Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-4623 State: PUBLISHED Published: 2023-09-06T13:56:57.295Z Last Updated: 2025-02-27T21:00:32.991Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Kernel Problem Types: CWE-416 Description: A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after
he parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free. We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b3d26c5702c7d6c45456326e56d2ccf3f103e60f - https://kernel.dance/b3d26c5702c7d6c45456326e56d2ccf3f103e60f - https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html - http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html - https://lists.debian.org/debian-lts-announce/2024/01/msg
iles/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html - https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
CVE ID: CVE-2023-4624 State: PUBLISHED Published: 2023-08-30T12:02:20.664Z Last Updated: 2024-10-01T18:39:14.627Z Severity: LOW (CVSS 2.4 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: bookstackapp Products: bookstackapp/bookstack Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/9ce5cef6-e546-44e7-addf-a2726fa4e60c - https://github.com/bookstackapp/bookstack/commit/c324ad928dbdd54ce5b09eb0dabe60ef9de1ea38
CVE ID: CVE-2023-4625 State: PUBLISHED Published: 2023-11-06T04:57:44.446Z Last Updated: 2025-02-27T20:34:25.710Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Mitsubishi Electric Corporation Products: MELSEC iQ-F Series FX5U-32MT/ES, MELSEC iQ-F Series FX5U-64MT/ES, MELSEC iQ-F Series FX5U-80MT/ES, MELSEC iQ-F Series FX5U-32MR/ES, MELSEC iQ-F Series FX5U-64MR/ES, MELSEC iQ-F Series FX5U-80MR/ES, MELSEC iQ-F Series FX5U-32MT/DS, MELSEC iQ-F Series FX5U-64MT/DS, MELSEC iQ-F Series FX5U-80MT/DS, MELSEC iQ-F Series FX5U-32MR/DS, MELSEC iQ-F Series FX5U-64MR/DS, MELSEC iQ-F Series FX5U-80MR/DS, MELSEC iQ-F Series FX5U-32MT/ESS, MELSEC iQ-F Series FX5U-64MT/ESS
Series FX5U-64MR/DS, MELSEC iQ-F Series FX5U-80MR/DS, MELSEC iQ-F Series FX5U-32MT/ESS, MELSEC iQ-F Series FX5U-64MT/ESS, MELSEC iQ-F Series FX5U-80MT/ESS, MELSEC iQ-F Series FX5U-32MT/DSS, MELSEC iQ-F Series FX5U-64MT/DSS, MELSEC iQ-F Series FX5U-80MT/DSS, MELSEC iQ-F Series FX5UC-32MT/D, MELSEC iQ-F Series FX5UC-64MT/D, MELSEC iQ-F Series FX5UC-96MT/D, MELSEC iQ-F Series FX5UC-32MT/DSS, MELSEC iQ-F Series FX5UC-64MT/DSS, MELSEC iQ-F Series FX5UC-96MT/DSS, MELSEC iQ-F Series FX5UC-32MT/DS-TS, MELSEC iQ-F Series FX5UC-32MT/DSS-TS, MELSEC iQ-F Series FX5UC-32MR/DS-TS, MELSEC iQ-F Series FX5UJ-24MT/ES, MELSEC iQ-F Series FX5UJ-40MT/ES, MELSEC iQ-F Series FX5UJ-60MT/ES, MELSEC iQ-F Series FX5UJ
iQ-F Series FX5UJ-24MT/ES, MELSEC iQ-F Series FX5UJ-40MT/ES, MELSEC iQ-F Series FX5UJ-60MT/ES, MELSEC iQ-F Series FX5UJ-24MR/ES, MELSEC iQ-F Series FX5UJ-40MR/ES, MELSEC iQ-F Series FX5UJ-60MR/ES, MELSEC iQ-F Series FX5UJ-24MT/ESS, MELSEC iQ-F Series FX5UJ-40MT/ESS, MELSEC iQ-F Series FX5UJ-60MT/ESS, MELSEC iQ-F Series FX5UJ-24MT/DS, MELSEC iQ-F Series FX5UJ-40MT/DS, MELSEC iQ-F Series FX5UJ-60MT/DS, MELSEC iQ-F Series FX5UJ-24MR/DS, MELSEC iQ-F Series FX5UJ-40MR/DS, MELSEC iQ-F Series FX5UJ-60MR/DS, MELSEC iQ-F Series FX5UJ-24MT/DSS, MELSEC iQ-F Series FX5UJ-40MT/DSS, MELSEC iQ-F Series FX5UJ-60MT/DSS, MELSEC iQ-F Series FX5UJ-24MT/ES-A, MELSEC iQ-F Series FX5UJ-40MT/ES-A, MELSEC iQ-F Seri
SEC iQ-F Series FX5UJ-60MT/DSS, MELSEC iQ-F Series FX5UJ-24MT/ES-A, MELSEC iQ-F Series FX5UJ-40MT/ES-A, MELSEC iQ-F Series FX5UJ-60MT/ES-A, MELSEC iQ-F Series FX5UJ-24MR/ES-A, MELSEC iQ-F Series FX5UJ-40MR/ES-A, MELSEC iQ-F Series FX5UJ-60MR/ES-A, MELSEC iQ-F Series FX5S-30MT/ES, MELSEC iQ-F Series FX5S-40MT/ES, MELSEC iQ-F Series FX5S-60MT/ES, MELSEC iQ-F Series FX5S-80MT/ES, MELSEC iQ-F Series FX5S-30MR/ES, MELSEC iQ-F Series FX5S-40MR/ES, MELSEC iQ-F Series FX5S-60MR/ES, MELSEC iQ-F Series FX5S-80MR/ES, MELSEC iQ-F Series FX5S-30MT/ESS, MELSEC iQ-F Series FX5S-40MT/ESS, MELSEC iQ-F Series FX5S-60MT/ESS, MELSEC iQ-F Series FX5S-80MT/ESS, MELSEC iQ-R Series R00CPU, MELSEC iQ-R Series R01CPU
