Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
jection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223127. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.223127 - https://vuldb.com/?ctiid.223127 - https://github.com/AureliusLia/bug_report/blob/main/vendors/Skynidnine/Friendly%20Island%20Pizza%20Website%20and%20Ordering%20System/SQLi-1.md
CVE ID: CVE-2023-1380 State: PUBLISHED Published: 2023-03-27T00:00:00 Last Updated: 2024-08-02T05:49:10.358Z Vendors: n/a Products: Kernel Problem Types: CWE-125 Description: A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2177883 - https://lore.kernel.org/linux-wireless/20230309104457.22628-1-jisoo.jang%40yonsei.ac.kr/T/#u - https://
cgi?id=2177883 - https://lore.kernel.org/linux-wireless/20230309104457.22628-1-jisoo.jang%40yonsei.ac.kr/T/#u - https://www.openwall.com/lists/oss-security/2023/03/14/1 - https://security.netapp.com/advisory/ntap-20230511-0001/ - http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html - http://packetstormsecurity.com/files/173757/Kernel-Live-Patch-Security-Notice-LSN-0096-1.html - https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html - https://www.debian.org/security/2023/dsa-5480 - https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
CVE ID: CVE-2023-1381 State: PUBLISHED Published: 2023-04-10T14:14:39.985Z Last Updated: 2025-02-11T17:21:25.629Z Vendors: Unknown Products: WP Meta SEO Problem Types: CWE-502 Deserialization of Untrusted Data Description: The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to a PHAR deserialization vulnerability. Furthermore, the plugin contains a gadget chain which may be used in certain configurations to achieve remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f140a928-d297-4bd1-8552-bfebcedba536 - https://bl
CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f140a928-d297-4bd1-8552-bfebcedba536 - https://blog.wpscan.com/uncovering-a-phar-deserialization-vulnerability-in-wp-meta-seo-and-escalating-to-rce/
CVE ID: CVE-2023-1382 State: PUBLISHED Published: 2023-04-19T00:00:00.000Z Last Updated: 2025-03-19T15:37:05.212Z Vendors: n/a Products: Kernel Problem Types: CWE-476 Description: A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc protocol in the Linux kernel. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lore.kernel.org/netdev/bc7bd3183f1c275c820690fc65b708238fe9e38e.1668807842.git.lucien.xin%40gmail.com/T/#u
CVE ID: CVE-2023-1383 State: PUBLISHED Published: 2023-05-03T11:42:10.455Z Last Updated: 2025-01-30T15:07:33.815Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: AmazonFire TV Stick 3rd gen, Insignia Products: Fire TV Stick 3rd gen, TV with FireOS Problem Types: CWE-841 Description: An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an attacker to register services that are only locally accessible. This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS versions prior to 7.6.3.3. Additional Analyst Notes: - CVE Program Container: - CI
r to 6.2.9.5. Insignia TV with FireOS versions prior to 7.6.3.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bitdefender.com/blog/labs/vulnerabilities-identified-amazon-fire-tv-stick-insignia-fire-os-tv-series/
CVE ID: CVE-2023-1384 State: PUBLISHED Published: 2023-05-03T12:10:43.924Z Last Updated: 2025-01-30T15:06:49.243Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Amazon, Insignia Products: Fire TV Stick 3rd gen, TV with FireOS Problem Types: CWE-80 Description: The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS versions prior to 7.6.3.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bitdefender.com/blog/labs/vul
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bitdefender.com/blog/labs/vulnerabilities-identified-amazon-fire-tv-stick-insignia-fire-os-tv-series/
CVE ID: CVE-2023-1385 State: PUBLISHED Published: 2023-05-03T12:33:31.872Z Last Updated: 2025-01-30T15:00:50.049Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Amazon, Insignia Products: Fire TV Stick 3rd gen, TV with FireOS Problem Types: CWE-330 Description: Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authentication to amzn.lightning services. This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS 7.6.3.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www
th FireOS 7.6.3.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bitdefender.com/blog/labs/vulnerabilities-identified-amazon-fire-tv-stick-insignia-fire-os-tv-series/
CVE ID: CVE-2023-1386 State: PUBLISHED Published: 2023-07-24T15:19:25.843Z Last Updated: 2024-09-25T19:57:50.614Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: n/a, Red Hat, Fedora Products: qemu, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8 Advanced Virtualization, Red Hat Enterprise Linux 9, Fedora, Extra Packages for Enterprise Linux Problem Types: CWE-281 Description: A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. When a local user in the guest writes an executable file with SUID or SGID, none of these privileged bits are correctly dropped. As a result, in
guest writes an executable file with SUID or SGID, none of these privileged bits are correctly dropped. As a result, in rare circumstances, this flaw could be used by malicious users in the guest to elevate their privileges within the guest and help a host local user to elevate privileges on the host. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-1386 - https://bugzilla.redhat.com/show_bug.cgi?id=2223985 - https://github.com/advisories/GHSA-ppj8-867g-rgjr - https://github.com/v9fs/linux/issues/29 - https://security.netapp.com/advisory/ntap-20230831-0005/
