Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-43657 State: PUBLISHED Published: 2023-09-28T18:04:26.672Z Last Updated: 2024-09-23T18:21:57.902Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: discourse Products: discourse-encrypt Problem Types: CWE-79 Description: discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross site scripting (XSS) issue when a site has content security policy (CSP) headers disabled. Having CSP disabled is a non-default configuration, and having it disabled with discourse-encrypt installed will result in a warning in the Discourse admin dashboard. This has been
g it disabled with discourse-encrypt installed will result in a warning in the Discourse admin dashboard. This has been fixed in commit `9c75810af9` which is included in the latest version of the discourse-encrypt plugin. Users are advised to upgrade. Users unable to upgrade should ensure that CSP headers are enabled and properly configured. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse-encrypt/security/advisories/GHSA-5fh6-wp7p-xx7v - https://github.com/discourse/discourse-encrypt/commit/9c75810af9a474d7edaec67dea66f852c0ba1f4e - https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
CVE ID: CVE-2023-43658 State: PUBLISHED Published: 2023-10-16T21:28:57.341Z Last Updated: 2024-09-16T15:48:22.849Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: discourse Products: discourse-calendar Problem Types: CWE-79 Description: dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Improper escaping of event titles could lead to Cross-site Scripting (XSS) within the 'email preview' UI when a site has CSP disabled. Having CSP disabled is a non-default configuration, so the vast majority of sites are unaffected. This problem is resolved in the latest version of t
default configuration, so the vast majority of sites are unaffected. This problem is resolved in the latest version of the discourse-calendar plugin. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse-calendar/security/advisories/GHSA-3fwj-f6ww-7hr6 - https://github.com/discourse/discourse-calendar/commit/9788310906febb36822d6823d14f1059c39644de - https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
CVE ID: CVE-2023-43659 State: PUBLISHED Published: 2023-10-16T21:05:31.991Z Last Updated: 2024-09-16T15:51:43.554Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: discourse Products: discourse Problem Types: CWE-79 Description: Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via the digest email preview UI. This issue only affects sites with CSP disabled. This issue has been patched in the 3.1.1 stable release as well as the 3.2.0.beta1 release. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum. Additional Analyst Notes: - CVE Pro
vised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-g4qg-5q2h-m8ph - https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
CVE ID: CVE-2023-43660 State: PUBLISHED Published: 2023-09-27T21:00:29.827Z Last Updated: 2024-09-20T19:34:17.363Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: warp-tech Products: warpgate Problem Types: CWE-287 Description: Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by sending an SSH key offer without a signature. This allows bypassing authentication under following conditions: 1. The attacker knows the username and a valid target name 2. The attacked knows the user's public key and 3. Only SSH public key authentication is required for the user
rget name 2. The attacked knows the user's public key and 3. Only SSH public key authentication is required for the user account. This issue has been addressed in version 0.8.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/warp-tech/warpgate/security/advisories/GHSA-3cjp-w4cp-m9c8 - https://github.com/warp-tech/warpgate/commit/a4df7f7a21395cfaee7a9789d1e3846290caeb63
CVE ID: CVE-2023-43661 State: PUBLISHED Published: 2023-10-11T19:56:18.447Z Last Updated: 2024-09-17T13:59:09.383Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) Vendors: cachethq Products: cachet Problem Types: CWE-94 Description: Cachet, the open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cache
ssue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cachethq/cachet/security/advisories/GHSA-hv79-p62r-wg3p - https://github.com/cachethq/cachet/commit/6fb043e109d2a262ce3974e863c54e9e5f5e0587
CVE ID: CVE-2023-43662 State: PUBLISHED Published: 2023-09-28T21:54:44.467Z Last Updated: 2024-09-23T18:40:06.351Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: ShokoAnime Products: ShokoServer Problem Types: CWE-22 Description: ShokoServer is a media server which specializes in organizing anime. In affected versions the `/api/Image/WithPath` endpoint is accessible without authentication and is supposed to return default server images. The endpoint accepts the parameter `serverImagePath`, which is not sanitized in any way before being passed to `System.IO.File.OpenRead`, which results in an arbitrary file read. This issue may lead to an arbitrary file read w
d to `System.IO.File.OpenRead`, which results in an arbitrary file read. This issue may lead to an arbitrary file read which is exacerbated in the windows installer which installs the ShokoServer as administrator. Any unauthenticated attacker may be able to access sensitive information and read files stored on the server. The `/api/Image/WithPath` endpoint has been removed in commit `6c57ba0f0` which will be included in subsequent releases. Users should limit access to the `/api/Image/WithPath` endpoint or manually patch their installations until a patched release is made. This issue was discovered by the GitHub Security lab and is also indexed as GHSL-2023-191. Additional Analyst Notes: - C
