uni
eferences: - https://networks.unify.com/security/advisories/OBSO-2306-01.pdf - https://www.news.de/technik/856969401/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/
CVE ID: CVE-2023-45350 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-09-19T15:39:01.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: Atos Unify OpenScape 4000 Manager V10 R1 before V10 R1.42.1 and 4000 Manager V10 R0 allow Privilege escalation that may lead to the ability of an authenticated attacker to run arbitrary code via AScm. This is also known as OSFOURK-24034. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://networks.unify.com/security/advisories/OBSO-2306-01.pdf - https://www.news.de/technik/856969401/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstelle
de/technik/856969401/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/
CVE ID: CVE-2023-45351 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-09-19T15:38:06.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.1, 4000 Assistant V10 R0, 4000 Manager V10 R1 before V10 R1.42.1, and 4000 Manager V10 R0 allow Authenticated Command Injection via AShbr. This is also known as OSFOURK-24039. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://networks.unify.com/security/advisories/OBSO-2306-01.pdf - https://www.news.de/technik/856969401/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-
/technik/856969401/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/
CVE ID: CVE-2023-45352 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-09-19T15:37:05.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated attacker to execute arbitrary code on the operating system via a Common Management Portal web interface Path traversal vulnerability allowing write access outside the intended folders. This is also known as OCMP-6592. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://networks.unify.com/security/advisories/OBSO-2306-02.pdf - https://www.news.de/technik/857003738/unify-opens
s: - https://networks.unify.com/security/advisories/OBSO-2306-02.pdf - https://www.news.de/technik/857003738/unify-openscape-common-management-platform-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-update-zu-bekannten-schwachstellen-und-sicherheitsluecken-vom-03-07-2023/1/
CVE ID: CVE-2023-45353 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-09-19T15:32:43.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated attacker to execute arbitrary code on the operating system by leveraging the Common Management Portal web interface for Authenticated remote upload and creation of arbitrary files affecting the underlying operating system. This is also known as OCMP-6591. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://networks.unify.com/security/advisories/OBSO-2306-02.pdf - https://www
er: - CISA ADP Vulnrichment: References: - https://networks.unify.com/security/advisories/OBSO-2306-02.pdf - https://www.news.de/technik/857003738/unify-openscape-common-management-platform-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-update-zu-bekannten-schwachstellen-und-sicherheitsluecken-vom-03-07-2023/1/
CVE ID: CVE-2023-45354 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-09-19T15:30:45.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated remote attacker to execute arbitrary code on the operating system by using the Common Management Portal web interface. This is also known as OCMP-6589. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://networks.unify.com/security/advisories/OBSO-2306-02.pdf - https://www.news.de/technik/857003738/unify-openscape-common-management-platform-gefaehrdet-it-sicherheitswarnung-v
df - https://www.news.de/technik/857003738/unify-openscape-common-management-platform-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-update-zu-bekannten-schwachstellen-und-sicherheitsluecken-vom-03-07-2023/1/
CVE ID: CVE-2023-45355 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-09-19T15:37:46.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 and 4000 and Manager Platform V10 R1 before Hotfix V10 R1.42.2 allow command injection by an authenticated attacker into the platform operating system, leading to administrative access via the webservice. This is also known as OSFOURK-24120. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://networks.unify.com/security/advisories/OBSO-2308-02.pdf - https://www.news.de/technik/857079218/unify-openscape-4000-gefaeh
works.unify.com/security/advisories/OBSO-2308-02.pdf - https://www.news.de/technik/857079218/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-betroffene-systeme-und-produkte-neue-versionen-und-updates/1/
CVE ID: CVE-2023-45356 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-09-19T18:15:15.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 4000 and Manager Platform V10 R1 before Hotfix V10 R1.42.2 allow command injection by an authenticated attacker into the platform operating system, leading to administrative access, via dtb pages of the platform portal. This is also known as OSFOURK-23719. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://networks.unify.com/security/advisories/OBSO-2308-02.pdf - https://www.news.de/technik/857079218/unify-opensc
: - https://networks.unify.com/security/advisories/OBSO-2308-02.pdf - https://www.news.de/technik/857079218/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-betroffene-systeme-und-produkte-neue-versionen-und-updates/1/
CVE ID: CVE-2023-45357 State: PUBLISHED Published: 2023-10-17T00:00:00 Last Updated: 2024-09-16T15:05:17.547Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a sensitive information disclosure vulnerability. An authenticated attacker could potentially obtain access to sensitive information via a popup warning message. 6.14 (6.14.0) is also a fixed release. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/
