Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
38D section 8.2.1 guidance for constructing a deterministic IV for AES in GCM mode, truncation of the counter portion could lead to IV reuse. Both truncations and overruns of the key and overruns of the IV will produce incorrect results and could, in some cases, trigger a memory exception. However, these issues are not currently assessed as security critical. Changing the key and/or IV lengths is not considered to be a common operation and the vulnerable API was recently introduced. Furthermore it is likely that application developers will have spotted this problem during testing since decryption would fail unless both peers in the communication were similarly vulnerable. For these reasons w
esting since decryption would fail unless both peers in the communication were similarly vulnerable. For these reasons we expect the probability of an application being vulnerable to this to be quite low. However if an application is vulnerable then this issue is considered very serious. For these reasons we have assessed this issue as Moderate severity overall. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because the issue lies outside of the FIPS provider boundary. OpenSSL 3.1 and 3.0 are vulnerable to this issue. Additional Analyst Notes: - CVE Program Container: References: - https://www.openssl.org/news
vulnerable to this issue. Additional Analyst Notes: - CVE Program Container: References: - https://www.openssl.org/news/secadv/20231024.txt - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=5f69f5c65e483928c4b28ed16af6e5742929f1ee - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0df40630850fb2740e6be6890bb905d3fc623b2d
CVE ID: CVE-2023-5365 State: PUBLISHED Published: 2023-10-09T15:17:20.863Z Last Updated: 2024-09-19T14:38:13.668Z Vendors: HP Inc. Products: HP LIFE Android Mobile Description: HP LIFE Android Mobile application is potentially vulnerable to escalation of privilege and/or information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_9393937-9393961-16/hpsbgn03870
CVE ID: CVE-2023-5366 State: PUBLISHED Published: 2023-10-06T17:43:34.376Z Last Updated: 2025-02-13T17:20:09.786Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) Vendors: n/a, Red Hat, Fedora Products: openvswitch, Fast Datapath for RHEL 7, Fast Datapath for RHEL 8, Fast Datapath for RHEL 9, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 3.11, Red Hat OpenShift Container Platform 4, Red Hat OpenStack Platform 16.1, Red Hat OpenStack Platform 16.2, Red Hat Virtualization 4, Fedora Problem Types: CWE-345 Description: A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This
n Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed target IP address field that can redirect ICMPv6 traffic to arbitrary IP addresses. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-5366 - https://bugzilla.redhat.com/show_bug.cgi?id=2006347 - http://www.openwall.com/lists/oss-security/2024/02/08/4 - https://lists.debian.org/debian-lts-announce/2024/02/msg00004.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VYY
24/02/msg00004.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VYYUBF6OW2JG7VOFEOROHXGSJCTES3QO/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LFZADABUDOFI2KZIRQBYFZCIKH55RGY3/
CVE ID: CVE-2023-5367 State: PUBLISHED Published: 2023-10-25T19:46:58.494Z Last Updated: 2025-11-06T20:51:20.572Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 6 Problem Types: CWE-787 Description: A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDevicePrope
ccurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible escalation of privileges or denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:6802 - https://access.redhat.com/errata/RHSA-2023:6808 - https://access.redhat.com/errata/RHSA-2023:7373 - https://access.redhat.com/errata/RHSA-2023:7388 - https://access.redhat.com/errata/RHSA-2023:7405 - https://access.redhat.com/errata/RHSA-2023:7428 - https://access.redhat.com/errata/RHSA-2023:7436 - ht