CVE ID: CVE-2023-1387 State: PUBLISHED Published: 2023-04-26T13:47:16.914Z Last Updated: 2025-02-13T16:39:22.007Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: Grafana Products: Grafana, Grafana Enterprise Problem Types: CWE-200 Description: Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authe
JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://grafana.com/security/security-advisories/cve-2023-1387/ - https://github.com/grafana/bugbounty/security/advisories/GHSA-5585-m9r5-p86j - https://security.netapp.com/advisory/ntap-20230609-0003/
CVE ID: CVE-2023-1388 State: PUBLISHED Published: 2023-06-07T07:32:52.231Z Last Updated: 2025-01-06T21:05:59.938Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Trellix Products: Trellix Agent Problem Types: CWE 120 - Heap-Based Buffer Overflow Description: A heap-based overflow vulnerability in TA prior to version 5.7.9 allows a remote user to alter the page heap in the macmnsvc process memory block, resulting in the service becoming unavailable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kcm.trellix.com/corporate/index?page=content&id=SB10398
CVE ID: CVE-2023-1389 State: PUBLISHED Published: 2023-03-15T00:00:00.000Z Last Updated: 2025-10-21T23:15:23.352Z Vendors: n/a Products: TP-Link Archer AX21 (AX1800) Problem Types: Command Injection Description: TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request. Additional Analyst Notes: - CVE Program Con
to inject commands, which would be run as root, with a simple POST request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-11 - http://packetstormsecurity.com/files/174131/TP-Link-Archer-AX21-Command-Injection.html
CVE ID: CVE-2023-1390 State: PUBLISHED Published: 2023-03-16T00:00:00.000Z Last Updated: 2025-04-23T16:23:37.728Z Vendors: n/a Products: Linux kernel (TIPC kernel module) Problem Types: CWE-1050 Description: A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue. Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system to instantly spike to 100%, causing a denial of service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github
condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/netspooky/bee2d07022f6350bb88eaa48e571d9b5 - https://infosec.exchange/%40_mattata/109427999461122360 - https://github.com/torvalds/linux/commit/b77413446408fdd256599daf00d5be72b5f3e7c6 - https://security.netapp.com/advisory/ntap-20230420-0001/
CVE ID: CVE-2023-1391 State: PUBLISHED Published: 2023-03-14T14:21:03.575Z Last Updated: 2024-08-02T05:49:11.232Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Tours & Travels Management System Problem Types: CWE-434 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file admin/ab.php. The manipulation of the argument img leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-222978 is the identifier assigned to this vulnerability. A
exploit has been disclosed to the public and may be used. VDB-222978 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222978 - https://vuldb.com/?ctiid.222978 - https://blog.csdn.net/Dwayne_Wade/article/details/129526901
CVE ID: CVE-2023-1392 State: PUBLISHED Published: 2023-03-14T14:24:13.917Z Last Updated: 2025-02-27T15:57:01.659Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Pizza Ordering System Problem Types: CWE-434 Description: A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this vulnerability is the function save_menu. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222979. Additional Analyst Notes: - CVE Program Container: - CISA
he associated identifier of this vulnerability is VDB-222979. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.222979 - https://vuldb.com/?ctiid.222979 - https://github.com/Fchen-xcu/Vulnerability-Set/blob/main/The%20online%20pizza%20ordering%20system%20has%20a%20file%20upload%20(RCE)%20vulnerability.pdf
CVE ID: CVE-2023-1393 State: PUBLISHED Published: 2023-03-30T00:00:00.000Z Last Updated: 2025-02-14T15:43:04.174Z Vendors: n/a Products: xorg-server Problem Types: CWE-416 Description: A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client explicitly destroys the compositor overlay window (aka COW), the Xserver would leave a dangling pointer to that window in the CompScreen structure, which will trigger a use-after-free later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openwall.com/lists/oss-security/2023/03/29/1 - https://lists.fedoraproject.org/archives/list/package-ann
: - https://www.openwall.com/lists/oss-security/2023/03/29/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H3EVO3OQV6T4BSABWZ2TU3PY5TJTEQZ2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPNQYHUI63DB5FHK6EOI3Z4C6YQZGZKI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SW2NRC3V53PIBXFPFBVWCOM2MDDILWQS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QHJMSMK7G4GPLMKIGKXIOL2RTKU5VFWE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEHSYYFG
L2RTKU5VFWE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEHSYYFGBN3G4RS2HJXKQ5NBMOAZ5F2F/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PSAAGI5V77FQXIT5PP4URP6BYQVCK5U5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NOYATGGPMT3COC7ELAJW5TG2PVS3AFR2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWFUDSBSABRHQOX6TIQ5O3SNPFTPFQQP/ - https://security.gentoo.org/glsa/202305-30 - https://gitlab.freedesktop.org/xorg/xserver/-/commit/26ef545b3502f61ca722a7a3373507e88ef64110
CVE ID: CVE-2023-1394 State: PUBLISHED Published: 2023-03-14T14:31:19.825Z Last Updated: 2024-08-02T05:49:11.348Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Graduate Tracer System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0. It has been classified as critical. This affects the function mysqli_query of the file bsitemp.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222981 was assigned to this vulnerability. Additional Analyst Notes
