Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-4645 State: PUBLISHED Published: 2023-10-19T01:53:49.809Z Last Updated: 2025-02-05T19:13:04.797Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: spacetime Products: Ad Inserter – Ad Manager & AdSense Ads Problem Types: CWE-862 Missing Authorization Description: The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai_ajax function. This can allow unauthenticated attackers to extract sensitive data such as post titles and slugs (including those of protected posts along with their passwords), usernames, available roles, the plugin license key provided the remote debugging
cted posts along with their passwords), usernames, available roles, the plugin license key provided the remote debugging option is enabled. In the default state it is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/57b3eef3-e165-45ac-89d7-2a2a6529b310?source=cve - https://plugins.trac.wordpress.org/browser/ad-inserter/trunk/ad-inserter.php#L6529 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2969942%40ad-inserter%2Ftags%2F2.7.31&old=2922718%40ad-inserter%2Ftrunk
CVE ID: CVE-2023-4646 State: PUBLISHED Published: 2023-10-16T19:39:14.025Z Last Updated: 2025-04-23T16:12:06.972Z Vendors: Unknown Products: Simple Posts Ticker Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple Posts Ticker WordPress plugin before 1.1.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c34f8dcc-3be6-44ad-91a4-7c3a0ce2f9d7
CVE ID: CVE-2023-4647 State: PUBLISHED Published: 2023-09-01T10:30:27.108Z Last Updated: 2024-10-03T06:23:14.931Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which the projects API pagination can be skipped, potentially leading to DoS on certain instances. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/414502
CVE ID: CVE-2023-4648 State: PUBLISHED Published: 2023-10-20T07:29:40.773Z Last Updated: 2025-02-05T19:02:39.068Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: bompus Products: WP Customer Reviews Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Customer Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pag
ible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f81950be-de32-4fa1-94fe-42667414fe2d?source=cve - https://plugins.trac.wordpress.org/changeset/2965658/wp-customer-reviews/trunk?contextall=1&old=2882143&old_path=%2Fwp-customer-reviews%2Ftrunk
CVE ID: CVE-2023-4649 State: PUBLISHED Published: 2023-08-31T00:00:19.715Z Last Updated: 2024-10-01T18:37:20.865Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: instantsoft Products: instantsoft/icms2 Problem Types: CWE-384 Description: Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/069bb1f3-0805-480d-a6e1-b3345cdc60f3 - https://github.com/instantsoft/icms2/commit/ca5f150da11d9caae86638885137afe35bcc3592
CVE ID: CVE-2023-4650 State: PUBLISHED Published: 2023-08-31T00:00:19.835Z Last Updated: 2024-10-01T19:24:19.429Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: instantsoft Products: instantsoft/icms2 Problem Types: CWE-284 Description: Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/d92e8985-9d9d-4a62-92e8-ada014ee3b17 - https://github.com/instantsoft/icms2/commit/78ff8ca066e86a65ff35470b5622be3aa7d2f928
CVE ID: CVE-2023-4651 State: PUBLISHED Published: 2023-08-31T00:00:19.707Z Last Updated: 2024-10-01T18:41:52.148Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: instantsoft Products: instantsoft/icms2 Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/beba9b98-2a5c-4629-987d-b67f47ba9437 - https://github.com/instantsoft/icms2/commit/a6bf758de0b3242b0c0e4b47a588aae0c94305b0
CVE ID: CVE-2023-4652 State: PUBLISHED Published: 2023-08-31T00:00:19.459Z Last Updated: 2024-10-01T18:00:44.147Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: instantsoft Products: instantsoft/icms2 Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/7869e4af-fad9-48c3-9e4f-c949e54cbb41 - https://github.com/instantsoft/icms2/commit/7a7e57e77f12f36d0e96be6d5b9066389372dbcd
CVE ID: CVE-2023-4653 State: PUBLISHED Published: 2023-08-31T00:00:19.557Z Last Updated: 2024-10-01T18:21:38.757Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H) Vendors: instantsoft Products: instantsoft/icms2 Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/e0bf7e95-fc8c-4fd4-8575-8b46b9431c6d - https://github.com/instantsoft/icms2/commit/7e9d79818bd52dfa7811d5978c72785054c65242
CVE ID: CVE-2023-4654 State: PUBLISHED Published: 2023-08-31T00:00:44.025Z Last Updated: 2024-10-01T18:05:45.506Z Severity: LOW (CVSS 2.6 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: instantsoft Products: instantsoft/icms2 Problem Types: CWE-614 Description: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/56432a75-af43-4b1a-9307-bd8de568351b - https://github.com/instantsoft/icms2/commit/ca5f150da11d9caae86638885137afe35bcc3592
CVE ID: CVE-2023-4655 State: PUBLISHED Published: 2023-08-31T00:00:42.783Z Last Updated: 2024-10-01T18:06:17.491Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: instantsoft Products: instantsoft/icms2 Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/e2189ad5-b665-4ba5-b6c4-112e58ae9a97 - https://github.com/instantsoft/icms2/commit/a6a30e7bc96cd2081707388046c0259870533da6
CVE ID: CVE-2023-4656 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:19.977Z Description: No description available.