/RHSA-2023:7405 - https://access.redhat.com/errata/RHSA-2023:7428 - https://access.redhat.com/errata/RHSA-2023:7436 - https://access.redhat.com/errata/RHSA-2023:7526 - https://access.redhat.com/errata/RHSA-2023:7533 - https://access.redhat.com/errata/RHSA-2024:0010 - https://access.redhat.com/errata/RHSA-2024:0128 - https://access.redhat.com/errata/RHSA-2024:2169 - https://access.redhat.com/errata/RHSA-2024:2170 - https://access.redhat.com/errata/RHSA-2024:2995 - https://access.redhat.com/errata/RHSA-2024:2996 - https://access.redhat.com/errata/RHSA-2025:12751 - https://access.redhat.com/security/cve/CVE-2023-5367 - https://bugzilla.redhat.com/show_bug.cgi?id=2243091 - https://lists.x.org/ar
ess.redhat.com/security/cve/CVE-2023-5367 - https://bugzilla.redhat.com/show_bug.cgi?id=2243091 - https://lists.x.org/archives/xorg-announce/2023-October/003430.html
CVE ID: CVE-2023-5368 State: PUBLISHED Published: 2023-10-04T03:38:09.357Z Last Updated: 2024-08-02T07:59:43.658Z Vendors: FreeBSD Products: FreeBSD Problem Types: CWE-1188 Description: On an msdosfs filesystem, the 'truncate' or 'ftruncate' system calls under certain circumstances populate the additional space in the file with unallocated data from the underlying disk device, rather than zero bytes. This may permit a user with write access to files on a msdosfs filesystem to read unintended data (e.g. from a previously deleted file). Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-23:12.msdosfs.asc - https://security.netapp
Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-23:12.msdosfs.asc - https://security.netapp.com/advisory/ntap-20231124-0004/ - https://dfir.ru/2023/11/01/bringing-unallocated-data-back-the-fat12-16-32-case/
CVE ID: CVE-2023-5369 State: PUBLISHED Published: 2023-10-04T03:48:53.559Z Last Updated: 2025-02-13T17:20:10.344Z Vendors: FreeBSD Products: FreeBSD Problem Types: CWE-273 Description: Before correction, the copy_file_range system call checked only for the CAP_READ and CAP_WRITE capabilities on the input and output file descriptors, respectively. Using an offset is logically equivalent to seeking, and the system call must additionally require the CAP_SEEK capability. This incorrect privilege check enabled sandboxed processes with only read or write but no seek capability on a file descriptor to read data from or write data to an arbitrary location within the file corresponding to that file d
a file descriptor to read data from or write data to an arbitrary location within the file corresponding to that file descriptor. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-23:13.capsicum.asc - https://security.netapp.com/advisory/ntap-20231124-0009/
CVE ID: CVE-2023-5370 State: PUBLISHED Published: 2023-10-04T03:59:45.199Z Last Updated: 2025-02-13T17:20:10.970Z Vendors: FreeBSD Products: FreeBSD Problem Types: CWE-665 Description: On CPU 0 the check for the SMCCC workaround is called before SMCCC support has been initialized. This resulted in no speculative execution workarounds being installed on CPU 0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-23:14.smccc.asc - https://security.netapp.com/advisory/ntap-20231124-0005/
CVE ID: CVE-2023-5371 State: PUBLISHED Published: 2023-10-04T16:01:48.187Z Last Updated: 2024-08-29T15:04:51.442Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Wireshark Foundation Products: Wireshark Problem Types: CWE-789 Description: RTPS dissector memory leak in Wireshark 4.0.0 to 4.0.8 and 3.6.0 to 3.6.16 allows denial of service via packet injection or crafted capture file Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2023-27.html - https://gitlab.com/wireshark/wireshark/-/issues/19322
CVE ID: CVE-2023-5372 State: PUBLISHED Published: 2024-01-30T00:55:33.090Z Last Updated: 2024-08-23T18:58:04.490Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: NAS326 firmware, NAS542 firmware Problem Types: CWE-78 Description: The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(ABAG.12)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands by sending a crafted query parameter attached to the URL of an affected device’s web management interface. Additional Analyst Notes: - CVE
ed query parameter attached to the URL of an affected device’s web management interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-nas-products-01-30-2024
CVE ID: CVE-2023-5373 State: PUBLISHED Published: 2023-10-04T12:31:04.960Z Last Updated: 2024-08-02T07:59:43.680Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Computer and Laptop Store Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected is the function register of the file Master.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-241254 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA
