Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-46312 State: PUBLISHED Published: 2023-10-31T09:16:22.558Z Last Updated: 2024-09-06T20:14:10.004Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Zaytech Products: Smart Online Order for Clover Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Zaytech Smart Online Order for Clover plugin <= 1.5.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/clover-online-orders/wordpress-smart-online-order-for-clover-plugin-1-5-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-46313 State: PUBLISHED Published: 2023-10-31T09:39:05.763Z Last Updated: 2024-09-06T15:24:23.563Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Katie Seaborn Products: Zotpress Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Katie Seaborn Zotpress plugin <= 7.3.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/zotpress/wordpress-zotpress-plugin-7-3-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-46315 State: PUBLISHED Published: 2023-10-22T00:00:00 Last Updated: 2024-09-12T17:50:42.748Z Vendors: n/a Products: n/a Problem Types: n/a Description: The zanllp sd-webui-infinite-image-browsing (aka Infinite Image Browsing) extension before 977815a for stable-diffusion-webui (aka Stable Diffusion web UI), if Gradio authentication is enabled without secret key configuration, allows remote attackers to read any local file via /file?path= in the URL, as demonstrated by reading /proc/self/environ to discover credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zanllp/sd-webui-infinite-image-browsing/issues/38
m Container: - CISA ADP Vulnrichment: References: - https://github.com/zanllp/sd-webui-infinite-image-browsing/issues/387 - https://github.com/zanllp/sd-webui-infinite-image-browsing/pull/368/commits/977815a2b28ad953c10ef0114c365f698c4b8f19
CVE ID: CVE-2023-46316 State: PUBLISHED Published: 2023-10-24T00:00:00 Last Updated: 2024-08-02T20:45:41.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: In buc Traceroute 2.0.12 through 2.1.2 before 2.1.3, the wrapper scripts do not properly parse command lines. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sourceforge.net/projects/traceroute/files/traceroute/traceroute-2.1.3/ - https://security-tracker.debian.org/tracker/CVE-2023-46316 - http://packetstormsecurity.com/files/176660/Traceroute-2.1.2-Privilege-Escalation.html
CVE ID: CVE-2023-46317 State: PUBLISHED Published: 2023-10-22T00:00:00 Last Updated: 2024-09-12T17:45:59.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: Knot Resolver before 5.7.0 performs many TCP reconnections upon receiving certain nonsensical responses from servers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.knot-resolver.cz/2023-08-22-knot-resolver-5.7.0.html - https://gitlab.nic.cz/knot/knot-resolver/-/merge_requests/1448
CVE ID: CVE-2023-46319 State: PUBLISHED Published: 2023-10-22T00:00:00 Last Updated: 2024-09-12T15:48:37.928Z Vendors: n/a Products: n/a Problem Types: n/a Description: WALLIX Bastion 9.x before 9.0.9 and 10.x before 10.0.5 allows unauthenticated access to sensitive information by bypassing access control on a network access administration web interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wallix.com/support/alerts/
CVE ID: CVE-2023-46321 State: PUBLISHED Published: 2023-10-22T00:00:00 Last Updated: 2024-09-11T20:35:41.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have shell metacharacters for a /usr/bin/man command line. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://iterm2.com/downloads.html - https://gitlab.com/gnachman/iterm2/-/commit/de3d351e1bd3bc1c1a4f85fe976c592e497dd071
CVE ID: CVE-2023-46322 State: PUBLISHED Published: 2023-10-22T00:00:00 Last Updated: 2024-09-11T20:28:05.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. The hostname's initial character may be non-alphanumeric. The hostname's other characters may be outside the set of alphanumeric characters, dash, and period. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://iterm2.com/downloads.html - https://gitlab.com/gnachman/iterm2/-/commit/ef7bb84520013b2524df9787d4aa9f2c96746c01
