Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-3010 State: PUBLISHED Published: 2023-10-25T08:09:48.174Z Last Updated: 2025-06-12T14:57:39.628Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Grafana Products: worldmap-panel Problem Types: CWE-79 Description: Grafana is an open-source platform for monitoring and observability. The WorldMap panel plugin, versions before 1.0.4 contains a DOM XSS vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://grafana.com/security/security-advisories/cve-2023-3010/ - https://security.netapp.com/advisory/ntap-20240503-0001/
CVE ID: CVE-2023-3011 State: PUBLISHED Published: 2023-07-12T04:38:44.334Z Last Updated: 2024-10-22T19:33:00.764Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: reputeinfosystems Products: ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The ARMember plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.5. This is due to missing or incorrect nonce validation on the arm_check_user_cap function. This makes it possible for unauthenticated attackers to perform multiple unauthorized actions via a forge
_cap function. This makes it possible for unauthenticated attackers to perform multiple unauthorized actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/42f5f29b-2d83-4b15-82aa-0598f8a2317b?source=cve - https://plugins.trac.wordpress.org/changeset/2932691/armember-membership/trunk/autoload.php
CVE ID: CVE-2023-3012 State: PUBLISHED Published: 2023-05-31T00:00:00 Last Updated: 2025-01-09T17:12:26.107Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: gpac Products: gpac/gpac Problem Types: CWE-476 Description: NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/916b787a-c603-409d-afc6-25bb02070e69 - https://github.com/gpac/gpac/commit/53387aa86c1af1228d0fa57c67f9c7330716d5a7 - https://www.debian.org/security/2023/dsa-5452
CVE ID: CVE-2023-3013 State: PUBLISHED Published: 2023-05-31T00:00:00 Last Updated: 2025-01-09T19:42:27.634Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: gpac Products: gpac/gpac Problem Types: CWE-252 Description: Unchecked Return Value in GitHub repository gpac/gpac prior to 2.2.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/52f95edc-cc03-4a9f-9bf8-74f641260073 - https://github.com/gpac/gpac/commit/78e539b43293829a14a32e821f5267e3b7417594
CVE ID: CVE-2023-3014 State: PUBLISHED Published: 2023-05-31T13:31:03.382Z Last Updated: 2024-08-02T06:41:04.130Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: BeipyVideoResolution Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in BeipyVideoResolution up to 2.6. Affected is an unknown function of the file admin/admincore.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-230358 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vul
identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230358 - https://vuldb.com/?ctiid.230358 - https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/BeipyVideoResolution/xss.md
CVE ID: CVE-2023-3015 State: PUBLISHED Published: 2023-05-31T14:00:04.846Z Last Updated: 2024-08-02T06:41:04.085Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: yiwent Products: Vip Video Analysis Problem Types: CWE-918 Description: A vulnerability has been found in yiwent Vip Video Analysis 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file data/title.php. The manipulation of the argument titurl leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230359. Additional Analyst Notes: - CVE Pr
ublic and may be used. The associated identifier of this vulnerability is VDB-230359. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230359 - https://vuldb.com/?ctiid.230359 - https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/VIP-video-analysis/SSRF.md
CVE ID: CVE-2023-3016 State: PUBLISHED Published: 2023-05-31T14:00:05.898Z Last Updated: 2024-08-02T06:41:04.189Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: yiwent Products: Vip Video Analysis Problem Types: CWE-79 Description: A vulnerability was found in yiwent Vip Video Analysis 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/admincore.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230360. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.co
r of this vulnerability is VDB-230360. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230360 - https://vuldb.com/?ctiid.230360 - https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/VIP-video-analysis/XSS.md
CVE ID: CVE-2023-3017 State: PUBLISHED Published: 2023-05-31T14:31:03.108Z Last Updated: 2024-08-02T06:41:04.072Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: SourceCodester Products: Lost and Found Information System Problem Types: CWE-80 Description: A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been classified as problematic. This affects an unknown part of the file admin/?page=user/manage_user of the component Manage User Page. The manipulation of the argument First Name/Middle Name/Last Name leads to basic cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may
ss site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-230361 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230361 - https://vuldb.com/?ctiid.230361 - https://medium.com/@akashpandey380/lost-and-found-information-system-v1-0-html-injection-3596f2b856c0
CVE ID: CVE-2023-3018 State: PUBLISHED Published: 2023-05-31T14:31:04.073Z Last Updated: 2024-08-02T06:41:04.091Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Lost and Found Information System Problem Types: CWE-284 Description: A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/?page=user/list. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-230362 is the identifier assigned to this vulnerability. Additional Analyst Notes
sed to the public and may be used. VDB-230362 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230362 - https://vuldb.com/?ctiid.230362 - https://medium.com/@akashpandey380/lost-and-found-information-system-v1-0-idor-cve-2023-977966c4450d
