Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
476 Description: A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver and causing kernel panic and a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:0723 - https://access.redhat.com/errata/RHSA-2024:0724 - https://access.redhat.com/errata/RHSA-2024:0725 - https://access.redhat.com/errata/RHSA-2024:0881 - https://access.redhat.com/errata/RHSA-2024:0897 - https://access.redhat.com/errata/RHSA-2024:1248
rata/RHSA-2024:0881 - https://access.redhat.com/errata/RHSA-2024:0897 - https://access.redhat.com/errata/RHSA-2024:1248 - https://access.redhat.com/errata/RHSA-2024:2094 - https://access.redhat.com/errata/RHSA-2024:3810 - https://access.redhat.com/security/cve/CVE-2023-6356 - https://bugzilla.redhat.com/show_bug.cgi?id=2254054
CVE ID: CVE-2023-6357 State: PUBLISHED Published: 2023-12-05T14:29:25.649Z Last Updated: 2024-08-02T08:28:21.783Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: CODESYS Products: CODESYS Control for BeagleBone SL, CODESYS Control for emPC-A/iMX6 SL, CODESYS Control for IOT2000 SL, CODESYS Control for Linux ARM SL, CODESYS Control for Linux SL, CODESYS Control for PFC100 SL, CODESYS Control for PFC200 SL, CODESYS Control for PLCnext SL, CODESYS Control for Raspberry Pi SL, CODESYS Control for WAGO Touch Panels 600 SL, CODESYS Runtime Toolkit for Linux or QNX Problem Types: CWE-78 Description: A low-privileged remote attacker could exploit the vulnerability and
for Linux or QNX Problem Types: CWE-78 Description: A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker full control of the device. Additional Analyst Notes: - CVE Program Container: References: - https://https://cert.vde.com/en/advisories/VDE-2023-066
CVE ID: CVE-2023-6359 State: PUBLISHED Published: 2023-11-28T12:01:33.644Z Last Updated: 2024-08-02T08:28:21.868Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Grupo Alumne Products: Alumne LMS Problem Types: CWE-79 Description: A Cross-Site Scripting (XSS) vulnerability has been found in Alumne LMS affecting version 4.0.0.1.08. An attacker could exploit the 'localidad' parameter to inject a custom JavaScript payload and partially take over another user's browser session, due to the lack of proper sanitisation of the 'localidad' field on the /users/editmy page. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe
the /users/editmy page. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-alumne-lms
CVE ID: CVE-2023-6360 State: PUBLISHED Published: 2023-11-30T15:17:14.959Z Last Updated: 2024-10-10T20:19:02.663Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Problem Types: CWE-89 Description: The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-40
CVE ID: CVE-2023-6361 State: PUBLISHED Published: 2024-10-07T15:03:01.746Z Last Updated: 2024-10-07T19:10:36.852Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: WinHex Products: WinHex Problem Types: CWE-119 Description: A vulnerability has been discovered in Winhex affecting version 16.1 SR-1 and 20.4. This vulnerability consists of a buffer overflow controlling the Structured Exception Handler (SEH) registers. This could allow attackers to execute arbitrary code via a long filename argument. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-winhex
CVE ID: CVE-2023-6362 State: PUBLISHED Published: 2024-10-07T15:03:07.120Z Last Updated: 2024-10-07T19:11:20.909Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: WinHex Products: WinHex Problem Types: CWE-119 Description: A vulnerability has been discovered in Winhex affecting version 16.1 SR-1 and 20.4. This vulnerability consists of a buffer overflow controlling the Structured Exception Handler (SEH) registers. This could allow attackers to execute arbitrary code via a long filename argument. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-winhex
CVE ID: CVE-2023-6363 State: PUBLISHED Published: 2024-05-03T13:25:19.215Z Last Updated: 2024-11-25T17:40:49.156Z Vendors: Arm Ltd Products: Valhall GPU Kernel Driver, Arm 5th Gen GPU Architecture Kernel Driver Problem Types: CWE-416 Description: Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. If the system’s memory is carefully prepared by the user, then this in turn could give them access to already freed memory. This issue affects Valhall GPU Kernel Driver: from r41p0 through r47p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p
issue affects Valhall GPU Kernel Driver: from r41p0 through r47p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r47p0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE ID: CVE-2023-6364 State: PUBLISHED Published: 2023-12-14T16:04:40.029Z Last Updated: 2024-08-02T08:28:21.770Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-79 Description: In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within a dashboard component. If a WhatsUp Gold user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser. Additional Analyst Notes: - CVE
ould be able to execute malicious JavaScript within the context of the victims browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023
CVE ID: CVE-2023-6365 State: PUBLISHED Published: 2023-12-14T16:05:08.330Z Last Updated: 2024-08-02T08:28:21.864Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-79 Description: In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within a device group. If a WhatsUp Gold user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser. Additional Analyst Notes: - CVE Program
able to execute malicious JavaScript within the context of the victims browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023
