Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-25469 State: PUBLISHED Published: 2024-12-09T11:31:32.664Z Last Updated: 2024-12-09T18:42:45.251Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Magazine3 Products: Easy Table of Contents Problem Types: CWE-862 Description: Missing Authorization vulnerability in Magazine3 Easy Table of Contents allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Table of Contents: from n/a through 2.0.45.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/easy-table-of-contents/vulnerability/wordpress-easy-table-of-contents-plugin-2-0-45-2-broken-acc
tabase/wordpress/plugin/easy-table-of-contents/vulnerability/wordpress-easy-table-of-contents-plugin-2-0-45-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-25470 State: PUBLISHED Published: 2023-05-26T13:51:17.880Z Last Updated: 2024-11-08T18:41:38.915Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Anton Skorobogatov Products: Rus-To-Lat Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Anton Skorobogatov Rus-To-Lat plugin <= 0.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/rustolat/wordpress-rus-to-lat-plugin-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-25471 State: PUBLISHED Published: 2023-08-30T15:37:32.285Z Last Updated: 2024-09-24T19:08:35.672Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Webcodin Products: WCP OpenWeather Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Webcodin WCP OpenWeather plugin <= 2.5.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wcp-openweather/wordpress-wcp-openweather-plugin-2-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-25472 State: PUBLISHED Published: 2023-05-23T12:20:06.741Z Last Updated: 2025-01-08T22:06:21.581Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Podlove Products: Podlove Podcast Publisher Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Podcast Publisher plugin <= 3.8.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/podlove-podcasting-plugin-for-wordpress/wordpress-podlove-podcast-publisher-plugin-3-8-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-25473 State: PUBLISHED Published: 2023-07-18T11:33:10.733Z Last Updated: 2024-09-25T17:03:26.289Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Miro Mannino Products: Flickr Justified Gallery Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Miro Mannino Flickr Justified Gallery plugin <= 3.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/flickr-justified-gallery/wordpress-flickr-justified-gallery-plugin-3-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-25474 State: PUBLISHED Published: 2023-05-23T15:01:51.824Z Last Updated: 2024-08-02T14:47:50.192Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Csaba Kissi Products: About Me 3000 widget Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Csaba Kissi About Me 3000 widget plugin <= 2.2.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/about-me-3000/wordpress-about-me-3000-widget-plugin-2-2-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-25475 State: PUBLISHED Published: 2023-07-18T11:58:20.481Z Last Updated: 2024-09-25T17:02:33.942Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Vladimir Prelovac Products: Smart YouTube PRO Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Vladimir Prelovac Smart YouTube PRO plugin <= 4.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/smart-youtube/wordpress-smart-youtube-pro-plugin-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-25476 State: PUBLISHED Published: 2023-10-18T07:56:06.571Z Last Updated: 2024-09-12T19:41:03.974Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Ezoic Products: AmpedSense – AdSense Split Tester Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ezoic AmpedSense – AdSense Split Tester plugin <= 4.68 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ampedsense-adsense-split-tester/wordpress-ampedsense-adsense-split-tester-plugin-4-68-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-25477 State: PUBLISHED Published: 2023-09-01T10:38:21.616Z Last Updated: 2024-09-24T19:07:54.130Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Yotuwp Products: Video Gallery Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Yotuwp Video Gallery plugin <= 1.3.12 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/yotuwp-easy-youtube-embed/wordpress-video-gallery-youtube-playlist-channel-gallery-by-yotuwp-plugin-1-3-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-25478 State: PUBLISHED Published: 2023-07-10T12:44:21.490Z Last Updated: 2024-10-07T19:30:51.671Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Jason Rouet Products: Weather Station Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Jason Rouet Weather Station plugin <= 3.8.12 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/live-weather-station/wordpress-weather-station-plugin-3-8-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-25479 State: PUBLISHED Published: 2023-04-25T12:00:04.202Z Last Updated: 2025-01-09T15:34:39.241Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Podlove Products: Podlove Subscribe button Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Podlove Podlove Subscribe button plugin <= 1.3.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/podlove-subscribe-button/wordpress-podlove-subscribe-button-plugin-1-3-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-25480 State: PUBLISHED Published: 2023-10-06T12:41:32.577Z Last Updated: 2024-09-19T14:55:12.085Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: BoldGrid Products: Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.24.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/post-and-page-builder/wordpress-post-and-page-builder-by-boldgrid-plugin-1-24-1-cross-site-reques
