Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-34012 State: PUBLISHED Published: 2023-06-23T11:24:51.803Z Last Updated: 2024-10-10T17:20:15.040Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Premium Addons for Elementor Products: Premium Addons PRO Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Premium Addons for Elementor Premium Addons PRO plugin <= 2.8.24 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/premium-addons-pro/wordpress-premium-addons-pro-plugin-2-8-24-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34013 State: PUBLISHED Published: 2023-11-13T02:28:32.010Z Last Updated: 2025-01-08T21:33:44.531Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Poll Maker Team Products: Poll Maker – Best WordPress Poll Plugin Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Poll Maker Team Poll Maker – Best WordPress Poll Plugin.This issue affects Poll Maker – Best WordPress Poll Plugin: from n/a through 4.6.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/poll-maker/wordpress-poll-maker-plugin-4-6-2-server-side-request-forgery-
https://patchstack.com/database/vulnerability/poll-maker/wordpress-poll-maker-plugin-4-6-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-34014 State: PUBLISHED Published: 2024-12-13T14:23:35.657Z Last Updated: 2024-12-13T20:36:52.712Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: G5Theme Products: Grid Plus Problem Types: CWE-862 Description: Missing Authorization vulnerability in G5Theme Grid Plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grid Plus: from n/a through 1.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/grid-plus/vulnerability/wordpress-grid-plus-plugin-1-3-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-34015 State: PUBLISHED Published: 2023-07-11T08:36:04.177Z Last Updated: 2024-10-11T15:05:44.267Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: PI Websolution Products: Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce shipping Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in PI Websolution Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce shipping plugin <= 1.6.4.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/advanced
: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/advanced-free-flat-shipping-woocommerce/wordpress-advanced-flat-rate-shipping-woocommerce-plugin-1-6-4-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-34017 State: PUBLISHED Published: 2023-07-25T13:33:06.245Z Last Updated: 2024-09-26T15:04:33.107Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: FiveStarPlugins Products: Five Star Restaurant Reservations Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FiveStarPlugins Five Star Restaurant Reservations plugin <= 2.6.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/restaurant-reservations/wordpress-five-star-restaurant-reservations-plugin-2-6-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=
vations/wordpress-five-star-restaurant-reservations-plugin-2-6-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34018 State: PUBLISHED Published: 2023-11-30T17:01:49.611Z Last Updated: 2024-08-02T15:54:14.121Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: SoundCloud Inc. Products: SoundCloud Shortcode Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoundCloud Inc. SoundCloud Shortcode allows Stored XSS.This issue affects SoundCloud Shortcode: from n/a through 3.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/soundcloud-shortcode/wordpress-soundcloud-shortcode-plugin-3-1-0-cross-site-scripting-xs
tack.com/database/vulnerability/soundcloud-shortcode/wordpress-soundcloud-shortcode-plugin-3-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34019 State: PUBLISHED Published: 2024-12-13T14:23:36.185Z Last Updated: 2024-12-13T18:44:26.773Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Uncanny Owl Products: Uncanny Toolkit for LearnDash Problem Types: CWE-862 Description: Missing Authorization vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.6.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/uncanny-learndash-toolkit/vulnerability/wordpress-uncanny-toolkit-for-le
ttps://patchstack.com/database/wordpress/plugin/uncanny-learndash-toolkit/vulnerability/wordpress-uncanny-toolkit-for-learndash-plugin-3-6-4-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-34020 State: PUBLISHED Published: 2024-03-27T13:24:44.296Z Last Updated: 2025-04-10T18:28:10.680Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: Uncanny Owl Products: Uncanny Toolkit for LearnDash Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.6.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/uncanny-learndash-toolkit/wordpress-uncanny-toolkit-for-learndash-plugin-3-6-4-3-open-redire
.com/database/vulnerability/uncanny-learndash-toolkit/wordpress-uncanny-toolkit-for-learndash-plugin-3-6-4-3-open-redirection-vulnerability?_s_id=cve
CVE ID: CVE-2023-34021 State: PUBLISHED Published: 2023-06-23T11:31:21.007Z Last Updated: 2024-10-10T17:19:46.903Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Andy Moyle Products: Church Admin Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Andy Moyle Church Admin plugin <= 3.7.29 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/church-admin/wordpress-church-admin-plugin-3-7-29-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34022 State: PUBLISHED Published: 2023-08-30T14:46:01.651Z Last Updated: 2024-09-24T19:09:40.052Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Rakib Hasan Products: Dynamic QR Code Generator Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rakib Hasan Dynamic QR Code Generator plugin <= 0.0.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/dynamic-qr-code-generator/wordpress-dynamic-qr-code-generator-plugin-0-0-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34023 State: PUBLISHED Published: 2023-08-30T14:25:02.811Z Last Updated: 2024-08-02T15:54:14.119Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Miled Products: WordPress Social Login Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Miled WordPress Social Login plugin <= 3.0.4 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wordpress-social-login/wordpress-wordpress-social-login-plugin-3-0-4-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE ID: CVE-2023-34024 State: PUBLISHED Published: 2023-11-09T20:32:09.956Z Last Updated: 2024-09-03T18:19:16.097Z Vendors: Guillemant David Products: WP Full Auto Tags Manager Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Guillemant David WP Full Auto Tags Manager plugin <= 2.