he public and may be used. VDB-241254 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.241254 - https://vuldb.com/?ctiid.241254 - https://github.com/Szlllc/Cve/blob/main/Computer%20and%20Laptop%20Store%20System%20Master.php%20has%20Sqlinjection.pdf
CVE ID: CVE-2023-5374 State: PUBLISHED Published: 2023-10-04T13:31:04.897Z Last Updated: 2024-08-02T07:59:44.597Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Computer and Laptop Store Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this vulnerability is an unknown functionality of the file products.php. The manipulation of the argument c leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-241255. Additional Analyst No
osed to the public and may be used. The associated identifier of this vulnerability is VDB-241255. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.241255 - https://vuldb.com/?ctiid.241255 - https://github.com/llixixi/Engineers-Online-Portal-System/blob/main/Computer%20and%20Laptop%20Store%20System%20products.php%20has%20Sqlinjection.pdf
CVE ID: CVE-2023-5375 State: PUBLISHED Published: 2023-10-04T08:30:39.679Z Last Updated: 2024-09-17T13:50:50.236Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: mosparo Products: mosparo/mosparo Problem Types: CWE-601 Description: Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/3fa2abde-cb58-45a3-a115-1727ece9acb9 - https://github.com/mosparo/mosparo/commit/9d5da367b78b8c883bfef5f332ffea26292f99e8
CVE ID: CVE-2023-5376 State: PUBLISHED Published: 2024-01-09T09:44:18.108Z Last Updated: 2025-10-08T09:12:42.388Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: Korenix Products: JetNet Series Problem Types: CWE-306 Description: An Improper Authentication vulnerability in Korenix JetNet TFTP allows abuse of this service. This issue affects JetNet devices older than firmware version 2024/01. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.beijerelectronics.com/en/support/Help___online?docId=69947 - https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetnet-series/ - http://seclists.org/fulldis
d=69947 - https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetnet-series/ - http://seclists.org/fulldisclosure/2024/Jan/11 - http://packetstormsecurity.com/files/176550/Korenix-JetNet-Series-Unauthenticated-Access.html
CVE ID: CVE-2023-5377 State: PUBLISHED Published: 2023-10-04T09:53:52.991Z Last Updated: 2024-09-17T13:49:53.615Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: gpac Products: gpac/gpac Problem Types: CWE-125 Description: Out-of-bounds Read in GitHub repository gpac/gpac prior to v2.2.2-DEV. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/fe778df4-3867-41d6-954b-211c81bccbbf - https://github.com/gpac/gpac/commit/8e9d6b38c036a97020c462ad48e1132e0ddc57ce
CVE ID: CVE-2023-5378 State: PUBLISHED Published: 2024-01-29T11:11:11.608Z Last Updated: 2025-06-17T21:29:17.036Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Jan Syski Products: MegaBIP, SmodBIP Problem Types: CWE-79 Description: Improper Input Validation vulnerability in MegaBIP and already unsupported SmodBIP software allows for Stored XSS.This issue affects SmodBIP in all versions and MegaBIP in versions up to 4.36.2. MegaBIP 5.08 was tested and is not vulnerable. A precise range of vulnerable versions remains unknown. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://megabip.pl/ - https://smod.pl/ - https
st Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://megabip.pl/ - https://smod.pl/ - https://cert.pl/en/posts/2023/12/CVE-2023-5378 - https://cert.pl/posts/2023/12/CVE-2023-5378
CVE ID: CVE-2023-5379 State: PUBLISHED Published: 2023-12-12T21:54:52.669Z Last Updated: 2025-11-07T10:51:59.956Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7, Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7, Red Hat build of Quarkus, Red Hat Data Grid 8, Red Hat Decision Manager 7, Red Hat Fuse 7, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Fuse 6, Red Hat Process Automation 7, Red Hat Single Sign-On 7, Red Hat support for Spring Boot Problem Types: CWE-770 Description: A flaw was found in Undertow. When an AJP r