database/vulnerability/post-and-page-builder/wordpress-post-and-page-builder-by-boldgrid-plugin-1-24-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-25481 State: PUBLISHED Published: 2023-05-23T12:26:25.243Z Last Updated: 2024-08-02T14:47:42.232Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Podlove Products: Podlove Subscribe button Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Subscribe button plugin <= 1.3.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/podlove-subscribe-button/wordpress-podlove-subscribe-button-plugin-1-3-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-25482 State: PUBLISHED Published: 2023-07-18T11:29:24.352Z Last Updated: 2024-09-25T17:03:33.082Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Mike Martel Products: WP Tiles Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Mike Martel WP Tiles plugin <= 1.1.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-tiles/wordpress-wp-tiles-plugin-1-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-25483 State: PUBLISHED Published: 2023-09-27T07:42:48.470Z Last Updated: 2024-09-23T12:52:01.579Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Ankit Agarwal, Priyanshu Mittal Products: Easy Coming Soon Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ankit Agarwal, Priyanshu Mittal Easy Coming Soon plugin <= 2.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/easy-coming-soon/wordpress-easy-coming-soon-plugin-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-25484 State: PUBLISHED Published: 2023-04-25T16:50:45.908Z Last Updated: 2025-01-09T15:34:27.177Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Oliver Schlöbe Products: Simple Yearly Archive Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Oliver Schlöbe Simple Yearly Archive plugin <= 2.1.8 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/simple-yearly-archive/wordpress-simple-yearly-archive-plugin-2-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-25485 State: PUBLISHED Published: 2023-04-25T18:33:47.611Z Last Updated: 2025-01-09T15:34:06.293Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Bernhard Kux Products: JSON Content Importer Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bernhard Kux JSON Content Importer plugin <= 1.3.15 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/json-content-importer/wordpress-json-content-importer-plugin-1-3-15-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-25486 State: PUBLISHED Published: 2024-12-09T11:31:31.871Z Last Updated: 2024-12-09T18:42:53.024Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Migrate Products: Clone Problem Types: CWE-862 Description: Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a through 2.3.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-clone-by-wp-academy/vulnerability/wordpress-clone-plugin-2-3-7-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-25487 State: PUBLISHED Published: 2023-07-11T07:25:16.209Z Last Updated: 2024-10-07T17:34:37.577Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Pixelgrade Products: PixTypes Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade PixTypes plugin <= 1.4.14 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/pixtypes/wordpress-pixtypes-plugin-1-4-14-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-25488 State: PUBLISHED Published: 2023-09-01T10:54:52.277Z Last Updated: 2025-02-19T21:25:06.107Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Duc Bui Quang Products: WP Default Feature Image Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Duc Bui Quang WP Default Feature Image plugin <= 1.0.1.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-default-feature-image/wordpress-wp-default-feature-image-plugin-1-0-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-25489 State: PUBLISHED Published: 2023-10-04T10:35:25.647Z Last Updated: 2024-09-19T17:58:46.800Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Jeff Sherk Products: Update Theme and Plugins from Zip File Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Jeff Sherk Update Theme and Plugins from Zip File plugin <= 2.0.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/update-theme-and-plugins-from-zip-file/wordpress-update-theme-and-plugins-from-zip-file-plugin-2-0-0-cross-site-request-forgery-csrf-vulnerabili
-from-zip-file/wordpress-update-theme-and-plugins-from-zip-file-plugin-2-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-25490 State: PUBLISHED Published: 2023-04-25T11:46:23.083Z Last Updated: 2025-01-09T15:34:48.472Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Eric Teubert Products: Archivist – Custom Archive Templates Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin <= 1.7.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/archivist-custom-archive-templates/wordpress-archivist-custom-archive-templates-plugin-1-7-4-cross-site-scripting-xss-vulnerabilit
custom-archive-templates/wordpress-archivist-custom-archive-templates-plugin-1-7-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-25491 State: PUBLISHED Published: 2023-05-06T22:55:17.758Z Last Updated: 2024-08-02T13:44:25.683Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Samuel Marshall Products: JCH Optimize Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Samuel Marshall JCH Optimize plugin <= 3.2.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/jch-optimize/wordpress-jch-optimize-plugin-3-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-25492 State: PUBLISHED Published: 2023-05-01T14:11:48.551Z Last Updated: 2025-01-30T15:53:03.655Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Lenovo Products: XClarity Controller Problem Types: CWE-134 Description: A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string injection vulnerability in a web interface API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-99936