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-full-auto-tags-manager/wordpress-wp-full-auto-tags-manager-plugin-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-34025 State: PUBLISHED Published: 2023-11-09T20:29:07.527Z Last Updated: 2024-09-03T18:21:01.545Z Vendors: LWS Products: LWS Hide Login Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Hide Login plugin <= 2.1.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/lws-hide-login/wordpress-lws-hide-login-plugin-2-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-34026 State: PUBLISHED Published: 2023-06-12T15:05:25.402Z Last Updated: 2024-10-10T17:28:06.839Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: BrokenCrust Products: This Day In History Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in BrokenCrust This Day In History plugin <= 3.10.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/this-day-in-history/wordpress-this-day-in-history-plugin-3-10-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34027 State: PUBLISHED Published: 2023-12-19T19:44:44.362Z Last Updated: 2024-08-02T15:54:14.186Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Rajnish Arora Products: Recently Viewed Products Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Rajnish Arora Recently Viewed Products.This issue affects Recently Viewed Products: from n/a through 1.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/recently-viewed-products/wordpress-recently-viewed-products-plugin-1-0-0-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-34028 State: PUBLISHED Published: 2023-06-22T14:21:00.258Z Last Updated: 2024-10-18T13:01:02.404Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: realmag777 Products: WOLF – WordPress Posts Bulk Editor and Manager Professional Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/bulk-editor/wordpress-wolf-wordpress-posts-bulk-editor-and-manager-professional-plugin-1-0-7-cross-sit
ase/vulnerability/bulk-editor/wordpress-wolf-wordpress-posts-bulk-editor-and-manager-professional-plugin-1-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-34029 State: PUBLISHED Published: 2023-07-11T12:25:42.496Z Last Updated: 2025-02-19T21:28:06.768Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Prem Tiwari Products: Disable WordPress Update Notifications and auto-update Email Notifications Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Prem Tiwari Disable WordPress Update Notifications and auto-update Email Notifications plugin <= 2.3.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/disable-update-notifications/wordpress-disable-wordpress-update-notifi
: - https://patchstack.com/database/vulnerability/disable-update-notifications/wordpress-disable-wordpress-update-notifications-and-auto-update-email-notifications-plugin-2-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-34030 State: PUBLISHED Published: 2023-11-30T13:54:25.013Z Last Updated: 2024-08-02T15:54:14.166Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Really Simple Plugins Products: Complianz, Complianz Premium Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Complianz, Really Simple Plugins Complianz Premium allows Cross-Site Request Forgery.This issue affects Complianz: from n/a through 6.4.5; Complianz Premium: from n/a through 6.4.7. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/complianz-gdpr/wordpress-complianz-plugi
Program Container: References: - https://patchstack.com/database/vulnerability/complianz-gdpr/wordpress-complianz-plugin-6-4-5-multiple-cross-site-request-forgery-csrf-vulnerability?_s_id=cve - https://patchstack.com/database/vulnerability/complianz-gdpr-premium/wordpress-complianz-premium-plugin-6-4-7-multiple-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-34031 State: PUBLISHED Published: 2023-11-09T20:25:19.432Z Last Updated: 2024-09-03T18:22:23.858Z Vendors: Pascal Casier Products: bbPress Toolkit Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Pascal Casier bbPress Toolkit plugin <= 1.0.12 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/bbp-toolkit/wordpress-bbpress-toolkit-plugin-1-0-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-34032 State: PUBLISHED Published: 2023-08-30T14:19:23.198Z Last Updated: 2024-09-24T19:09:50.921Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Pascal Casier Products: bbPress Toolkit Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Pascal Casier bbPress Toolkit plugin <= 1.0.12 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/bbp-toolkit/wordpress-bbpress-toolkit-plugin-1-0-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34033 State: PUBLISHED Published: 2023-11-09T19:31:04.794Z Last Updated: 2024-09-04T13:27:24.287Z Vendors: Malinky Products: Ajax Pagination and Infinite Scroll Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Malinky Ajax Pagination and Infinite Scroll plugin <= 2.0.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/malinky-ajax-pagination/wordpress-ajax-pagination-and-infinite-scroll-plugin-2-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-34034 State: PUBLISHED Published: 2023-07-19T14:16:12.150Z Last Updated: 2024-10-28T14:40:32.304Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: n/a Products: Spring Security Problem Types: potential for a security bypass Description: Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2023-34034 - https://security.netapp.com/advisory/ntap-20230814-0008/