CVE ID: CVE-2023-6366 State: PUBLISHED Published: 2023-12-14T16:05:31.492Z Last Updated: 2025-05-21T14:34:08.582Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-79 Description: In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within Alert Center. If a WhatsUp Gold user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser. Additional Analyst Notes: - CVE Program C
ble to execute malicious JavaScript within the context of the victims browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023
CVE ID: CVE-2023-6367 State: PUBLISHED Published: 2023-12-14T16:05:50.619Z Last Updated: 2024-08-02T08:28:21.784Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-79 Description: In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within Roles. If a WhatsUp Gold user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser. Additional Analyst Notes: - CVE Program Containe
execute malicious JavaScript within the context of the victims browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023
CVE ID: CVE-2023-6368 State: PUBLISHED Published: 2023-12-14T16:06:29.101Z Last Updated: 2024-10-16T14:36:49.428Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-306 Description: In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate information related to a registered device being monitored by WhatsUp Gold. Additional Analyst Notes: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-G
ontainer: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023
CVE ID: CVE-2023-6369 State: PUBLISHED Published: 2024-01-11T08:32:33.836Z Last Updated: 2025-06-03T14:09:37.869Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: recorp Products: Export WP Page to Static HTML/CSS Problem Types: CWE-862 Missing Authorization Description: The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple AJAX actions in all versions up to, and including, 2.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose sensitive information or perform unauthorized actions, suc
ttackers, with subscriber-level access and above, to disclose sensitive information or perform unauthorized actions, such as saving advanced plugin settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/47cb48aa-b556-4f25-ac68-ff0a812972c1?source=cve - https://plugins.trac.wordpress.org/browser/export-wp-page-to-static-html/trunk/admin/includes/AjaxRequests/cancelRcExportProcess.php#L23 - https://plugins.trac.wordpress.org/browser/export-wp-page-to-static-html/trunk/admin/includes/AjaxRequests/deleteExportedZipFile.php#L24 - https://plugins.trac.wordpress.org/browser/export-wp-page-to-stati
includes/AjaxRequests/deleteExportedZipFile.php#L24 - https://plugins.trac.wordpress.org/browser/export-wp-page-to-static-html/trunk/admin/includes/AjaxRequests/exportLogPercentage.php#L23 - https://plugins.trac.wordpress.org/browser/export-wp-page-to-static-html/trunk/admin/includes/AjaxRequests/requestForWpPageToStaticHtml.php#L24 - https://plugins.trac.wordpress.org/browser/export-wp-page-to-static-html/trunk/admin/includes/AjaxRequests/saveAdvancedSettings.php#L22 - https://plugins.trac.wordpress.org/browser/export-wp-page-to-static-html/trunk/admin/includes/AjaxRequests/searchPosts.php#L24 - https://plugins.trac.wordpress.org/browser/export-wp-page-to-static-html/trunk/admin/includes/Aj
s/searchPosts.php#L24 - https://plugins.trac.wordpress.org/browser/export-wp-page-to-static-html/trunk/admin/includes/AjaxRequests/seeLogsInDetails.php#L22 - https://plugins.trac.wordpress.org/changeset/3002740/export-wp-page-to-static-html
CVE ID: CVE-2023-6371 State: PUBLISHED Published: 2024-03-28T07:18:03.820Z Last Updated: 2025-05-23T04:04:33.702Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-79 Description: An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. A wiki page with a crafted payload may lead to a Stored XSS, allowing attackers to perform arbitrary actions on behalf of victims. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/4
t Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/433021 - https://hackerone.com/reports/2257080
CVE ID: CVE-2023-6373 State: PUBLISHED Published: 2024-01-16T15:57:47.717Z Last Updated: 2025-06-11T16:38:42.806Z Vendors: Unknown Products: ArtPlacer Widget Problem Types: CWE-89 SQL Injection, CWE-352 Cross-Site Request Forgery (CSRF) Description: The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor (or above) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/afc11c92-a7c5-4e55-8f34-f2235
Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/afc11c92-a7c5-4e55-8f34-f2235438bd1b/
CVE ID: CVE-2023-6374 State: PUBLISHED Published: 2024-01-30T09:00:14.800Z Last Updated: 2025-06-09T18:35:44.426Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Mitsubishi Electric Corporation Products: MELSEC WS Series WS0-GETH00200 Problem Types: CWE-294 Description: Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 all serial numbers allows a remote unauthenticated attacker to bypass authentication by capture-replay attack and illegally login to the affected module. As a result, the remote attacker who has logged in illegally may be able to disclose or tamper with the programs and para
s a result, the remote attacker who has logged in illegally may be able to disclose or tamper with the programs and parameters in the modules. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-019_en.pdf - https://jvn.jp/vu/JVNVU99497477 - https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-03