CVE ID: CVE-2023-4658 State: PUBLISHED Published: 2023-12-01T07:01:58.125Z Last Updated: 2025-11-20T04:09:48.351Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the `Allowed to merge` permission as a guest user, when granted the permission through a group. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/423835
p. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/423835 - https://hackerone.com/reports/2104540
CVE ID: CVE-2023-4659 State: PUBLISHED Published: 2023-10-02T14:05:20.926Z Last Updated: 2024-09-20T14:52:13.615Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Free5Gc Products: Open5Gc Problem Types: CWE-352 Description: Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the platform as an administrator, simply by changing the token value to "admin". It is also possible to perform POST, GET and DELETE requests without any token value. Therefore, an unprivileged remote user is able to create, delete and modify users within theapplication. Additional Analyst Notes: - CVE Program Container:
er is able to create, delete and modify users within theapplication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-request-forgery-free5gc
CVE ID: CVE-2023-4661 State: PUBLISHED Published: 2023-09-15T08:34:57.980Z Last Updated: 2024-09-25T15:17:16.347Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Saphira Products: Saphira Connect Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saphira Saphira Connect allows SQL Injection.This issue affects Saphira Connect: before 9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0535
CVE ID: CVE-2023-4662 State: PUBLISHED Published: 2023-09-15T08:36:04.782Z Last Updated: 2024-12-03T14:45:35.332Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Saphira Products: Saphira Connect Problem Types: CWE-250 Description: Execution with Unnecessary Privileges vulnerability in Saphira Saphira Connect allows Remote Code Inclusion.This issue affects Saphira Connect: before 9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0535
CVE ID: CVE-2023-4663 State: PUBLISHED Published: 2023-09-15T08:37:18.453Z Last Updated: 2024-09-24T18:20:55.389Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Saphira Products: Saphira Connect Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Saphira Saphira Connect allows Reflected XSS.This issue affects Saphira Connect: before 9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0535
CVE ID: CVE-2023-4664 State: PUBLISHED Published: 2023-09-15T08:38:09.957Z Last Updated: 2024-08-02T07:31:06.680Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Saphira Products: Saphira Connect Problem Types: CWE-276 Description: Incorrect Default Permissions vulnerability in Saphira Saphira Connect allows Privilege Escalation.This issue affects Saphira Connect: before 9. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-23-0535
CVE ID: CVE-2023-4665 State: PUBLISHED Published: 2023-09-15T08:39:57.272Z Last Updated: 2024-09-25T15:16:05.399Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Saphira Products: Saphira Connect Problem Types: CWE-279 Description: Incorrect Execution-Assigned Permissions vulnerability in Saphira Saphira Connect allows Privilege Escalation.This issue affects Saphira Connect: before 9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0535
CVE ID: CVE-2023-4666 State: PUBLISHED Published: 2023-10-16T19:39:11.293Z Last Updated: 2025-04-23T16:12:18.603Z Vendors: Unknown Products: Form Maker by 10Web Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c6597e36-02d6-46b4-89db-52c160f418be
CVE ID: CVE-2023-4667 State: PUBLISHED Published: 2023-11-28T08:09:10.450Z Last Updated: 2024-10-17T16:26:43.231Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: IDEMIA Products: SIGMA Lite & Lite +, SIGMA Wide, SIGMA Extreme, MorphoWave Compact/XP, VisionPass, MorphoWave SP Problem Types: CWE-79 Description: The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface. The root cause of the vulnerability is inadequate input validation and output encoding in the web administrat
interface. The root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware. This could lead to unauthorized access and data leakage Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.idemia.com/vulnerability-information
CVE ID: CVE-2023-4668 State: PUBLISHED Published: 2023-10-20T07:29:32.176Z Last Updated: 2025-02-05T19:04:03.221Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: spacetime Products: Ad Inserter – Ad Manager & AdSense Ads Problem Types: CWE-862 Missing Authorization Description: The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-processing-fe URL parameter. This can allow unauthenticated attackers to extract sensitive data including installed plugins (present and active), active theme, various plugin settings, WordPress version, as well as some server settings such as memory
t and active), active theme, various plugin settings, WordPress version, as well as some server settings such as memory limit, installation paths. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ce457c98-c55b-4b71-a80b-393eceb9effd?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2969942%40ad-inserter%2Ftags%2F2.7.31&old=2922718%40ad-inserter%2Ftrunk