gn-On 7, Red Hat support for Spring Boot Problem Types: CWE-770 Description: A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because mod_proxy_cluster marks the JBoss EAP instance as an error worker when the TCP connection is closed from the backend after sending the AJP request without receiving an AJP response, and stops forwarding. This issue could allow a malicious user could to repeatedly send requests that exceed the max-header-size, causing a Denial of Service (
allow a malicious user could to repeatedly send requests that exceed the max-header-size, causing a Denial of Service (DoS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:9582 - https://access.redhat.com/errata/RHSA-2025:9583 - https://access.redhat.com/security/cve/CVE-2023-5379 - https://bugzilla.redhat.com/show_bug.cgi?id=2242099
CVE ID: CVE-2023-5380 State: PUBLISHED Published: 2023-10-25T19:46:59.432Z Last Updated: 2025-11-20T18:06:04.492Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6 Problem Types: CWE-416 Description: A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if the pointer is warped from within a window on one screen to the root window of the other screen and if the original window is d
nter is warped from within a window on one screen to the root window of the other screen and if the original window is destroyed followed by another window being destroyed. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:7428 - https://access.redhat.com/errata/RHSA-2024:2169 - https://access.redhat.com/errata/RHSA-2024:2298 - https://access.redhat.com/errata/RHSA-2024:2995 - https://access.redhat.com/errata/RHSA-2024:3067 - https://access.redhat.com/security/cve/CVE-2023-5380 - https://bugzilla.redhat.com/show_bug.cgi?id=2244736 - https://lists.x.org/archives/xorg-announce/2023-October/003430.html
CVE ID: CVE-2023-5381 State: PUBLISHED Published: 2023-11-15T22:32:29.744Z Last Updated: 2024-08-02T07:59:44.299Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: webtechstreet Products: Elementor Addon Elements Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.12.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary
This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bd2bc2e7-960e-40db-9dcc-a6a60117bd83?source=cve - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/inc/admin/admin-ui.php#L79 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2996185%40addon-elemen
min-ui.php#L79 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2996185%40addon-elements-for-elementor-page-builder%2Ftrunk&old=2980987%40addon-elements-for-elementor-page-builder%2Ftrunk&sfp_email=&sfph_mail=#file15
CVE ID: CVE-2023-5382 State: PUBLISHED Published: 2023-11-22T15:33:27.505Z Last Updated: 2024-08-02T07:59:44.336Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: funnelforms Products: Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to missing or incorrect nonce validation on the fnsf_delete_posts function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request gra
_posts function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/72e4428b-d2cd-471f-9821-947f4601fd64?source=cve - https://plugins.trac.wordpress.org/changeset/2986938/funnelforms-free
CVE ID: CVE-2023-5383 State: PUBLISHED Published: 2023-11-22T15:33:35.385Z Last Updated: 2025-06-10T13:30:19.676Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: funnelforms Products: Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to missing or incorrect nonce validation on the fnsf_copy_posts function. This makes it possible for unauthenticated attackers to create copies of arbitrary posts via a forged req
osts function. This makes it possible for unauthenticated attackers to create copies of arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d35ec0f0-fa7a-4531-b5f7-5adcf2af051c?source=cve - https://plugins.trac.wordpress.org/changeset/2986938/funnelforms-free
CVE ID: CVE-2023-5384 State: PUBLISHED Published: 2023-12-18T13:43:08.728Z Last Updated: 2025-11-20T07:07:36.736Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Data Grid 8.4.6 Problem Types: CWE-312 Description: A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:7676 - https://access.redhat.com/security/cve/
ogram Container: References: - https://access.redhat.com/errata/RHSA-2023:7676 - https://access.redhat.com/security/cve/CVE-2023-5384 - https://bugzilla.redhat.com/show_bug.cgi?id=2242156