CVE ID: CVE-2023-3019 State: PUBLISHED Published: 2023-07-24T15:19:19.804Z Last Updated: 2025-11-06T21:26:38.630Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Advanced Virtualization Problem Types: CWE-416 Description: A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process
found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:0135 - https://access.redhat.com/errata/RHSA-2024:0404 - https://access.redhat.com/errata/RHSA-2024:0569 - https://access.redhat.com/errata/RHSA-2024:2135 - https://access.redhat.com/security/cve/CVE-2023-3019 - https://bugzilla.redhat.com/show_bug.cgi?id=2222351
CVE ID: CVE-2023-3020 State: PUBLISHED Published: 2023-05-31T00:00:00 Last Updated: 2025-01-09T21:05:28.326Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: mkucej Products: mkucej/i-librarian-free Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository mkucej/i-librarian-free prior to 5.10.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/92cbe37c-33fa-43bf-8d5b-69aebf51d32c - https://github.com/mkucej/i-librarian-free/commit/3f2c64768a70fc0d529bc29d47bc706ecf26314e
CVE ID: CVE-2023-3021 State: PUBLISHED Published: 2023-05-31T00:00:00 Last Updated: 2025-01-09T21:04:58.188Z Severity: MEDIUM (CVSS 4.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L) Vendors: mkucej Products: mkucej/i-librarian-free Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository mkucej/i-librarian-free prior to 5.10.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/9d289d3a-2931-4e94-b61c-449581736eff - https://github.com/mkucej/i-librarian-free/commit/187e5ff4f413047fb522a9ab24c3c42555d7cfe7
CVE ID: CVE-2023-3022 State: PUBLISHED Published: 2023-06-19T00:00:00.000Z Last Updated: 2025-03-11T14:48:04.464Z Vendors: n/a Products: Linux Kernel (IPv6) Problem Types: CWE-843 Description: A flaw was found in the IPv6 module of the Linux kernel. The arg.result was not used consistently in fib6_rule_lookup, sometimes holding rt6_info and other times fib6_info. This was not accounted for in other parts of the code where rt6_info was expected unconditionally, potentially leading to a kernel panic in fib6_rule_suppress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2211440 - https://github.com/torvalds/li
ISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2211440 - https://github.com/torvalds/linux/commit/a65120bae4b7
CVE ID: CVE-2023-3023 State: PUBLISHED Published: 2023-07-12T04:38:49.121Z Last Updated: 2024-10-16T19:11:54.285Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: levelfourstorefront Products: Shopping Cart & eCommerce Store Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The WP EasyCart plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in versions up to, and including, 5.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, wi
ter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level or above permissions, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c9c1ddaf-4bf2-4937-b7bf-a09162db043e?source=cve - https://plugins.trac.wordpress.org/changeset/2923668/wp-easycart/trunk/admin/inc/wp_easycart_admin_table.php
CVE ID: CVE-2023-3024 State: PUBLISHED Published: 2023-09-29T16:32:30.503Z Last Updated: 2024-09-25T15:44:26.053Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: silabs.com Products: GSDK Problem Types: CWE-787 Description: Forcing the Bluetooth LE stack to segment 'prepare write response' packets can lead to an out-of-bounds memory access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/SiliconLabs/gecko_sdk - https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000ViQvHQAV/?operationContext=S1
CVE ID: CVE-2023-3025 State: PUBLISHED Published: 2023-09-16T08:31:30.152Z Last Updated: 2024-09-25T13:44:03.123Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: hyno Products: Dropbox Folder Share Problem Types: CWE-918 Server-Side Request Forgery (SSRF) Description: The Dropbox Folder Share plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.9.7 via the 'link' parameter. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CVE Program Containe
and can be used to query and modify information from internal services. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d62bd2bd-db01-479f-89e4-8031d69a912f?source=cve - https://plugins.trac.wordpress.org/browser/dropbox-folder-share/trunk/HynoTech/DropboxFolderShare/Principal.php#L118
CVE ID: CVE-2023-3026 State: PUBLISHED Published: 2023-06-01T00:00:00 Last Updated: 2025-01-10T18:55:55.645Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: jgraph Products: jgraph/drawio Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/9bbcc127-1e69-4c88-b318-d2afef48eff0 - https://github.com/jgraph/drawio/commit/c7ac634055c3edfabc7729fc4298a5ab7bfbf384
CVE ID: CVE-2023-3027 State: PUBLISHED Published: 2023-06-05T00:00:00 Last Updated: 2025-01-08T16:52:25.796Z Vendors: n/a Products: RHACM Problem Types: CWE-269 Description: The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values (instead of the policy apply a static manifest on a managed cluster) of taking advantage of cluster scoped access in a created policy. This feature does not restrict properly to lookup content from the namespace where the policy was created. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2211468#c0
CVE ID: CVE-2023-3028 State: PUBLISHED Published: 2023-06-01T05:34:48.206Z Last Updated: 2025-01-10T18:45:46.415Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: Hangzhou Hopechart IoT Technology Co., Ltd. Products: HQT401 Problem Types: CWE-319, CWE-345, CWE-287 Description: Insufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models are possibly affected too. Multiple vulnerabilities were identified: - The MQTT backend does not require authentication, allowing unauthorized connections from an attacker. - T