CVE ID: CVE-2023-46324 State: PUBLISHED Published: 2023-10-23T00:00:00 Last Updated: 2024-08-02T20:45:40.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its private key and the attacker's public key. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/free5gc/udm/pull/20 - https://github.com/free5gc/udm/compare/v1.1.1...v1.2.0 - https://www.gsma.com/security/
github.com/free5gc/udm/pull/20 - https://github.com/free5gc/udm/compare/v1.1.1...v1.2.0 - https://www.gsma.com/security/wp-content/uploads/2023/10/0073-invalid_curve.pdf
CVE ID: CVE-2023-46326 State: PUBLISHED Published: 2023-11-30T00:00:00 Last Updated: 2024-08-02T20:45:40.880Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZStack Cloud version 3.10.38 and before allows unauthenticated API access to the list of active job UUIDs and the session ID for each of these. This leads to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zstackio/zstack/security/advisories/GHSA-w2rv-x3pp-h67q
CVE ID: CVE-2023-46327 State: PUBLISHED Published: 2023-11-02T02:19:24.487Z Last Updated: 2024-09-06T15:44:18.201Z Vendors: FUJIFILM Business Inovation Corp., Xerox Corporation Products: Apeos C3070 Asia Pacific Model, Apeos C3570 Asia Pacific Model, Apeos C4570 Asia Pacific Model, Apeos C2060 Japan Model, Apeos C2360 Japan Model, Apeos C2570 Japan Model, Apeos C3070 Japan Model, Apeos C3570 Japan Model, Apeos C4570 Japan Model, Apeos C5570 Japan Model, Apeos C6570 Japan Model, Apeos C7070 Japan Model, Apeos C6580 Japan Model, Apeos C7580 Japan Model, Apeos C8180 Japan Model, Apeos C3530 Japan Model, Apeos C4030 Japan Model, Apeos C5240 Japan Model, ApeosPro C650 Japan Model, ApeosPro C750 J
l, Apeos C3530 Japan Model, Apeos C4030 Japan Model, Apeos C5240 Japan Model, ApeosPro C650 Japan Model, ApeosPro C750 Japan Model, ApeosPro C810 Japan Model, RevoriaPress SC170 Japan Model, RevoriaPress SC180 Japan Model, ApeosPort C2060 Japan Model, ApeosPort C2360 Japan Model, ApeosPort C2570 Japan Model, ApeosPort C3070 Japan Model, ApeosPort C3570 Japan Model, ApeosPort C4570 Japan Model, ApeosPort C5570 Japan Model, ApeosPort C6570 Japan Model, ApeosPort C7070 Japan Model, ApeosPort-VII C3322 Japan Model, ApeosPort-VII C4422 Japan Model, Apeos 1860 Japan Model, Apeos 2560 Japan Model, Apeos 3060 Japan Model, Apeos 3570 Japan Model, Apeos 4570 Japan Model, Apeos 5580 Japan Model, Apeos
2560 Japan Model, Apeos 3060 Japan Model, Apeos 3570 Japan Model, Apeos 4570 Japan Model, Apeos 5580 Japan Model, Apeos 6580 Japan Model, Apeos 7580 Japan Model, Apeos 5330 Japan Model, Apeos 6340 Japan Model, Revoria Press E1100 Japan Model, Revoria Press E1110 Japan Model, Revoria Press E1125 Japan Model, Revoria Press E1136 Japan Model, ApeosPort 1860 Japan Model, ApeosPort 2560 Japan Model, ApeosPort 3060 Japan Model, ApeosPort 3570 Japan Model, ApeosPort 4570 Japan Model, ApeosPort-VII 5022 Japan Model, Apeos C2060 Asia Pacific Model, Apeos C2060 GK Asia Pacific Model, Apeos C2560 Asia Pacific Model, Apeos C2560 GK Asia Pacific Model, Apeos C3060 Asia Pacific Model, Apeos C3060 GK Asia
Apeos C2560 Asia Pacific Model, Apeos C2560 GK Asia Pacific Model, Apeos C3060 Asia Pacific Model, Apeos C3060 GK Asia Pacific Model, Apeos C2570 Asia Pacific Model, Apeos C5570 Asia Pacific Model, Apeos C6570 Asia Pacific Model, Apeos C7070 Asia Pacific Model, Apeos C6580 Asia Pacific Model, Apeos C7580 Asia Pacific Model, Apeos C8180 Asia Pacific Model, Apeos C3530 Asia Pacific Model, Apeos C4030 Asia Pacific Model, Apeos C5240 Asia Pacific Model, ApeosPro C650 Asia Pacific Model, ApeosPro C750 Asia Pacific Model, ApeosPro C810 Asia Pacific Model, RevoriaPress SC170 Asia Pacific Model, RevoriaPress SC180 Asia Pacific Model, ApeosPort C2060 Asia Pacific Model, ApeosPort C2060 G Asia Pacifi
Pacific Model, RevoriaPress SC180 Asia Pacific Model, ApeosPort C2060 Asia Pacific Model, ApeosPort C2060 G Asia Pacific Model, ApeosPort C2560 Asia Pacific Model, ApeosPort C2560 G Asia Pacific Model, ApeosPort C3060 Asia Pacific Model, ApeosPort C3060 G Asia Pacific Model, ApeosPort C3070 Asia Pacific Model, ApeosPort C3570 Asia Pacific Model, ApeosPort C4570 Asia Pacific Model, ApeosPort C5570 Asia Pacific Model, ApeosPort C6570 Asia Pacific Model, ApeosPort C7070 Asia Pacific Model, ApeosPort-VII C3321 Asia Pacific Model, ApeosPort-VII C4421 Asia Pacific Model, Apeos 2560 Asia Pacific Model, Apeos 2560 GK Asia Pacific Model, Apeos 3060 Asia Pacific Model, Apeos 3060 GK Asia Pacific Mode
