Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-249257 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.249257 - https://vuldb.com/?ctiid.249257 - https://modzero.com/en/advisories/mz-23-01-poly-voip/ - https://support.hp.com/us-en/document/ish_9931565-9931594-16/hpsbpy03898 - https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices - https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html
CVE ID: CVE-2023-4465 State: PUBLISHED Published: 2023-12-29T09:37:59.607Z Last Updated: 2024-08-02T07:31:05.490Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: Poly Products: Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CCX 700, EDGE E100, EDGE E220, EDGE E300, EDGE E320, EDGE E350, EDGE E400, EDGE E450, EDGE E500, EDGE E550, VVX 101, VVX 150, VVX 201, VVX 250, VVX 300, VVX 301, VVX 310, VVX 311, VVX 350, VVX 400, VVX 401, VVX 410, VVX 411, VVX 450, VVX 500, VVX 501, VVX 600, VVX 601 Problem Types: CWE-620 Description: A vulnerability, which was classified as problematic, was found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CC
n: A vulnerability, which was classified as problematic, was found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CCX 700, EDGE E100, EDGE E220, EDGE E300, EDGE E320, EDGE E350, EDGE E400, EDGE E450, EDGE E500, EDGE E550, VVX 101, VVX 150, VVX 201, VVX 250, VVX 300, VVX 301, VVX 310, VVX 311, VVX 350, VVX 400, VVX 401, VVX 410, VVX 411, VVX 450, VVX 500, VVX 501, VVX 600 and VVX 601. Affected is an unknown function of the component Configuration File Import. The manipulation of the argument device.auth.localAdminPassword leads to unverified password change. It is possible to launch the attack remotely. The exploit has been disclosed to the pub
s to unverified password change. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249258 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.249258 - https://vuldb.com/?ctiid.249258 - https://modzero.com/en/advisories/mz-23-01-poly-voip/ - https://support.hp.com/us-en/document/ish_9929371-9929407-16/hpsbpy03899 - https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices - https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html
CVE ID: CVE-2023-4466 State: PUBLISHED Published: 2023-12-29T09:38:01.706Z Last Updated: 2024-08-02T07:31:05.363Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: Poly Products: CCX 400, CCX 600, Trio 8800, Trio C60 Problem Types: CWE-693 Description: A vulnerability has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Web Interface. The manipulation leads to protection mechanism failure. The attack can be launched remotely. The vendor explains that they do not regard this as a vulnerability as this is a feature that they offer to their customers who have a variet
hat they do not regard this as a vulnerability as this is a feature that they offer to their customers who have a variety of environmental needs that are met through different firmware builds. To avoid potential roll-back attacks, they remove vulnerable builds from the public servers as a remediation effort. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249259. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.249259 - https://vuldb.com/?ctiid.249259 - https://modzero.com/en/advisories/mz-23-01-poly-voip/ - https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices - https://fahrplan.events
.com/en/advisories/mz-23-01-poly-voip/ - https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices - https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html
CVE ID: CVE-2023-4467 State: PUBLISHED Published: 2023-12-29T09:38:03.884Z Last Updated: 2024-08-02T07:31:05.430Z Severity: N/A (CVSS 6.5 AV:L/AC:L/Au:M/C:C/I:C/A:C) Vendors: Poly Products: Trio 8800 Problem Types: CWE-912 Description: A vulnerability was found in Poly Trio 8800 7.2.6.0019 and classified as critical. Affected by this issue is some unknown functionality of the component Test Automation Mode. The manipulation leads to backdoor. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249260. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.