MELSEC iQ-F Series FX5S-60MT/ESS, MELSEC iQ-F Series FX5S-80MT/ESS, MELSEC iQ-R Series R00CPU, MELSEC iQ-R Series R01CPU, MELSEC iQ-R Series R02CPU, MELSEC iQ-R Series R04CPU, MELSEC iQ-R Series R08CPU, MELSEC iQ-R Series R16CPU, MELSEC iQ-R Series R32CPU, MELSEC iQ-R Series R120CPU, MELSEC iQ-R Series R04ENCPU, MELSEC iQ-R Series R08ENCPU, MELSEC iQ-R Series R16ENCPU, MELSEC iQ-R Series R32ENCPU, MELSEC iQ-R Series R120ENCPU, MELSEC iQ-R Series R08PCPU, MELSEC iQ-R Series R16PCPU, MELSEC iQ-R Series R32PCPU, MELSEC iQ-R Series R120PCPU Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F/iQ
mproper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F/iQ-R Series CPU modules Web server function allows a remote unauthenticated attacker to prevent legitimate users from logging into the Web server function for a certain period after the attacker has attempted to log in illegally by continuously attempting unauthorized login to the Web server function. The impact of this vulnerability will persist while the attacker continues to attempt unauthorized login. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-014_en.pdf - htt
CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-014_en.pdf - https://jvn.jp/vu/JVNVU94620134 - https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-02
CVE ID: CVE-2023-4626 State: PUBLISHED Published: 2024-03-12T09:33:55.378Z Last Updated: 2024-08-05T17:25:10.040Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: binhnguyenplus Products: LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… Problem Types: CWE-862 Missing Authorization Description: The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ladiflow_save_hook() function in versions up to, and including, 4.3. This makes it possible for authenticated attackers with subscriber-level access and above to update the 'ladiflow_hook_configs' option. Additional Analys
ticated attackers with subscriber-level access and above to update the 'ladiflow_hook_configs' option. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/47dccf26-6c8d-4418-a874-c29749bee537?source=cve - https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L1983
CVE ID: CVE-2023-4627 State: PUBLISHED Published: 2024-03-12T09:33:56.315Z Last Updated: 2024-08-22T20:45:24.956Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: binhnguyenplus Products: LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… Problem Types: CWE-862 Missing Authorization Description: The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_config() function in versions up to, and including, 4.4. This makes it possible for authenticated attackers with subscriber-level access and above to update the 'ladipage_config' option. Additional Analyst Notes: - CV
attackers with subscriber-level access and above to update the 'ladipage_config' option. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d8074af6-cb2c-44db-9110-517f33caa96e?source=cve - https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L1971
CVE ID: CVE-2023-4628 State: PUBLISHED Published: 2024-03-12T09:33:54.384Z Last Updated: 2025-04-16T15:39:23.015Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: binhnguyenplus Products: LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the ladiflow_save_hook() function in versions up to, and including, 4.4. This makes it possible for unauthenticated attackers to update the 'ladiflow_hook_configs' option via a forged request granted they can trick a site admi
enticated attackers to update the 'ladiflow_hook_configs' option via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0be418fa-f1cf-4aaf-bc94-c8e04186a54b?source=cve - https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L1983
CVE ID: CVE-2023-4629 State: PUBLISHED Published: 2024-03-12T09:33:57.201Z Last Updated: 2024-08-02T07:31:06.547Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: binhnguyenplus Products: LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the save_config() function in versions up to, and including, 4.3. This makes it possible for unauthenticated attackers to update the 'ladipage_config' option via a forged request granted they can trick a site administrator int
ed attackers to update the 'ladipage_config' option via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ea595e78-f4fc-491d-8143-c836302618d5?source=cve - https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L1971