CVE ID: CVE-2023-34035 State: PUBLISHED Published: 2023-07-18T15:29:10.091Z Last Updated: 2024-10-25T15:47:50.802Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: Spring Security Problem Types: Authorization rule misconfiguration Description: Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String) and multiple servlets, one of them being Spring MVC’s DispatcherServlet. (DispatcherServlet is a Spring MVC component that maps HTTP endpoints to methods on @Controller-annotated classes.) Specifically, an applicati
a Spring MVC component that maps HTTP endpoints to methods on @Controller-annotated classes.) Specifically, an application is vulnerable when all of the following are true: * Spring MVC is on the classpath * Spring Security is securing more than one servlet in a single application (one of them being Spring MVC’s DispatcherServlet) * The application uses requestMatchers(String) to refer to endpoints that are not Spring MVC endpoints An application is not vulnerable if any of the following is true: * The application does not have Spring MVC on the classpath * The application secures no servlets other than Spring MVC’s DispatcherServlet * The application uses requestMatchers(String) only for Sp
secures no servlets other than Spring MVC’s DispatcherServlet * The application uses requestMatchers(String) only for Spring MVC endpoints Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2023-34035
CVE ID: CVE-2023-34036 State: PUBLISHED Published: 2023-07-17T10:00:43.245Z Last Updated: 2024-10-30T14:52:30.766Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Spring Products: Spring HATEOAS Problem Types: CWE-644 Description: Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle (and possibly discard) forwarded headers either in WebFlux or at the level of the underlying HTTP server. For the application to be affected, it needs to satisfy t
ther in WebFlux or at the level of the underlying HTTP server. For the application to be affected, it needs to satisfy the following requirements: * It needs to use the reactive web stack (Spring WebFlux) and Spring HATEOAS to create links in hypermedia-based responses. * The application infrastructure does not guard against clients submitting (X-)Forwarded… headers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2023-34036
CVE ID: CVE-2023-34037 State: PUBLISHED Published: 2023-08-04T11:18:19.611Z Last Updated: 2024-10-21T17:30:05.673Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: n/a Products: VMware Horizon Server Problem Types: Request smuggling vulnerability Description: VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able to perform HTTP smuggle requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0017.html
CVE ID: CVE-2023-34038 State: PUBLISHED Published: 2023-08-04T11:24:57.885Z Last Updated: 2024-08-02T15:54:14.136Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: VMware Horizon Server Problem Types: Information disclosure vulnerability Description: VMware Horizon Server contains an information disclosure vulnerability. A malicious actor with network access may be able to access information relating to the internal network configuration. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2023-0017.html
CVE ID: CVE-2023-34039 State: PUBLISHED Published: 2023-08-29T17:36:18.899Z Last Updated: 2025-02-13T16:55:14.048Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Aria Operations for Networks Problem Types: Authentication Bypass Vulnerability Description: Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gain access to the Aria Operations for Networks CLI. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisori
Networks CLI. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2023-0018.html - http://packetstormsecurity.com/files/174452/VMWare-Aria-Operations-For-Networks-Remote-Code-Execution.html - http://packetstormsecurity.com/files/175320/VMWare-Aria-Operations-For-Networks-SSH-Private-Key-Exposure.html
CVE ID: CVE-2023-34040 State: PUBLISHED Published: 2023-08-24T12:59:20.620Z Last Updated: 2024-10-01T16:13:52.394Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Spring Products: Spring For Apache Kafka Problem Types: CWE-502 Description: In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers. Specifically, an application is vulnerable when all of the following are true: * The user does not configure an ErrorHandlingDese
lly, an application is vulnerable when all of the following are true: * The user does not configure an ErrorHandlingDeserializer for the key and/or value of the record * The user explicitly sets container properties checkDeserExWhenKeyNull and/or checkDeserExWhenValueNull container properties to true. * The user allows untrusted sources to publish to a Kafka topic By default, these properties are false, and the container only attempts to deserialize the headers if an ErrorHandlingDeserializer is configured. The ErrorHandlingDeserializer prevents the vulnerability by removing any such malicious headers before processing the record. Additional Analyst Notes: - CVE Program Container: - CISA ADP
g any such malicious headers before processing the record. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2023-34040
CVE ID: CVE-2023-34041 State: PUBLISHED Published: 2023-09-08T07:22:00.607Z Last Updated: 2024-08-02T15:54:14.253Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Cloud Foundry Products: Routing, CF Deployment Description: Cloud foundry routing release versions prior to 0.278.0 are vulnerable to abuse of HTTP Hop-by-Hop Headers. An unauthenticated attacker can use this vulnerability for headers like B3 or X-B3-SpanID to affect the identification value recorded in the logs in foundations. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/abuse-of-http-hop-by-hop-headers-in-cloud-foundry-gorouter/
CVE ID: CVE-2023-34042 State: PUBLISHED Published: 2024-02-05T22:00:01.075Z Last Updated: 2025-06-03T18:51:02.797Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: N/A Products: Spring Security Problem Types: Incorrect Permission Assignment for spring-security.xsd Description: The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system. While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical Resource” and could result in an exploit. Users should update to the latest version of Sprin