Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-33906 State: PUBLISHED Published: 2023-08-07T01:54:43.488Z Last Updated: 2024-10-17T14:49:25.369Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 Description: In Contacts Service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1687281677639942145
CVE ID: CVE-2023-33907 State: PUBLISHED Published: 2023-08-07T01:54:43.812Z Last Updated: 2024-10-17T14:48:34.532Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 Description: In Contacts Service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1687281677639942145
CVE ID: CVE-2023-33908 State: PUBLISHED Published: 2023-08-07T01:54:44.098Z Last Updated: 2024-10-17T14:47:50.371Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 Description: In ims service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1687281677639942145
CVE ID: CVE-2023-33909 State: PUBLISHED Published: 2023-08-07T01:54:44.402Z Last Updated: 2024-10-17T20:29:27.384Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 Description: In Contacts service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1687281677639942145
CVE ID: CVE-2023-33910 State: PUBLISHED Published: 2023-08-07T01:54:44.692Z Last Updated: 2024-10-17T14:46:52.599Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 Description: In Contacts Service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1687281677639942145
CVE ID: CVE-2023-33911 State: PUBLISHED Published: 2023-08-07T01:54:44.992Z Last Updated: 2024-10-17T14:46:03.989Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 Description: In vowifi service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1687281677639942145
CVE ID: CVE-2023-33912 State: PUBLISHED Published: 2023-08-07T01:54:45.355Z Last Updated: 2024-10-17T14:45:00.625Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 Description: In Contacts service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1687281677639942145
CVE ID: CVE-2023-33913 State: PUBLISHED Published: 2023-08-07T01:54:46.257Z Last Updated: 2024-11-07T16:52:52.278Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: T606/T612/T616/T610/T618/T760/T770/T820/S8000 Description: In DRM/oemcrypto, there is a possible out of bounds write due to an incorrect calculation of buffer size.This could lead to remote escalation of privilege with System execution privileges needed Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1687281677639942145
CVE ID: CVE-2023-33914 State: PUBLISHED Published: 2023-09-04T01:16:12.851Z Last Updated: 2024-10-01T13:04:12.062Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: T760/T770/T820/S8000 Description: In NIA0 algorithm in Security Mode Command, there is a possible missing verification incorrect input. This could lead to remote information disclosure no additional execution privileges needed Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1698296481653522434
CVE ID: CVE-2023-33915 State: PUBLISHED Published: 2023-09-04T01:16:13.120Z Last Updated: 2024-09-30T20:14:39.226Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: T760/T770/T820/S8000 Description: In LTE protocol stack, there is a possible missing permission check. This could lead to remote information disclosure no additional execution privileges needed Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1698296481653522434
CVE ID: CVE-2023-33916 State: PUBLISHED Published: 2023-09-04T01:16:00.948Z Last Updated: 2024-10-02T14:50:09.527Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 Description: In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1698296481653522434
CVE ID: CVE-2023-33917 State: PUBLISHED Published: 2023-09-04T01:16:01.230Z Last Updated: 2024-10-10T15:43:35.588Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 Description: In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1698296481653522434
CVE ID: CVE-2023-33918 State: PUBLISHED Published: 2023-09-04T01:16:01.516Z Last Updated: 2024-10-02T14:48:46.172Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 Description: In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1698296481653522434
CVE ID: CVE-2023-33919 State: PUBLISHED Published: 2023-06-13T08:17:18.755Z Last Updated: 2025-11-03T20:35:33.949Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: CP-8031 MASTER MODULE, CP-8050 MASTER MODULE Problem Types: CWE-77 Description: A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges. Additional Analyst Notes:
ow an authenticated privileged remote attacker to execute arbitrary code with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-731916.pdf - http://seclists.org/fulldisclosure/2023/Jul/14 - http://packetstormsecurity.com/files/173370/Siemens-A8000-CP-8050-CP-8031-Code-Execution-Command-Injection.html - http://seclists.org/fulldisclosure/2024/Jul/4