560 Asia Pacific Model, Apeos 2560 GK Asia Pacific Model, Apeos 3060 Asia Pacific Model, Apeos 3060 GK Asia Pacific Model, Apeos 3560 Asia Pacific Model, Apeos 3560 GK Asia Pacific Model, Apeos 4570 Asia Pacific Model, Apeos 5570 Asia Pacific Model, Apeos 6580 Asia Pacific Model, Apeos 7580 Asia Pacific Model, Apeos 6340 Asia Pacific Model, Apeos 4830 Asia Pacific Model, Apeos 5330 Asia Pacific Model, Revoria Press E1100 Asia Pacific Model, Revoria Press E1110 Asia Pacific Model, Revoria Press E1125 Asia Pacific Model, Revoria Press E1136 Asia Pacific Model, ApeosPort 2560 Asia Pacific Model, ApeosPort 2560 G Asia Pacific Model, ApeosPort 3060 Asia Pacific Model, ApeosPort 3060 G Asia Pacifi
Asia Pacific Model, ApeosPort 2560 G Asia Pacific Model, ApeosPort 3060 Asia Pacific Model, ApeosPort 3060 G Asia Pacific Model, ApeosPort 3560 Asia Pacific Model, ApeosPort 3560 G Asia Pacific Model, ApeosPort 3570 Asia Pacific Model, ApeosPort 4570 Asia Pacific Model, ApeosPort 4570 G Asia Pacific Model, ApeosPort 5570 Asia Pacific Model, ApeosPort 5570 G Asia Pacific Model, ApeosPort-VII 4021 Asia Pacific Model, ApeosPort-VII 5021 Asia Pacific Model, PrimeLink C9065 Asia Pacific Model, PrimeLink C9070 Asia Pacific Model, Apeos C3070 Europe Model, Apeos C3570 Europe Model, Apeos C4570 Europe Model, Apeos C5570 Europe Model, Apeos C6570 Europe Model, Apeos C7070 Europe Model, ApeosPro C650
, Apeos C4570 Europe Model, Apeos C5570 Europe Model, Apeos C6570 Europe Model, Apeos C7070 Europe Model, ApeosPro C650 Europe Model, ApeosPro C750 Europe Model, ApeosPro C810 Europe Model, RevoriaPress SC170 Europe Model, RevoriaPress SC180 Europe Model, Revoria Press E1100 Europe Model, Revoria Press E1110 Europe Model, Revoria Press E1125 Europe Model, Revoria Press E1136 Europe Model, Xerox VersaLink C7020, Xerox VersaLink C7120, Xerox VersaLink C7025, Xerox VersaLink C7125, Xerox VersaLink C7030, Xerox VersaLink C7130, Xerox PrimeLink C9065, Xerox PrimeLink C9070, Xerox VersaLink C405, Xerox VersaLink C505, Xerox VersaLink C605, Xerox VersaLink B7025, Xerox VersaLink B7125, Xerox VersaL
x VersaLink C405, Xerox VersaLink C505, Xerox VersaLink C605, Xerox VersaLink B7025, Xerox VersaLink B7125, Xerox VersaLink B7030, Xerox VersaLink B7130, Xerox VersaLink B7035, Xerox VersaLink B7135, Xerox PrimeLink B9100, Xerox PrimeLink B9110, Xerox PrimeLink B9125, Xerox PrimeLink B9136, Xerox VersaLink B405, Xerox VersaLink B605, Xerox VersaLink B615, Xerox WorkCentre 6515 Problem Types: Use of weak credentials Description: Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. and Xerox Corporation provide a facility to export the contents of their Address Book with encrypted form, but the encryption strength is insufficient. With the knowledge of the encr
s of their Address Book with encrypted form, but the encryption strength is insufficient. With the knowledge of the encryption process and the encryption key, the information such as the server credentials may be obtained from the exported Address Book data. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.fujifilm.com/fbglobal/eng/company/news/notice/2023/1031_addressbook_announce.html - https://security.business.xerox.com/en-us/documents/bulletins/ - https://jvn.jp/en/vu/JVNVU96
ddressbook_announce.html - https://security.business.xerox.com/en-us/documents/bulletins/ - https://jvn.jp/en/vu/JVNVU96482726/index.html
CVE ID: CVE-2023-46331 State: PUBLISHED Published: 2023-10-23T00:00:00 Last Updated: 2024-09-17T14:21:45.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebAssembly wabt 1.0.33 has an Out-of-Bound Memory Read in in DataSegment::IsValidRange(), which lead to segmentation fault. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/WebAssembly/wabt/issues/2310