This issue was discovered by the GitHub Security lab and is also indexed as GHSL-2023-191. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ShokoAnime/ShokoServer/security/advisories/GHSA-mwcv-ghjq-8f2g - https://github.com/ShokoAnime/ShokoServer/commit/6c57ba0f073d6be5a4f508c46c2ce36727cbce80
CVE ID: CVE-2023-43663 State: PUBLISHED Published: 2023-09-28T18:13:49.216Z Last Updated: 2024-09-20T19:32:29.398Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-269 Description: PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, even with low user right. This allows low privileged users to disable portions of a shops functionality. Commit `ce1f6708` addresses this issue and is included in version 8.1.2. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Co
Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-6jmf-2pfc-q9m7 - https://github.com/PrestaShop/PrestaShop/commit/ce1f67083537194e974caf86c57e547a0aaa46cd
CVE ID: CVE-2023-43664 State: PUBLISHED Published: 2023-09-28T18:16:57.658Z Last Updated: 2024-09-20T19:26:46.506Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-269 Description: PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: method `ajaxProcessGetPossibleHookingListForModule` doesn't check access rights. This issue has been addressed in commit `15bd281c` which is included in version 8.1.2. Users are advised to upgrade. There are no known workaround for this issue. Additional Analyst Notes: - CVE P
ion 8.1.2. Users are advised to upgrade. There are no known workaround for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-gvrg-62jp-rf7j - https://github.com/PrestaShop/PrestaShop/commit/15bd281c18f032a5134a8d213b44d24829d45762
CVE ID: CVE-2023-43665 State: PUBLISHED Published: 2023-11-03T00:00:00.000Z Last Updated: 2025-11-04T17:12:41.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232. Additional Analyst N
are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21forum/django-announce - https://docs.djangoproject.com/en/4.2/releases/security/ - https://www.djangoproject.com/weblog/2023/oct/04/security-releases/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU/ - https://security.netapp.com/advisory/ntap-20231221-0001/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D/ - http://www.openwall.c
chives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D/ - http://www.openwall.com/lists/oss-security/2024/03/04/1
CVE ID: CVE-2023-43666 State: PUBLISHED Published: 2023-10-16T08:08:10.148Z Last Updated: 2024-09-16T18:18:16.678Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-345 Description: Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, General user can view all user data like Admin account. Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8623 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/scbgh3ty3xcxm3q33r2t9f42gwwo1why
CVE ID: CVE-2023-43667 State: PUBLISHED Published: 2023-10-16T08:08:01.762Z Last Updated: 2025-06-16T16:50:38.393Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-74 Description: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false log records, making it harder to audit and trace malicious activities. Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8628 Additional Analyst Notes: - CVE Program Container: -
ick [1] to solve it. [1] https://github.com/apache/inlong/pull/8628 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/spnb378g268p1f902fr9kqyph2k8n543
CVE ID: CVE-2023-43668 State: PUBLISHED Published: 2023-10-16T08:07:42.681Z Last Updated: 2024-09-16T18:25:25.535Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, some sensitive params checks will be bypassed, like "autoDeserizalize","allowLoadLocalInfile".... . Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8604 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/t
604 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/16gtk7rpdm1rof075ro83fkrnhbzn5sh
CVE ID: CVE-2023-43669 State: PUBLISHED Published: 2023-09-21T00:00:00 Last Updated: 2024-08-02T19:44:43.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted (e.g., thousands of times) and the average amount of data for each parse attempt (e.g., millions of bytes). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/snapview/tungstenite-rs/issues/376 - https://cwe.mitre.org/data/definitions/407.html -
References: - https://github.com/snapview/tungstenite-rs/issues/376 - https://cwe.mitre.org/data/definitions/407.html - https://crates.io/crates/tungstenite/versions - https://github.com/snapview/tungstenite-rs/commit/8b3ecd3cc0008145ab4bc8d0657c39d09db8c7e2 - https://github.com/advisories/GHSA-9mcr-873m-xcxp - https://github.com/github/advisory-database/pull/2752 - https://bugzilla.suse.com/show_bug.cgi?id=1215563 - https://bugzilla.redhat.com/show_bug.cgi?id=2240110 - https://security-tracker.debian.org/tracker/CVE-2023-43669 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/THK6G6CD4VW6RCROWUV2C4HSINKK3XAK/ - https://lists.fedoraproject.org
t/package-announce%40lists.fedoraproject.org/message/THK6G6CD4VW6RCROWUV2C4HSINKK3XAK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TT7SF6CQ5VHAGFLWNXY64NFSW4WIWE7D/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R77EUWPZVP5WSMNXUXUDNHR7G7OI5NGM/
CVE ID: CVE-2023-43683 State: PUBLISHED Published: 2025-08-14T00:00:00.000Z Last Updated: 2025-08-15T16:28:35.738Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Malwarebytes 4.6.14.326 and before 5.1.5.116 (and Nebula 2020-10-21 and later). A Stack buffer out-of-bounds access exists because of an integer underflow when handling newline characters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.malwarebytes.com/secure/cves/cve-2023-43683