CVE ID: CVE-2023-33920 State: PUBLISHED Published: 2023-06-13T08:17:19.819Z Last Updated: 2025-02-13T16:55:11.191Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: CP-8031 MASTER MODULE, CP-8050 MASTER MODULE Problem Types: CWE-798 Description: A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). The affected devices contain the hash of the root password in a hard-coded form, which could be exploited for UART console login to the device. An attacker with direct physical access could exploit this vulnerability. Additional Analyst Notes: - CVE
to the device. An attacker with direct physical access could exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-731916.pdf - http://seclists.org/fulldisclosure/2023/Jul/14 - http://packetstormsecurity.com/files/173370/Siemens-A8000-CP-8050-CP-8031-Code-Execution-Command-Injection.html
CVE ID: CVE-2023-33921 State: PUBLISHED Published: 2023-06-13T08:17:20.886Z Last Updated: 2025-02-13T16:55:11.752Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: CP-8031 MASTER MODULE, CP-8050 MASTER MODULE Problem Types: CWE-749 Description: A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). The affected devices contain an exposed UART console login interface. An attacker with direct physical access could try to bruteforce or crack the root password to login to the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vu
orce or crack the root password to login to the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-731916.pdf - http://seclists.org/fulldisclosure/2023/Jul/14 - http://packetstormsecurity.com/files/173370/Siemens-A8000-CP-8050-CP-8031-Code-Execution-Command-Injection.html
CVE ID: CVE-2023-33922 State: PUBLISHED Published: 2024-06-11T09:17:29.261Z Last Updated: 2024-08-02T15:54:13.430Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Elementor Products: Elementor Website Builder Problem Types: CWE-862 Description: Missing Authorization vulnerability in Elementor Elementor Website Builder.This issue affects Elementor Website Builder: from n/a through 3.13.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/elementor/wordpress-elementor-plugin-3-13-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-33923 State: PUBLISHED Published: 2024-03-25T04:46:03.396Z Last Updated: 2025-04-10T18:31:54.470Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: HashThemes Products: Viral News, Viral, HashOne Problem Types: CWE-862 Description: Missing Authorization vulnerability in HashThemes Viral News, HashThemes Viral, HashThemes HashOne.This issue affects Viral News: from n/a through 1.4.5; Viral: from n/a through 1.8.0; HashOne: from n/a through 1.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/viral-news/wordpress-viral-news-theme-1-4-5-authenticated-arbitra
ences: - https://patchstack.com/database/vulnerability/viral-news/wordpress-viral-news-theme-1-4-5-authenticated-arbitrary-plugin-activation-vulnerability?_s_id=cve - https://patchstack.com/database/vulnerability/viral/wordpress-viral-theme-1-8-0-broken-access-control-vulnerability?_s_id=cve - https://patchstack.com/database/vulnerability/hashone/wordpress-hashone-theme-1-3-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-33924 State: PUBLISHED Published: 2023-11-06T08:05:34.285Z Last Updated: 2024-09-05T14:06:03.458Z Vendors: Felix Welberg Products: SIS Handball Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Felix Welberg SIS Handball allows SQL Injection.This issue affects SIS Handball: from n/a through 1.0.45. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/sis-handball/wordpress-sis-handball-plugin-1-0-45-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-33925 State: PUBLISHED Published: 2023-07-25T12:42:37.448Z Last Updated: 2024-09-25T16:59:57.367Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: PluginForage Products: WooCommerce Product Categories Selection Widget Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PluginForage WooCommerce Product Categories Selection Widget plugin <= 2.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woocommerce-product-category-selection-widget/wordpress-woocommerce-product-categories-selection-widget-plugin-2-0-r
ity/woocommerce-product-category-selection-widget/wordpress-woocommerce-product-categories-selection-widget-plugin-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-33926 State: PUBLISHED Published: 2023-05-28T19:00:51.539Z Last Updated: 2024-11-01T13:00:24.446Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) Vendors: Supsystic Products: Easy Google Maps Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Easy Google Maps plugin <= 1.11.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/google-maps-easy/wordpress-easy-google-maps-plugin-1-11-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-33927 State: PUBLISHED Published: 2023-10-31T14:12:51.537Z Last Updated: 2024-09-06T17:54:20.764Z Vendors: Themeisle Products: Multiple Page Generator Plugin – MPG Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Multiple Page Generator Plugin – MPG multiple-pages-generator-by-porthas allows SQL Injection.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.3.19. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/multiple-pages-generator-by-porthas/wordpress-multiple-page-