References: - https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/708617
CVE ID: CVE-2023-45358 State: PUBLISHED Published: 2023-10-17T00:00:00 Last Updated: 2024-09-16T15:02:46.212Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:L/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.14 (6.14.0) is
sers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.14 (6.14.0) is also a fixed release. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/708617
CVE ID: CVE-2023-45359 State: PUBLISHED Published: 2024-10-09T00:00:00 Last Updated: 2024-10-09T21:40:04.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-toc-toggle-button-label is not escaped, but should be, because the line param can have markup. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T340217 - https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/skins/Vector/+/c17b956e0750e051ac7c1098e3ff625f0db82b2c
CVE ID: CVE-2023-45360 State: PUBLISHED Published: 2023-11-03T00:00:00.000Z Last Updated: 2025-11-04T17:12:44.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is XSS in youhavenewmessagesmanyusers and youhavenewmessages i18n messages. This is related to MediaWiki:Youhavenewmessagesfromusers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://phabricator.wikimedia.org/T340221 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/
CVE ID: CVE-2023-45361 State: PUBLISHED Published: 2024-10-09T00:00:00.000Z Last Updated: 2025-03-13T20:13:31.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in VectorComponentUserLinks.php in the Vector Skin component in MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-intro-page MalformedTitleException is uncaught if it is not a valid title, leading to incorrect web pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T340220 - https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/skins/Vector/+/2a452b7e2562cba32b8a17bc91dc5abb531f0a1c
CVE ID: CVE-2023-45362 State: PUBLISHED Published: 2023-11-03T00:00:00.000Z Last Updated: 2025-11-04T17:12:46.030Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DifferenceEngine.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. diff-multi-sameuser (aka "X intermediate revisions by the same user not shown") ignores username suppression. This is an information leak. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T341529 - https://lists.debian.org/debian-lts-announce/2023/11/msg00027.html - https://lists.fedoraproject.org/archives/list/package-announce%40list
an.org/debian-lts-announce/2023/11/msg00027.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/
CVE ID: CVE-2023-45363 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-10-15T18:00:10.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to cause a denial of service (unbounded loop and RequestTimeoutException) when querying pages redirected to other variants with redirects and converttitles set. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T333050 - https://www.debian.org/security/2023/dsa-5520 - https://lists.debian.org/debian-lt
//phabricator.wikimedia.org/T333050 - https://www.debian.org/security/2023/dsa-5520 - https://lists.debian.org/debian-lts-announce/2023/11/msg00027.html
CVE ID: CVE-2023-45364 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-09-19T18:14:01.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1. Deleted revision existence is leaked due to incorrect permissions being checked. This reveals that a given revision ID belonged to the given page title, and its timestamp, both of which are not supposed to be public information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T264765 - https://www.debian.org/security/2023/dsa
ISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T264765 - https://www.debian.org/security/2023/dsa-5520
CVE ID: CVE-2023-45367 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-09-19T18:04:49.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the CheckUser extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. A user can use a rest.php/checkuser/v0/useragent-clienthints/revision/ URL to store an arbitrary number of rows in cu_useragent_clienthints, leading to a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T344923
CVE ID: CVE-2023-45369 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-09-19T18:02:39.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the PageTriage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. Usernames of hidden users are exposed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T344359 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/PageTriage/+/960676
CVE ID: CVE-2023-45370 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-09-19T17:58:01.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. SportsTeams: Special:SportsManagerLogo and Special:SportsTeamsManagerLogo do not check for the sportsteamsmanager user right, and thus an attacker may be able to affect pages that are concerned with sports teams. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T345680 - https://gerrit.wikimedia.org/r/c/media
CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T345680 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/SportsTeams/+/959699/
CVE ID: CVE-2023-45371 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-09-19T17:54:27.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is no rate limit for merging items. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T345064 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/961264