CVE ID: CVE-2023-46332 State: PUBLISHED Published: 2023-10-23T00:00:00 Last Updated: 2024-09-17T14:21:11.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebAssembly wabt 1.0.33 contains an Out-of-Bound Memory Write in DataSegment::Drop(), which lead to segmentation fault. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/WebAssembly/wabt/issues/2311
CVE ID: CVE-2023-46343 State: PUBLISHED Published: 2024-01-23T00:00:00.000Z Last Updated: 2025-06-17T13:55:44.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 6.5.9, there is a NULL pointer dereference in send_acknowledge in net/nfc/nci/spi.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lore.kernel.org/netdev/20231013184129.18738-1-krzysztof.kozlowski%40linaro.org/T/#r38bdbaf8ae15305b77f6c5bc8e15d38f405623c7 - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.9 - https://github.com/torvalds/linux/commit/7937609cd387246aed994e81aa4fa951358fba41 - https://git.kernel.org/cgit/linux/kernel/gi
/github.com/torvalds/linux/commit/7937609cd387246aed994e81aa4fa951358fba41 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7937609cd387246aed994e81aa4fa951358fba41
CVE ID: CVE-2023-46344 State: PUBLISHED Published: 2024-02-02T00:00:00.000Z Last Updated: 2025-05-07T20:11:59.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in Solar-Log Base 15 Firmware 6.0.1 Build 161, and possibly other Solar-Log Base products, allows an attacker to escalate their privileges by exploiting a stored cross-site scripting (XSS) vulnerability in the switch group function under /#ilang=DE&b=c_smartenergy_swgroups in the web portal. The vulnerability can be exploited to gain the rights of an installer or PM, which can then be used to gain administrative access to the web portal and execute further attacks. NOTE: The vendor states that this vulner
ed to gain administrative access to the web portal and execute further attacks. NOTE: The vendor states that this vulnerability has been fixed with 3.0.0-60 11.10.2013 for SL 200, 500, 1000 / not existing for SL 250, 300, 1200, 2000, SL 50 Gateway, SL Base. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solar-log.com/en/support/firmware-database-1 - http://solar-log.com - https://github.com/vinnie1717/CVE-2023-46344/blob/main/Solar-Log%20XSS
CVE ID: CVE-2023-46345 State: PUBLISHED Published: 2023-10-25T00:00:00 Last Updated: 2024-09-17T14:14:59.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/xlsparse.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/rycbar77/d747b2c37b544ece30b2353a65ab41f9
CVE ID: CVE-2023-46346 State: PUBLISHED Published: 2023-10-25T00:00:00 Last Updated: 2024-09-11T19:39:35.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 4.1.1 from MyPrestaModules for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a guest can perform a path traversal to view all files on the information system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpre
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2023/10/24/exportproducts.html
CVE ID: CVE-2023-46347 State: PUBLISHED Published: 2023-10-25T00:00:00 Last Updated: 2024-09-11T20:15:07.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Step by Step products Pack" (ndk_steppingpack) version 1.5.6 and before from NDK Design for PrestaShop, a guest can perform SQL injection. The method `NdkSpack::getPacks()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2023/10/24/ndk_steppingpack.html
CVE ID: CVE-2023-46348 State: PUBLISHED Published: 2023-12-14T00:00:00 Last Updated: 2024-08-02T20:45:40.766Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL njection vulnerability in SunnyToo sturls before version 1.1.13, allows attackers to escalate privileges and obtain sensitive information via StUrls::hookActionDispatcher and StUrls::getInstanceId methods. Additional Analyst Notes: - CVE Program Container: References: - https://security.friendsofpresta.org/modules/2023/12/07/sturls.html
CVE ID: CVE-2023-46349 State: PUBLISHED Published: 2023-11-27T00:00:00 Last Updated: 2024-11-26T20:35:43.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Product Catalog (CSV, Excel) Export/Update" (updateproducts) < 3.8.5 from MyPrestaModules for PrestaShop, a guest can perform SQL injection. The method `productsUpdateModel::getExportIds()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2023/11/23/updateproducts.html