CVE ID: CVE-2023-25493 State: PUBLISHED Published: 2024-04-05T20:46:00.491Z Last Updated: 2024-09-16T14:50:40.027Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: BIOS Problem Types: CWE-306 Description: A potential vulnerability was reported in the BIOS update tool driver for some Desktop, Smart Edge, Smart Office, and ThinkStation products that could allow a local user with elevated privileges to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-141775
CVE ID: CVE-2023-25494 State: PUBLISHED Published: 2024-04-05T20:46:09.016Z Last Updated: 2024-08-02T11:25:18.856Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Desktop BIOS, Smart Edge BIOS, ThinkStation BIOS Problem Types: CWE-125 Description: A potential vulnerability were reported in the BIOS of some Desktop, Smart Edge, and ThinkStation products that could allow a local attacker with elevated privileges to write to NVRAM variables. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-141775
CVE ID: CVE-2023-25495 State: PUBLISHED Published: 2023-04-28T21:26:12.202Z Last Updated: 2025-01-30T18:25:51.209Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Lenovo Products: XClarity Controller Problem Types: CWE-522 Description: A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations. There is no exposure where no LDAP client password is configured Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-99936
CVE ID: CVE-2023-25496 State: PUBLISHED Published: 2023-04-28T21:13:41.817Z Last Updated: 2025-01-30T18:26:10.385Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Lenovo Drivers Management Problem Types: CWE-284 Description: A privilege escalation vulnerability was reported in Lenovo Drivers Management Lenovo Driver Manager that could allow a local user to execute code with elevated privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/dc_415202.html
CVE ID: CVE-2023-25499 State: PUBLISHED Published: 2023-06-22T12:47:57.760Z Last Updated: 2024-12-05T19:58:49.359Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: vaadin Products: vaadin, flow-server Problem Types: CWE-200 Description: When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vaadin.com/security/CVE-2023-2
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vaadin.com/security/CVE-2023-25499 - https://github.com/vaadin/flow/pull/15885
CVE ID: CVE-2023-25500 State: PUBLISHED Published: 2023-06-22T12:49:06.603Z Last Updated: 2024-12-05T19:59:30.912Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: vaadin, flow Products: vaadin, flow-server Problem Types: CWE-200 Description: Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vaadin/flow/pull/16935 - https://v
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vaadin/flow/pull/16935 - https://vaadin.com/security/cve-2023-25500
CVE ID: CVE-2023-25504 State: PUBLISHED Published: 2023-04-17T16:29:43.729Z Last Updated: 2025-02-13T16:44:30.258Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-918 Description: A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed. This vulnerability exists in Apache Superset versions up to and including 2.0.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vu
in Apache Superset versions up to and including 2.0.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/tdnzkocfsqg2sbbornnp9g492fn4zhtx - http://www.openwall.com/lists/oss-security/2023/04/18/8
CVE ID: CVE-2023-25505 State: PUBLISHED Published: 2023-04-22T02:29:45.535Z Last Updated: 2025-02-04T19:04:20.964Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NVIDIA Products: NVIDIA DGX servers Problem Types: CWE-120 Description: NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler of the AMI MegaRAC BMC , where an attacker with the appropriate level of authorization can cause a buffer overflow, which may lead to denial of service, information disclosure, or arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5458
CVE ID: CVE-2023-25506 State: PUBLISHED Published: 2023-04-22T02:30:26.791Z Last Updated: 2025-02-04T19:03:47.410Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: NVIDIA Products: NVIDIA DGX servers Problem Types: CWE-788 Description: NVIDIA DGX-1 contains a vulnerability in Ofbd in AMI SBIOS, where a preconditioned heap can allow a user with elevated privileges to cause an access beyond the end of a buffer, which may lead to code execution, escalation of privileges, denial of service and information disclosure. The scope of the impact of this vulnerability can extend to other components. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
s vulnerability can extend to other components. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5458
CVE ID: CVE-2023-25507 State: PUBLISHED Published: 2023-04-22T02:31:16.047Z Last Updated: 2025-02-04T19:03:26.066Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: NVIDIA Products: NVIDIA DGX servers Problem Types: CWE-78 Description: NVIDIA DGX-1 BMC contains a vulnerability in the SPX REST API, where an attacker with the appropriate level of authorization can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure, and data tampering. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5458
CVE ID: CVE-2023-25508 State: PUBLISHED Published: 2023-04-22T02:32:04.737Z Last Updated: 2025-02-04T19:03:07.602Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: NVIDIA Products: NVIDIA DGX servers Problem Types: CWE-22 Description: NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler, where an attacker with the appropriate level of authorization can upload and download arbitrary files under certain circumstances, which may lead to denial of service, escalation of privileges, information disclosure, and data tampering. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/d