ed to the public and may be used. The identifier VDB-222981 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222981 - https://vuldb.com/?ctiid.222981 - https://blog.csdn.net/Dwayne_Wade/article/details/129522869
CVE ID: CVE-2023-1395 State: PUBLISHED Published: 2023-03-14T14:33:28.175Z Last Updated: 2025-02-26T21:36:56.401Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Yoga Class Registration System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been declared as problematic. This vulnerability affects the function query of the file admin/user/list.php. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-222982 is the identifier assigned to this vulnerability. Additional
as been disclosed to the public and may be used. VDB-222982 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.222982 - https://vuldb.com/?ctiid.222982 - https://blog.csdn.net/Dwayne_Wade/article/details/129496689
CVE ID: CVE-2023-1396 State: PUBLISHED Published: 2023-03-14T14:35:53.250Z Last Updated: 2024-08-02T05:49:11.064Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Tours & Travels Management System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file admin/traveller_details.php. The manipulation of the argument address leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerabilit
d remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222983. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222983 - https://vuldb.com/?ctiid.222983 - https://blog.csdn.net/Dwayne_Wade/article/details/129524104
CVE ID: CVE-2023-1397 State: PUBLISHED Published: 2023-03-14T15:00:05.157Z Last Updated: 2024-08-02T05:49:11.291Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Student Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in SourceCodester Online Student Management System 1.0. Affected is an unknown function of the file profile.php. The manipulation of the argument adminname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222984. Additional Analyst Notes: - CV
closed to the public and may be used. The identifier of this vulnerability is VDB-222984. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222984 - https://vuldb.com/?ctiid.222984 - https://github.com/E1CHO/cve_hub/blob/main/Online%20student%20management%20system%20pdf/Online%20student%20management%20system%20xss%20vlun%203.pdf
CVE ID: CVE-2023-1398 State: PUBLISHED Published: 2023-03-14T14:43:03.088Z Last Updated: 2024-08-02T05:49:10.353Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: XiaoBingBy Products: TeaCMS Problem Types: CWE-24 Description: A vulnerability classified as critical was found in XiaoBingBy TeaCMS 2.0. Affected by this vulnerability is an unknown functionality of the file /admin/upload. The manipulation leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222985 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?
was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222985 - https://vuldb.com/?ctiid.222985 - https://gitee.com/xiaobingby/TeaCMS/issues/I6IIYV
CVE ID: CVE-2023-1399 State: PUBLISHED Published: 2023-03-27T15:11:46.873Z Last Updated: 2025-01-16T21:38:51.200Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Keysight Technologies Products: N6854A Geolocation Server Problem Types: CWE-502 Description: N6854A Geolocation Server versions 2.4.2 are vulnerable to untrusted data deserialization, which may allow a malicious actor to escalate privileges in the affected device’s default configuration and achieve remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-01
CVE ID: CVE-2023-1400 State: PUBLISHED Published: 2023-03-27T15:37:25.452Z Last Updated: 2025-04-23T16:23:17.336Z Vendors: Unknown Products: Modern Events Calendar Lite Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Modern Events Calendar Lite WordPress plugin before 6.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c7feceef-28f1-4cac-b124-4b95e3f17b07
CVE ID: CVE-2023-1401 State: PUBLISHED Published: 2023-07-26T06:01:46.447Z Last Updated: 2025-11-20T04:06:23.275Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-201 Description: An issue has been discovered in GitLab DAST scanner affecting all versions starting from 3.0.29 before 4.0.5, in which the DAST scanner leak cross site cookies on redirect during authorization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/396533 - https://hackerone.com/reports/1889255
CVE ID: CVE-2023-1402 State: PUBLISHED Published: 2023-03-23T00:00:00 Last Updated: 2024-08-02T05:49:11.399Z Problem Types: CWE-200 Description: The course participation report required additional checks to prevent roles being displayed which the user did not have access to view. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2179427 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF/ - https://moodle.org/mod/forum/discuss.php?d=445069
CVE ID: CVE-2023-1403 State: PUBLISHED Published: 2023-06-09T05:33:18.177Z Last Updated: 2024-11-23T13:18:22.330Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpweaver Products: Weaver Xtreme Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Weaver Xtreme Theme for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display name in versions up to, and including, 5.0.7. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user
with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5b2bef63-c871-45e4-bb05-12bbba20ca5e?source=cve - https://themes.trac.wordpress.org/browser/weaver-xtreme/5.0.7/includes/lib-content.php#L1081