CVE ID: CVE-2023-46350 State: PUBLISHED Published: 2024-02-09T00:00:00.000Z Last Updated: 2025-06-20T20:18:50.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in InnovaDeluxe "Manufacturer or supplier alphabetical search" (idxrmanufacturer) module for PrestaShop versions 2.0.4 and before, allows remote attackers to escalate privileges and obtain sensitive information via the methods IdxrmanufacturerFunctions::getCornersLink, IdxrmanufacturerFunctions::getManufacturersLike and IdxrmanufacturerFunctions::getSuppliersLike. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modu
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2024/02/08/idxrmanufacturer.html
CVE ID: CVE-2023-46351 State: PUBLISHED Published: 2024-01-19T00:00:00.000Z Last Updated: 2025-06-20T18:19:05.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module mib < 1.6.1 from MyPresta.eu for PrestaShop, a guest can perform SQL injection. The methods `mib::getManufacturersByCategory()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mypresta.eu/modules/front-office-features/manufacturers-brands-images-block.html - https://security.friendsofpresta.org/modules/2024/01/18/mib.html
CVE ID: CVE-2023-46352 State: PUBLISHED Published: 2023-11-02T00:00:00 Last Updated: 2024-09-06T14:03:53.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Pixel Plus: Events + CAPI + Pixel Catalog for Facebook Module" (facebookconversiontrackingplus) up to version 2.4.9 from Smart Modules for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can access exports from the module which can lead to a leak of personal information from ps_customer table such as name / surname / email. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://addons.prestashop.c
l. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://addons.prestashop.com/en/analytics-statistics/18739-pixel-plus-events-capi-pixel-catalog-for-facebook.html - https://security.friendsofpresta.org/modules/2023/10/31/facebookconversiontrackingplus.html
CVE ID: CVE-2023-46353 State: PUBLISHED Published: 2023-12-06T00:00:00 Last Updated: 2024-11-26T15:45:32.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Product Tag Icons Pro" (ticons) before 1.8.4 from MyPresta.eu for PrestaShop, a guest can perform SQL injection. The method TiconProduct::getTiconByProductAndTicon() has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2023/11/28/ticons.html
CVE ID: CVE-2023-46354 State: PUBLISHED Published: 2023-12-06T00:00:00 Last Updated: 2024-08-02T20:45:41.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Orders (CSV, Excel) Export PRO" (ordersexport) < 5.2.0 from MyPrestaModules for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can access exports from the module which can lead to a leak of personal information from ps_customer/ps_address tables such as name / surname / email / phone number / full postal address. Additional Analyst Notes: - CVE Program Container: References: - https://security.friendsofpresta.org/modules/2023/11/28/orders
nal Analyst Notes: - CVE Program Container: References: - https://security.friendsofpresta.org/modules/2023/11/28/ordersexport.html
CVE ID: CVE-2023-46355 State: PUBLISHED Published: 2023-11-27T00:00:00 Last Updated: 2024-08-02T20:45:41.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "CSV Feeds PRO" (csvfeeds) < 2.6.1 from Bl Modules for PrestaShop, a guest can download personal information without restriction. Due to too permissive access control which does not force administrator to use password on feeds, a guest can access exports from the module which can lead to leaks of personal information from ps_customer / ps_order table such as name / surname / email / phone number / postal address. Additional Analyst Notes: - CVE Program Container: References: - https://security.friendsofpresta.or
r / postal address. Additional Analyst Notes: - CVE Program Container: References: - https://security.friendsofpresta.org/modules/2023/11/23/csvfeeds.html