CVE ID: CVE-2023-4669 State: PUBLISHED Published: 2023-09-14T18:34:40.357Z Last Updated: 2024-09-25T19:37:22.822Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Exagate Products: SYSGuard 3001 Problem Types: CWE-302 Description: Authentication Bypass by Assumed-Immutable Data vulnerability in Exagate SYSGuard 3001 allows Authentication Bypass.This issue affects SYSGuard 3001: before 3.2.20.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0525
CVE ID: CVE-2023-4670 State: PUBLISHED Published: 2023-09-15T07:24:13.607Z Last Updated: 2024-09-25T15:22:44.246Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Innosa Products: Probbys Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Innosa Probbys allows SQL Injection.This issue affects Probbys: before 2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0531
CVE ID: CVE-2023-4671 State: PUBLISHED Published: 2023-12-28T09:26:25.871Z Last Updated: 2024-11-25T13:31:15.889Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Talent Software Products: ECOP Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Talent Software ECOP allows Command Line Execution through SQL Injection.This issue affects ECOP: before 32255. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-23-0737
CVE ID: CVE-2023-4672 State: PUBLISHED Published: 2023-12-28T09:32:08.926Z Last Updated: 2024-08-02T07:31:06.571Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Talent Software Products: ECOP Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Talent Software ECOP allows Reflected XSS.This issue affects ECOP: before 32255. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-23-0737
CVE ID: CVE-2023-4673 State: PUBLISHED Published: 2023-09-15T05:38:51.703Z Last Updated: 2024-09-25T15:26:30.489Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sanalogy Products: Turasistan Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sanalogy Turasistan allows SQL Injection.This issue affects Turasistan: before 20230911 . Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0528
CVE ID: CVE-2023-4674 State: PUBLISHED Published: 2023-12-29T14:38:40.026Z Last Updated: 2024-08-02T07:31:06.725Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Yaztek Software Technologies and Computer Systems Products: E-Commerce Software Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yaztek Software Technologies and Computer Systems E-Commerce Software allows SQL Injection.This issue affects E-Commerce Software: through 20231229. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Conta
was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-23-0741
CVE ID: CVE-2023-4675 State: PUBLISHED Published: 2023-12-29T14:42:55.814Z Last Updated: 2025-04-17T20:15:20.578Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: GM Information Technologies Products: MDO Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GM Information Technologies MDO allows SQL Injection.This issue affects MDO: through 20231229. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0742
CVE ID: CVE-2023-4676 State: PUBLISHED Published: 2023-09-14T19:37:53.663Z Last Updated: 2024-09-24T20:35:48.291Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Yordam Products: MedasPro Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yordam MedasPro allows Reflected XSS.This issue affects MedasPro: before 28. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0527
CVE ID: CVE-2023-4677 State: PUBLISHED Published: 2023-11-23T14:22:01.559Z Last Updated: 2024-12-02T19:39:44.273Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-287 Description: Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory for cron log backups. The contents of these log files can then be abused to authenticate to the application as an administrator. This issue affects Pandora FMS <= 772. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pandorafms.c
S <= 772. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2023-4678 State: PUBLISHED Published: 2023-08-31T15:47:53.545Z Last Updated: 2024-09-19T15:37:05.077Z Severity: MEDIUM (CVSS 5.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: gpac Products: gpac/gpac Problem Types: CWE-369 Description: Divide By Zero in GitHub repository gpac/gpac prior to 2.3-DEV. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/688a4a01-8c18-469d-8cbe-a2e79e80c877 - https://github.com/gpac/gpac/commit/4607052c482a51dbdacfe1ade10645c181d07b07
CVE ID: CVE-2023-4679 State: PUBLISHED Published: 2024-11-15T10:53:32.070Z Last Updated: 2024-11-15T19:12:15.195Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: gpac Products: gpac/gpac Problem Types: CWE-416 Description: A use after free vulnerability exists in GPAC version 2.3-DEV-revrelease, specifically in the gf_filterpacket_del function in filter_core/filter.c at line 38. This vulnerability can lead to a double-free condition, which may cause the application to crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/6f721ee7-8785-4c26-801e-f40fed3faaac - https://github.com/gpac/gpac/commit/b68b3f0bf5c366e0032
ttps://huntr.com/bounties/6f721ee7-8785-4c26-801e-f40fed3faaac - https://github.com/gpac/gpac/commit/b68b3f0bf5c366e003221d78fd663a1d5514a876
CVE ID: CVE-2023-4680 State: PUBLISHED Published: 2023-09-14T23:06:24.546Z Last Updated: 2024-09-26T17:38:48.629Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: HashiCorp Products: Vault, Vault Enterprise Problem Types: CWE-323 Description: HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7
subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249