CVE ID: CVE-2023-4630 State: PUBLISHED Published: 2023-09-11T13:01:02.519Z Last Updated: 2024-10-03T06:23:14.833Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-862 Description: An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which any user can read limited information about any project's imports. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/415117
CVE ID: CVE-2023-4631 State: PUBLISHED Published: 2023-09-25T15:56:54.321Z Last Updated: 2025-04-23T16:15:39.315Z Vendors: Unknown Products: DoLogin Security Problem Types: CWE-290 Authentication Bypass by Spoofing Description: The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/28613fc7-1400-4553-bcc3-24df1cee418e
CVE ID: CVE-2023-4632 State: PUBLISHED Published: 2023-11-08T21:58:16.371Z Last Updated: 2024-09-03T20:11:48.263Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Lenovo System Update Problem Types: CWE-427 Description: An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-135367
CVE ID: CVE-2023-4634 State: PUBLISHED Published: 2023-09-06T08:27:50.147Z Last Updated: 2025-02-05T19:30:43.507Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: dglingren Products: Media Library Assistant Problem Types: CWE-73 External Control of File Name or Path Description: The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from the ~/includes/mla-stream-image.php file, where images are processed via Imagick(). This makes it possible for unauthenticated
includes/mla-stream-image.php file, where images are processed via Imagick(). This makes it possible for unauthenticated attackers to supply files via FTP that will make directory lists, local file inclusion, and remote code execution possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/05c68377-feb6-442d-a3a0-1fbc246c7cbf?source=cve - https://packetstormsecurity.com/files/174508/wpmla309-lfiexec.tgz - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2955933%40media-library-assistant&new=2955933%40media-library-assistant&sfp_email=&sfph_mail=#file4 - https:
poname=&old=2955933%40media-library-assistant&new=2955933%40media-library-assistant&sfp_email=&sfph_mail=#file4 - https://patrowl.io/blog-wordpress-media-library-rce-cve-2023-4634/ - https://github.com/Patrowl/CVE-2023-4634/
CVE ID: CVE-2023-4635 State: PUBLISHED Published: 2023-10-21T07:33:23.554Z Last Updated: 2025-02-05T18:59:44.300Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ashanjay Products: EventON Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The EventON plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into pe
henticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/115ad0b2-febe-485a-8fb5-9bd6edc37ef7?source=cve - https://github.com/xsn1210/vul/blob/main/xss%5BEventON%5D%20.md
CVE ID: CVE-2023-4636 State: PUBLISHED Published: 2023-09-05T02:25:43.851Z Last Updated: 2025-02-05T19:31:34.308Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: deepakkite Products: WordPress File Sharing Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WordPress File Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbi
ping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1df04293-87e9-4ab4-975d-54d36a993ab0?source=cve - https://github.com/xsn1210/vul2/blob/main/xss%5BWordPressFile%5D%20.md - https://plugins.trac.wordpress.org/changeset/2961909/user-private-files
CVE ID: CVE-2023-4637 State: PUBLISHED Published: 2024-02-05T21:21:59.862Z Last Updated: 2024-08-21T15:35:59.814Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: wpvividplugins Products: Migration, Backup, Staging – WPvivid Problem Types: CWE-862 Missing Authorization Description: The WPvivid plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the restore() and get_restore_progress() function in versions up to, and including, 0.9.94. This makes it possible for unauthenticated attackers to invoke these functions and obtain full file paths if they have access to a back-up ID. Additional Analyst Notes: - CVE Pr