CVE ID: CVE-2023-45372 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-09-19T17:50:13.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running (e.g., AbuseFilter). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T345064 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/961264
CVE ID: CVE-2023-45373 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-09-19T17:45:59.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the ProofreadPage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. XSS can occur via formatNumNoSeparators. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T345693 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/ProofreadPage/+/961262
CVE ID: CVE-2023-45374 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-09-19T17:45:18.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It does not check for the anti-CSRF edit token in Special:SportsTeamsManager and Special:UpdateFavoriteTeams. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T345040 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/SportsTeams/+/952552/
CVE ID: CVE-2023-45375 State: PUBLISHED Published: 2023-10-17T00:00:00 Last Updated: 2024-09-16T14:56:01.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "PireosPay" (pireospay) before version 1.7.10 from 01generator.com for PrestaShop, a guest can perform SQL injection via `PireosPayValidationModuleFrontController::postProcess().` Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2023/10/12/pireospay.html
CVE ID: CVE-2023-45376 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-09-13T14:31:58.033Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Carousels Pack - Instagram, Products, Brands, Supplier" (hicarouselspack) for PrestaShop up to version 1.5.0 from HiPresta for PrestaShop, a guest can perform SQL injection via HiCpProductGetter::getViewedProduct().` Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://addons.prestashop.com/en/sliders-galleries/20410-carousels-pack-instagram-products-brands-supplier.html - https://security.friendsofpresta.org/modules/2023/10/19/hicarouselspack.html
CVE ID: CVE-2023-45377 State: PUBLISHED Published: 2023-11-22T00:00:00.000Z Last Updated: 2025-06-10T13:41:06.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Chronopost Official" (chronopost) for PrestaShop, a guest can perform SQL injection. The script PHP `cancelSkybill.php` own a sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://addons.prestashop.com/fr/transporteurs/19561-chronopost-officiel.html - https://security.friendsofpresta.org/modules/2023/11/21/chronopost.html
CVE ID: CVE-2023-45378 State: PUBLISHED Published: 2023-10-31T00:00:00 Last Updated: 2024-09-05T19:57:29.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "PrestaBlog" (prestablog) version 4.4.7 and before from HDclic for PrestaShop, a guest can perform SQL injection. The script ajax slider_positions.php has a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2023/10/26/prestablog.html
CVE ID: CVE-2023-45379 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-09-13T14:30:50.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Rotator Img" (posrotatorimg) in versions at least up to 1.1 from PosThemes for PrestaShop, a guest can perform SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://posrotatorimg.com - https://security.friendsofpresta.org/modules/2023/10/17/posrotatorimg.html
CVE ID: CVE-2023-45380 State: PUBLISHED Published: 2023-11-07T00:00:00 Last Updated: 2024-09-05T14:30:05.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Order Duplicator " Clone and Delete Existing Order" (orderduplicate) in version <= 1.1.7 from Silbersaiten for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can download personal information from ps_customer/ps_address tables such as name / surname / phone number / full postal address. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2023/11/07/orderdup
ogram Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2023/11/07/orderduplicate.html
CVE ID: CVE-2023-45381 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-09-12T19:44:36.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Creative Popup" (creativepopup) up to version 1.6.9 from WebshopWorks for PrestaShop, a guest can perform SQL injection via `cp_download_popup().` Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://addons.prestashop.com/fr/pop-up/39348-creative-popup.html - https://security.friendsofpresta.org/modules/2023/10/19/creativepopup.html
CVE ID: CVE-2023-45382 State: PUBLISHED Published: 2023-11-17T00:00:00 Last Updated: 2024-08-12T14:07:50.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "SoNice Retour" (sonice_retour) up to version 2.1.0 from Common-Services for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a guest can perform a path traversal to view all files on the information system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://common-services.com/fr/home-fr/ - https://security.friend
gram Container: - CISA ADP Vulnrichment: References: - https://common-services.com/fr/home-fr/ - https://security.friendsofpresta.org/modules/2023/11/16/sonice_retour.html
CVE ID: CVE-2023-45383 State: PUBLISHED Published: 2023-10-18T00:00:00 Last Updated: 2024-09-13T17:51:11.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "SoNice etiquetage" (sonice_etiquetage) up to version 2.5.9 from Common-Services for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a guest can perform a path traversal to view all files on the information system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://common-services.com/fr/home-fr/ - https://securit