References: - https://patchstack.com/database/vulnerability/multiple-pages-generator-by-porthas/wordpress-multiple-page-generator-plugin-mpg-plugin-3-3-19-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-33928 State: PUBLISHED Published: 2024-12-13T14:23:30.275Z Last Updated: 2024-12-13T20:37:25.734Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: WebToffee Products: WordPress Backup & Migration Problem Types: CWE-862 Description: Missing Authorization vulnerability in WebToffee WordPress Backup & Migration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Backup & Migration: from n/a through 1.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-migration-duplicator/vulnerability/wordpress-wordpress-backup-migration-plugin
tchstack.com/database/wordpress/plugin/wp-migration-duplicator/vulnerability/wordpress-wordpress-backup-migration-plugin-1-4-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-33929 State: PUBLISHED Published: 2023-08-30T12:52:14.997Z Last Updated: 2024-09-24T19:22:54.823Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Joaquín Ruiz Products: Easy Admin Menu Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joaquín Ruiz Easy Admin Menu plugin <= 1.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/easy-admin-menu/wordpress-easy-admin-menu-plugin-1-3-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-33930 State: PUBLISHED Published: 2024-06-04T07:08:04.084Z Last Updated: 2024-08-02T15:54:13.395Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Unlimited Elements Products: Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Code Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 1.5.66. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referenc
emplates): from n/a through 1.5.66. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/unlimited-elements-for-elementor/wordpress-unlimited-elements-for-elementor-plugin-1-5-66-unrestricted-zip-extraction-vulnerability?_s_id=cve
CVE ID: CVE-2023-33931 State: PUBLISHED Published: 2023-05-28T17:14:49.422Z Last Updated: 2024-11-01T12:59:21.108Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Ciprian Popescu Products: YouTube Playlist Player Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Popescu YouTube Playlist Player plugin <= 4.6.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/youtube-playlist-player/wordpress-youtube-playlist-player-plugin-4-6-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-33933 State: PUBLISHED Published: 2023-06-14T07:44:12.626Z Last Updated: 2025-02-13T16:55:12.292Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0. 8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/tns2b4khyyncgs5v5p9y35pobg9z2bvs - https://www.debian.org/secu
lnrichment: References: - https://lists.apache.org/thread/tns2b4khyyncgs5v5p9y35pobg9z2bvs - https://www.debian.org/security/2023/dsa-5435 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6GDCBNFDDW6ULW7CACJCPENI7BVDHM5O/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGWXNAEEVRUZ5JG4EJAIIFC3CI7LFETV/ - https://lists.debian.org/debian-lts-announce/2023/06/msg00037.html
CVE ID: CVE-2023-33934 State: PUBLISHED Published: 2023-08-09T06:58:06.516Z Last Updated: 2025-02-13T16:55:12.908Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-444 Description: Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/jsl6dfdgs1mjjo1mbtyflyjr7xftswhc - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BOTOM2MFKOLK46Q3BQHO662HTPZFRQUC/ - https://lists.debian.org/debian-lts-announce
nnounce@lists.fedoraproject.org/message/BOTOM2MFKOLK46Q3BQHO662HTPZFRQUC/ - https://lists.debian.org/debian-lts-announce/2023/09/msg00042.html - https://www.debian.org/security/2023/dsa-5549
CVE ID: CVE-2023-33937 State: PUBLISHED Published: 2023-05-24T12:16:36.342Z Last Updated: 2024-10-22T15:52:55.857Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Stored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1 before fix pack 18, and 7.2 before fix pack 5 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form's `name` field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vu
lyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33937
CVE ID: CVE-2023-33938 State: PUBLISHED Published: 2023-05-24T13:20:19.626Z Last Updated: 2024-10-22T15:52:48.350Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an App Builder custom object's `Name` field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/secur
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33938
CVE ID: CVE-2023-33939 State: PUBLISHED Published: 2023-05-24T13:41:22.321Z Last Updated: 2024-10-22T15:52:40.777Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a facet label. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lifer
o a facet label. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33939