CVE ID: CVE-2023-6375 State: PUBLISHED Published: 2023-11-30T17:54:25.462Z Last Updated: 2024-08-02T08:28:21.804Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Tyler Technologies Products: Court Case Management Plus Problem Types: CWE-552 Description: Tyler Technologies Court Case Management Plus may store backups in a location that can be accessed by a remote, unauthenticated attacker. Backups may contain sensitive information such as database credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.tylertech.com/solutions/courts-public-safety/courts-justice - https://github.com/qwell/disorder-in-the-court/blob/main/README
tech.com/solutions/courts-public-safety/courts-justice - https://github.com/qwell/disorder-in-the-court/blob/main/README-TylerTechnologies.md - https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/ - https://www.cisa.gov/news-events/alerts/2023/11/30/multiple-vulnerabilities-affecting-web-based-court-case-and-document-management-systems
CVE ID: CVE-2023-6376 State: PUBLISHED Published: 2023-11-30T17:55:13.992Z Last Updated: 2024-08-02T08:28:21.756Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Henschen & Associates Products: court document management software Problem Types: CWE-330 Description: Henschen & Associates court document management software does not sufficiently randomize file names of cached documents, allowing a remote, unauthenticated attacker to access restricted documents. Additional Analyst Notes: - CVE Program Container: References: - https://www.henschen.com/government - https://github.com/qwell/disorder-in-the-court/blob/main/README-Henschen%26Associates.md - https://te
n.com/government - https://github.com/qwell/disorder-in-the-court/blob/main/README-Henschen%26Associates.md - https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/ - https://www.cisa.gov/news-events/alerts/2023/11/30/multiple-vulnerabilities-affecting-web-based-court-case-and-document-management-systems
CVE ID: CVE-2023-6377 State: PUBLISHED Published: 2023-12-13T06:27:40.758Z Last Updated: 2025-11-20T07:07:18.457Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for
upport, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 6 Problem Types: CWE-125 Description: A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases wher
ounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:7886 - https://access.redhat.com/errata/RHSA-2024:0006 - https://access.redhat.com/errata/RHSA-2024:0009 - https://access.redhat.com/errata/RHSA-2024:0010 - https://access.redhat.com/errata/RHSA-2024:0014 - https://access.redhat.com/errata/RHSA-2024:0015 - https://access.redhat.com/errata/RHSA-2024:0016 - https://access.redhat.com/errata/RHSA-2024:0017 - https://access.redhat.com/errata/RHSA-2024:0018 - https://access.redhat.com/errata/RH
redhat.com/errata/RHSA-2024:0017 - https://access.redhat.com/errata/RHSA-2024:0018 - https://access.redhat.com/errata/RHSA-2024:0020 - https://access.redhat.com/errata/RHSA-2024:2169 - https://access.redhat.com/errata/RHSA-2024:2170 - https://access.redhat.com/errata/RHSA-2024:2995 - https://access.redhat.com/errata/RHSA-2024:2996 - https://access.redhat.com/errata/RHSA-2025:13998 - https://access.redhat.com/security/cve/CVE-2023-6377 - https://bugzilla.redhat.com/show_bug.cgi?id=2253291 - https://gitlab.freedesktop.org/xorg/xserver/-/commit/0c1a93d319558fe3ab2d94f51d174b4f93810afd - https://lists.x.org/archives/xorg-announce/2023-December/003435.html
CVE ID: CVE-2023-6378 State: PUBLISHED Published: 2023-11-29T12:02:37.496Z Last Updated: 2024-11-29T12:04:40.421Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: QOS.CH Sarl Products: logback Problem Types: Denial-of-service using poisoned data Description: A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://logback.qos.ch/news.html#1.3.12
CVE ID: CVE-2023-6379 State: PUBLISHED Published: 2023-12-13T10:52:01.743Z Last Updated: 2024-10-01T14:47:25.647Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Alkacon Products: Open CMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to a victim and partially take control of their browsing session. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vul
rogram Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alkacon-software-opencms
CVE ID: CVE-2023-6380 State: PUBLISHED Published: 2023-12-13T10:54:35.693Z Last Updated: 2024-08-28T13:44:40.334Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Alkacon Products: Open CMS Problem Types: CWE-601 Description: Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially crafted URL and send it to a specific user to redirect them to a malicious site and compromise them. Exploitation of this vulnerability is possible due to the fact that there is no proper sanitization of the 'URI' parameter. Additional Analyst Notes: - CVE Program Container: - CIS
ct that there is no proper sanitization of the 'URI' parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alkacon-software-opencms
CVE ID: CVE-2023-6381 State: PUBLISHED Published: 2023-12-13T10:46:12.511Z Last Updated: 2024-08-02T08:28:21.771Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SuperMailer Products: Newsletter Software Problem Types: CWE-20 Description: Improper input validation vulnerability in Newsletter Software SuperMailer affecting version 11.20.0.2204. An attacker could exploit this vulnerability by sending a malicious configuration file (file with SMB extension) to a user via a link or email attachment and persuade the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to crash the application when attemp
ffected software on the local system. A successful exploit could allow the attacker to crash the application when attempting to load the malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/improper-input-validation-newsletter-software-supermailer