nvoke these functions and obtain full file paths if they have access to a back-up ID. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bad0bd6b-9c88-4d31-90b5-92d3ceb8c0af?source=cve - https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/class-wpvivid.php#L3943 - https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/class-wpvivid.php#L3736 - https://plugins.trac.wordpress.org/changeset/3023214/wpvivid-backuprestore/trunk/includes/class-wpvivid.php?contextall=1&old=3007861&old_path=%2Fwpvivid-backuprestore%2Ftrunk%2Fincludes%2Fclass-wpvivid.ph
ludes/class-wpvivid.php?contextall=1&old=3007861&old_path=%2Fwpvivid-backuprestore%2Ftrunk%2Fincludes%2Fclass-wpvivid.php
CVE ID: CVE-2023-4639 State: PUBLISHED Published: 2024-11-17T10:21:44.539Z Last Updated: 2025-02-07T17:02:40.205Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Migration Toolkit for Runtimes 1 on RHEL 8, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9, Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8, Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9, Migration Toolkit for Applications 6,
form 8.0 for RHEL 8, Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9, Migration Toolkit for Applications 6, Red Hat build of Apache Camel for Spring Boot 3, Red Hat build of Apicurio Registry, Red Hat build of Quarkus, Red Hat Data Grid 8, Red Hat Decision Manager 7, Red Hat Fuse 7, Red Hat Integration Camel K, Red Hat Integration Camel Quarkus, Red Hat Integration Change Data Capture, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform 6, Red Hat JBoss Fuse 6, Red Hat JBoss Fuse Service Works 6, Red Hat Process Automation 7, Red Hat Single Sign-On 7 Problem Types: CWE-444 Description: A flaw was found in Undertow, which incorrectly parses cookies with certa
Sign-On 7 Problem Types: CWE-444 Description: A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:1674 - https://access.redhat.com/errata/RHSA-2024:1675 - https://access.redhat.com/errata/RHSA-2024:1676 - https://access
674 - https://access.redhat.com/errata/RHSA-2024:1675 - https://access.redhat.com/errata/RHSA-2024:1676 - https://access.redhat.com/errata/RHSA-2024:1677 - https://access.redhat.com/errata/RHSA-2024:2763 - https://access.redhat.com/errata/RHSA-2024:2764 - https://access.redhat.com/errata/RHSA-2024:3919 - https://access.redhat.com/security/cve/CVE-2023-4639 - https://bugzilla.redhat.com/show_bug.cgi?id=2166022
CVE ID: CVE-2023-4640 State: PUBLISHED Published: 2023-08-30T16:42:45.242Z Last Updated: 2024-10-01T18:31:56.957Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: YugabyteDB Products: Anywhere Problem Types: CWE-284 Description: The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noting that it extends Controller rather than AuthenticatedController and includes no further checks. This issue affects YugabyteDB Anywhere: from 2.0.0 through 2.17.3 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.yugabyte.com
.17.3 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.yugabyte.com/
CVE ID: CVE-2023-4641 State: PUBLISHED Published: 2023-12-27T15:43:22.929Z Last Updated: 2025-11-03T19:28:32.370Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-303 Description: A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may
password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2023:6632 - https://access.redhat.com/errata/RHSA-2023:7112 - https://access.redhat.com/errata/RHSA-2024:0417 - https://access.redhat.com/errata/RHSA-2024:2577 - https://access.redhat.com/security/cve/CVE-2023-4641 - https://bugzilla.redhat.com/show_bug.cgi?id=2215945
CVE ID: CVE-2023-4642 State: PUBLISHED Published: 2023-11-27T16:21:58.631Z Last Updated: 2024-08-02T07:31:06.562Z Vendors: Unknown Products: kk Star Ratings Problem Types: CWE-362 Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization) Description: The kk Star Ratings WordPress plugin before 5.4.6 does not implement atomic operations, allowing one user vote multiple times on a poll due to a Race Condition. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6f481d34-6feb-4af2-914c-1f3288f69207
CVE ID: CVE-2023-4643 State: PUBLISHED Published: 2023-10-16T19:38:58.930Z Last Updated: 2025-04-23T16:13:57.330Z Vendors: Unknown Products: Enable Media Replace Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d9125604-2236-435c-a67c-07951a1fc5b1