ier of this vulnerability is VDB-249260. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.249260 - https://vuldb.com/?ctiid.249260 - https://modzero.com/en/advisories/mz-23-01-poly-voip/ - https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices - https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html
CVE ID: CVE-2023-4468 State: PUBLISHED Published: 2023-12-29T09:38:05.716Z Last Updated: 2024-08-02T07:31:05.502Z Severity: N/A (CVSS 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P) Vendors: Poly Products: Trio 8500, Trio 8800, Trio C60 Problem Types: CWE-862 Description: A vulnerability was found in Poly Trio 8500, Trio 8800 and Trio C60. It has been classified as problematic. This affects an unknown part of the component Poly Lens Management Cloud Registration. The manipulation leads to missing authorization. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier VDB-249261 was assigned to this vulnerability. Additional Anal
n disclosed to the public and may be used. The identifier VDB-249261 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.249261 - https://vuldb.com/?ctiid.249261 - https://modzero.com/en/advisories/mz-23-01-poly-voip/ - https://support.hp.com/us-en/document/ish_9929447-9929472-16/hpsbpy03902 - https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices - https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html
CVE ID: CVE-2023-4469 State: PUBLISHED Published: 2023-10-06T09:31:01.280Z Last Updated: 2025-02-05T19:17:05.703Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: bestwebsoft Products: Profile Extra Fields by BestWebSoft Problem Types: CWE-862 Missing Authorization Description: The Profile Extra Fields by BestWebSoft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the prflxtrflds_export_file function in versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to expose potentially sensitive user data, including data entered into custom fields. Additional Analyst Notes: -
ckers to expose potentially sensitive user data, including data entered into custom fields. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/916c73e8-a150-4b35-8773-ea0ec29f7fd1?source=cve - https://plugins.trac.wordpress.org/changeset/2975179/profile-extra-fields
CVE ID: CVE-2023-4471 State: PUBLISHED Published: 2023-08-31T05:33:14.958Z Last Updated: 2025-02-05T19:31:58.458Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: rustaurius Products: Order Tracking – WordPress Status Tracking Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the start_date and end_date parameters in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web s
t input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ed64d0ff-4f49-4c18-86ec-2c6fbd559d2e?source=cve - https://plugins.trac.wordpress.org/browser/order-tracking/trunk/includes/Export.class.php#L158 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2959453%40order-tracking%2Ftrunk&old=2949611%40order-tracking%2Ftrunk&sfp_email=&sf
?sfp_email=&sfph_mail=&reponame=&new=2959453%40order-tracking%2Ftrunk&old=2949611%40order-tracking%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-4472 State: PUBLISHED Published: 2024-02-01T22:11:21.361Z Last Updated: 2025-06-11T16:45:41.501Z Vendors: Objectplanet Products: Opinio Problem Types: CWE-335 Description: Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.objectplanet.com/opinio/changelog.html - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2024/MNDT-2024-0002.md
CVE ID: CVE-2023-4473 State: PUBLISHED Published: 2023-11-30T01:40:09.117Z Last Updated: 2025-02-13T17:13:42.026Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: NAS326 firmware, NAS542 firmware Problem Types: CWE-78 Description: A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/s
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products - https://bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/
CVE ID: CVE-2023-4474 State: PUBLISHED Published: 2023-11-30T01:45:29.920Z Last Updated: 2025-02-13T17:13:42.559Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: NAS326 firmware, NAS542 firmware Problem Types: CWE-78 Description: The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zyxel.com/glob
ce. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products - https://bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/
CVE ID: CVE-2023-4475 State: PUBLISHED Published: 2023-08-22T09:02:30.376Z Last Updated: 2024-10-02T20:02:50.949Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: ASUSTOR Products: ADM Problem Types: CWE-552 Description: An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master (ADM) allows an attacker to exploit the file renaming feature to move files to unintended directories. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.asustor.com/security/security_advisory_detail?id=30
CVE ID: CVE-2023-4476 State: PUBLISHED Published: 2023-09-25T15:56:56.519Z Last Updated: 2025-04-23T16:15:22.853Z Vendors: Unknown Products: Locatoraid Store Locator Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Locatoraid Store Locator WordPress plugin before 3.9.24 does not sanitise and escape the lpr-search parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3ca22b22-fe89-42be-94ec-b164838bcf50
CVE ID: CVE-2023-4478 State: PUBLISHED Published: 2023-08-25T09:06:06.310Z Last Updated: 2024-09-30T18:17:59.871Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-74 Description: Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-4479 State: PUBLISHED Published: 2024-03-04T07:17:20.299Z Last Updated: 2024-08-28T08:24:40.249Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: M-Files Corporation Products: M-Files Web Problem Types: CWE-79 Description: Stored XSS Vulnerability in M-Files Web versions before 23.8 allows attacker to execute script on users browser via stored HTML document within limited time period. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://product.m-files.com/security-advisories/cve-2023-4479/
CVE ID: CVE-2023-4480 State: PUBLISHED Published: 2023-09-05T14:43:25.762Z Last Updated: 2024-09-26T18:17:31.297Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: PHPFusion Products: PHPFusion Problem Types: CWE-538 Description: Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privileges of the running process. Additionally, they may write files to arbitrary locations, provided the files pass the application’s mime-type and file extension validation. Additional Analyst Notes: - CVE