CVE ID: CVE-2023-43687 State: PUBLISHED Published: 2025-08-14T00:00:00.000Z Last Updated: 2025-08-15T16:39:55.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Malwarebytes before 4.6.14.326 and before 5.1.5.116 (and Nebula 2020-10-21 and later). There is a Race condition that leads to code execution because of a lack of locks between file verification and execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.malwarebytes.com/secure/cves/cve-2023-43687
CVE ID: CVE-2023-43692 State: PUBLISHED Published: 2025-08-14T00:00:00.000Z Last Updated: 2025-08-15T16:32:21.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Malwarebytes before 4.6.14.326 and before 5.1.5.116 (and Nebula 2020-10-21 and later). Out-of-bound reads in strings detection utilities lead to system crashes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.malwarebytes.com/secure/cves/cve-2023-43692
CVE ID: CVE-2023-43694 State: PUBLISHED Published: 2025-08-14T00:00:00.000Z Last Updated: 2025-08-14T18:49:01.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Malwarebytes 4.6.14.326 and before and 5.1.5.116 and before (and Nebula 2020-10-21 and later). An Out of bounds read in several disassembling utilities causes stability issues and denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.malwarebytes.com/secure/cves/cve-2023-43694
CVE ID: CVE-2023-43696 State: PUBLISHED Published: 2023-10-09T11:51:45.921Z Last Updated: 2024-09-18T19:37:28.032Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) Vendors: SICK AG Products: APU0200 Problem Types: CWE-284 Description: Improper Access Control in SICK APU allows an unprivileged remote attacker to download as well as upload arbitrary files via anonymous access to the FTP server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json
CVE ID: CVE-2023-43697 State: PUBLISHED Published: 2023-10-09T12:03:27.736Z Last Updated: 2024-12-09T13:54:12.933Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: SICK AG Products: APU0200 Problem Types: CWE-471 Description: Modification of Assumed-Immutable Data (MAID) in RDT400 in SICK APU allows an unprivileged remote attacker to make the site unable to load necessary strings via changing file paths using HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.
s://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json
CVE ID: CVE-2023-43698 State: PUBLISHED Published: 2023-10-09T12:01:28.992Z Last Updated: 2024-09-19T16:04:34.282Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: SICK AG Products: APU0200 Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (’Cross-site Scripting’) in RDT400 in SICK APU allows an unprivileged remote attacker to run arbitrary code in the clients browser via injecting code into the website. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf - https://sick.com/.well-known/csaf/wh
//sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json
CVE ID: CVE-2023-43699 State: PUBLISHED Published: 2023-10-09T11:59:19.748Z Last Updated: 2024-12-09T13:54:43.591Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: SICK AG Products: APU0200 Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts in RDT400 in SICK APU allows an unprivileged remote attacker to guess the password via trial-and-error as the login attempts are not limited. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json
CVE ID: CVE-2023-43700 State: PUBLISHED Published: 2023-10-09T11:56:42.077Z Last Updated: 2024-09-19T14:24:13.788Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: SICK AG Products: APU0200 Problem Types: CWE-862 Description: Missing Authorization in RDT400 in SICK APU allows an unprivileged remote attacker to modify data via HTTP requests that no not require authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json
CVE ID: CVE-2023-43701 State: PUBLISHED Published: 2023-11-27T10:52:09.754Z Last Updated: 2024-08-02T19:44:43.832Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-79 Description: Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint. This issue affects Apache Superset versions prior to 2.1.2. Users are recommended to upgrade to version 2.1.2, which fixes this issue. Additional Ana
erset versions prior to 2.1.2. Users are recommended to upgrade to version 2.1.2, which fixes this issue. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/4dnr1knk50fw60jxkjgqj228f0xcc892 - https://www.openwall.com/lists/oss-security/2023/11/27/4
CVE ID: CVE-2023-43702 State: PUBLISHED Published: 2023-09-30T01:45:51.865Z Last Updated: 2024-09-23T17:02:30.493Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Os Commerce Products: Os Commerce Problem Types: CWE-79 Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "tracking_number" parameter, potentially leading to unauthorized execution of scripts within a user's web browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/bts/ - https://www.oscommerce.com/
CVE ID: CVE-2023-43703 State: PUBLISHED Published: 2023-09-30T01:45:57.973Z Last Updated: 2024-09-23T17:01:59.334Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Os Commerce Products: Os Commerce Problem Types: CWE-79 Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "product_info[][name]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/bts/ - https://www.oscommerce.com/
CVE ID: CVE-2023-43704 State: PUBLISHED Published: 2023-09-30T01:46:00.722Z Last Updated: 2024-09-23T17:01:31.309Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Os Commerce Products: Os Commerce Problem Types: CWE-79 Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "title" parameter, potentially leading to unauthorized execution of scripts within a user's web browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/bts/ - https://www.oscommerce.com/