identified: - The MQTT backend does not require authentication, allowing unauthorized connections from an attacker. - The vehicles publish their telemetry data (e.g. GPS Location, speed, odometer, fuel, etc) as messages in public topics. The backend also sends commands to the vehicles as MQTT posts in public topics. As a result, an attacker can access the confidential data of the entire fleet that is managed by the backend. - The MQTT messages sent by the vehicles or the backend are not encrypted or authenticated. An attacker can create and post messages to impersonate a vehicle or the backend. The attacker could then, for example, send incorrect information to the backend about the vehicle
ehicle or the backend. The attacker could then, for example, send incorrect information to the backend about the vehicle's location. - The backend can inject data into a vehicle´s CAN bus by sending a specific MQTT message on a public topic. Because these messages are not authenticated or encrypted, an attacker could impersonate the backend, create a fake message and inject CAN data in any vehicle managed by the backend. The confirmed version is 201808021036, however further versions have been also identified as potentially impacted. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://asrg.io/security-advisories/cve-2023-3028/
CVE ID: CVE-2023-3029 State: PUBLISHED Published: 2023-06-01T06:00:04.684Z Last Updated: 2024-11-22T17:59:45.290Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Guangdong Products: Pythagorean OA Office System Problem Types: CWE-352 Description: A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic. This vulnerability affects unknown code of the file /note/index/delete. The manipulation of the argument id leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-230458 is the identifier assigned to this vulnerability. Additional Analyst
disclosed to the public and may be used. VDB-230458 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.230458 - https://vuldb.com/?ctiid.230458 - https://gitee.com/gouguopen/office/issues/I74VRG
CVE ID: CVE-2023-3031 State: PUBLISHED Published: 2023-06-02T12:42:11.842Z Last Updated: 2025-01-08T17:58:49.460Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Webbax Products: King-Avis Problem Types: CWE-22 Description: Improper Limitation of a Pathname leads to a Path Traversal vulnerability in the module King-Avis for Prestashop, allowing a user knowing the download token to read arbitrary local files.This issue affects King-Avis: before 17.3.15. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://borelenzo.github.io/stuff/2023/06/01/cve-2023-3031.html
CVE ID: CVE-2023-3032 State: PUBLISHED Published: 2023-06-02T12:28:40.384Z Last Updated: 2025-01-08T18:05:05.431Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Mobatime Products: Mobatime web application Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Mobatime web application (Documentary proof upload modules) allows a malicious user to Upload a Web Shell to a Web Server.This issue affects Mobatime web application: through 06.7.22. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://borelenzo.github.io/stuff/2023/06/01/cve-2023-3032.html
CVE ID: CVE-2023-3033 State: PUBLISHED Published: 2023-06-02T12:28:54.133Z Last Updated: 2025-01-08T17:59:27.935Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Mobatime Products: Mobatime web application Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Mobatime web application allows Privilege Escalation, Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobatime web application: through 06.7.22. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://borelenzo.github.io/stuff/2023/06/01/cve-2023-3033.html
CVE ID: CVE-2023-3034 State: PUBLISHED Published: 2023-06-28T08:09:04.348Z Last Updated: 2024-11-06T20:26:42.857Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: BKG Products: NTRIP Professional Caster Problem Types: CWE-20 Description: Reflected XSS affects the ‘mode’ parameter in the /admin functionality of the web application in versions <=2.0.44 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://igs.bkg.bund.de/ntrip/bkgcaster - https://igs.bkg.bund.de/root_ftp/NTRIP/software/NTRIPCASTER_CHANGELOG
CVE ID: CVE-2023-3035 State: PUBLISHED Published: 2023-06-01T13:31:03.225Z Last Updated: 2024-08-02T06:41:04.141Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Guangdong Products: Pythagorean OA Office System Problem Types: CWE-79 Description: A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Schedule Handler. The manipulation of the argument description leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-2
. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230467. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230467 - https://vuldb.com/?ctiid.230467 - https://gitee.com/gouguopen/office/issues/I74ZPU
CVE ID: CVE-2023-3036 State: PUBLISHED Published: 2023-06-14T11:08:08.969Z Last Updated: 2025-01-02T19:22:43.099Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Cloudflare Products: cfnts Problem Types: CWE-119, CWE-125 Description: An unchecked read in NTP server in github.com/cloudflare/cfnts prior to commit 783490b https://github.com/cloudflare/cfnts/commit/783490b913f05e508a492cd7b02e3c4ec2297b71 enabled a remote attacker to trigger a panic by sending an NTSAuthenticator packet with extension length longer than the packet contents. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cloudflare/cfnts
ional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cloudflare/cfnts/security/advisories/GHSA-pwx6-gw47-96cp
CVE ID: CVE-2023-3037 State: PUBLISHED Published: 2023-10-04T11:10:09.394Z Last Updated: 2024-09-19T19:20:32.337Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: HelpDezk Products: HelpDezk Community Problem Types: CWE-285 Description: Improper authorization vulnerability in HelpDezk Community affecting version 1.1.10. This vulnerability could allow a remote attacker to access the platform without authentication and retrieve personal data via the jsonGrid parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-helpdezk-community