ions, provided the files pass the application’s mime-type and file extension validation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.synopsys.com/blogs/software-security/cyrc-vulnerability-advisory-cve-2023-2453/
CVE ID: CVE-2023-4481 State: PUBLISHED Published: 2023-08-31T23:46:18.796Z Last Updated: 2024-10-02T15:09:38.010Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks, Inc. Products: Junos OS, Junos OS Evolved Problem Types: CWE-20, Denial of Service Description: An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When certain specific crafted BGP UPDATE messages are received over an established BGP session, one BGP session may be torn down with an UPDATE message error, or the issue may
ceived over an established BGP session, one BGP session may be torn down with an UPDATE message error, or the issue may propagate beyond the local system which will remain non-impacted, but may affect one or more remote systems. This issue is exploitable remotely as the crafted UPDATE message can propagate through unaffected systems and intermediate BGP speakers. Continuous receipt of the crafted BGP UPDATE messages will create a sustained Denial of Service (DoS) condition for impacted devices. This issue affects eBGP and iBGP, in both IPv4 and IPv6 implementations. This issue requires a remote attacker to have at least one established BGP session. Improper Input Validation, Denial of Servic
sue requires a remote attacker to have at least one established BGP session. Improper Input Validation, Denial of Service vulnerability in Juniper Networks, Inc. Junos OS (BGP, rpd modules), Juniper Networks, Inc. Junos OS Evolved (BGP, rpd modules) allows Fuzzing.This issue affects Junos OS: * All versions before 20.4R3-S10, * from 21.1R1 through 21.*, * from 21.2 before 21.2R3-S5, * from 21.3 before 21.3R3-S5, * from 21.4 before 21.4R3-S7 (unaffected from 21.4R3-S5, affected from 21.4R3-S6) * from 22.1 before 22.1R3-S4, * from 22.2 before 22.2R3-S3, * from 22.3 before 22.3R3-S1, * from 22.4 before 22.4R3, * from 23.2 before 23.2R2. Junos OS Evolved: * All versions before 20.4R3-S10-EVO, *
3R3-S1, * from 22.4 before 22.4R3, * from 23.2 before 23.2R2. Junos OS Evolved: * All versions before 20.4R3-S10-EVO, * from 21.2-EVO before 21.2R3-S7-EVO, * from 21.3-EVO before 21.3R3-S5-EVO, * from 21.4-EVO before 21.4R3-S5-EVO, * from 22.1-EVO before 22.1R3-S4-EVO, * from 22.2-EVO before 22.2R3-S3-EVO, * from 22.3-EVO before 22.3R3-S1-EVO, * from 22.4-EVO before 22.4R3-EVO, * from 23.2-EVO before 23.2R2-EVO. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.juniper.net/JSA72510 - https://www.rfc-editor.org/rfc/rfc7606 - https://www.rfc-editor.org/rfc/rfc4271 - https://www.juniper.net/documentation/us/en/software/junos/bgp/topics/topic-ma
https://www.rfc-editor.org/rfc/rfc4271 - https://www.juniper.net/documentation/us/en/software/junos/bgp/topics/topic-map/bgp-error-messages.html
CVE ID: CVE-2023-4482 State: PUBLISHED Published: 2023-10-20T06:35:08.886Z Last Updated: 2025-02-05T19:11:29.440Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: miunosoft Products: Auto Amazon Links – Amazon Associates Affiliate Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Auto Amazon Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the style parameter in versions up to, and including, 5.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access to inject arbitrary we
n and output escaping. This makes it possible for authenticated attackers with contributor access to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/11ffb8a1-55d2-44c5-bcd2-ba866b94e8bc?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2961861%40amazon-auto-links%2Ftrunk&old=2896127%40amazon-auto-links%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-4485 State: PUBLISHED Published: 2023-09-05T23:03:57.616Z Last Updated: 2025-01-16T21:30:24.611Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ARDEREG Products: Sistemas SCADA Problem Types: CWE-89 Description: ARDEREG ​Sistema SCADA Central versions 2.203 and prior login page are vulnerable to an unauthenticated blind SQL injection attack. An attacker could manipulate the application's SQL query logic to extract sensitive information or perform unauthorized actions within the database. In this case, the vulnerability could allow an attacker to execute arbitrary SQL queries through the login page, potentially leading to unauthorized acce
ould allow an attacker to execute arbitrary SQL queries through the login page, potentially leading to unauthorized access, data leakage, or even disruption of critical industrial processes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-01
CVE ID: CVE-2023-4486 State: PUBLISHED Published: 2023-12-07T19:55:39.265Z Last Updated: 2025-05-28T13:52:00.866Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Johnson Controls Products: Metasys NAE55/SNE/SNC, Facility Explorer F4-SNC Problem Types: CWE-400 Description: Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to versions 11.0.6 and 12.0.4 and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.
enial-of-service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-23-341-03
CVE ID: CVE-2023-4487 State: PUBLISHED Published: 2023-09-05T22:55:45.047Z Last Updated: 2025-01-16T21:30:31.371Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: GE Digital Products: CIMPLICITY Problem Types: CWE-114 Description: GE CIMPLICITY 2023 is by a process control vulnerability, which could allow a local attacker to insert malicious configuration files in the expected web server execution path to escalate privileges and gain full control of the HMI software. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-02 - https://digitalsupport.ge.com/s/article/GE
eferences: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-02 - https://digitalsupport.ge.com/s/article/GE-Digital-CIMPLICITY-Privilege-Escalation-Vulnerability
CVE ID: CVE-2023-4488 State: PUBLISHED Published: 2023-10-20T06:35:29.541Z Last Updated: 2025-02-05T19:06:57.710Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: hyno Products: Dropbox Folder Share Problem Types: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Description: The Dropbox Folder Share for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.9.7 via the editor-view.php file. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access
arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/647a2f27-092a-4db1-932d-87ae8c2efcca?source=cve - https://plugins.trac.wordpress.org/browser/dropbox-folder-share/trunk/HynoTech/UsosGenerales/js/editor-view.php?rev=2904670