Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-48792 State: PUBLISHED Published: 2024-02-02T00:00:00.000Z Last Updated: 2025-06-11T16:58:13.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADAudit Plus through 7250 is vulnerable to SQL Injection in the report export option. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://manageengine.com - https://www.manageengine.com/products/active-directory-audit/sqlfix-7271.html
CVE ID: CVE-2023-48793 State: PUBLISHED Published: 2024-02-02T00:00:00.000Z Last Updated: 2025-06-11T16:59:05.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADAudit Plus through 7250 allows SQL Injection in the aggregate report feature. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://manageengine.com - https://www.manageengine.com/products/active-directory-audit/sqlfix-7271.html
CVE ID: CVE-2023-48795 State: PUBLISHED Published: 2023-12-18T00:00:00.000Z Last Updated: 2025-11-04T22:05:21.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandl
cause the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before
bssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before
e 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html - https://matt.ucc.asn.au/dropbear/CHANGES - https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES - https://www.netsarang.
matt.ucc.asn.au/dropbear/CHANGES - https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES - https://www.netsarang.com/en/xshell-update-history/ - https://www.paramiko.org/changelog.html - https://www.openssh.com/openbsd.html - https://github.com/openssh/openssh-portable/commits/master - https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ - https://www.bitvise.com/ssh-server-version-history - https://github.com/ronf/asyncssh/tags - https://gitlab.com/libssh/libssh-mirror/-/tags - https://www.reddit.com/r/sysadmin/comments/18idv52/cve202348795_why_is_this_cve_still_undisclosed/ - https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L
l_undisclosed/ - https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L39-L42 - https://www.openssh.com/txt/release-9.6 - https://jadaptive.com/important-java-ssh-security-update-new-ssh-vulnerability-discovered-cve-2023-48795/ - https://www.terrapin-attack.com - https://github.com/mkj/dropbear/blob/17657c36cce6df7716d5ff151ec09a665382d5dd/CHANGES#L25 - https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst - https://thorntech.com/cve-2023-48795-and-sftp-gateway/ - https://github.com/warp-tech/russh/releases/tag/v0.40.2 - https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0 - https://www.openwall.
.2 - https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0 - https://www.openwall.com/lists/oss-security/2023/12/18/2 - https://twitter.com/TrueSkrillor/status/1736774389725565005 - https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d - https://github.com/paramiko/paramiko/issues/2337 - https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg - https://news.ycombinator.com/item?id=38684904 - https://news.ycombinator.com/item?id=38685286 - http://www.openwall.com/lists/oss-security/2023/12/18/3 - https://github.com/mwiede/jsch/issues/457 - https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.10&id=10e09e273f69e149389b
ub.com/mwiede/jsch/issues/457 - https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.10&id=10e09e273f69e149389b3e0e5d44b8c221c2e7f6 - https://github.com/erlang/otp/releases/tag/OTP-26.2.1 - https://github.com/advisories/GHSA-45x7-px36-x8w8 - https://security-tracker.debian.org/tracker/source-package/libssh2 - https://security-tracker.debian.org/tracker/source-package/proftpd-dfsg - https://security-tracker.debian.org/tracker/CVE-2023-48795 - https://bugzilla.suse.com/show_bug.cgi?id=1217950 - https://bugzilla.redhat.com/show_bug.cgi?id=2254210 - https://bugs.gentoo.org/920280 - https://ubuntu.com/security/CVE-2023-48795 - https://www.suse.com/c/suse-addresses-the-ssh-v2-protocol-ter
.org/920280 - https://ubuntu.com/security/CVE-2023-48795 - https://www.suse.com/c/suse-addresses-the-ssh-v2-protocol-terrapin-attack-aka-cve-2023-48795/ - https://access.redhat.com/security/cve/cve-2023-48795 - https://github.com/mwiede/jsch/pull/461 - https://github.com/drakkan/sftpgo/releases/tag/v2.5.6 - https://github.com/libssh2/libssh2/pull/1291 - https://forum.netgate.com/topic/184941/terrapin-ssh-attack - https://github.com/jtesta/ssh-audit/commit/8e972c5e94b460379fe0c7d20209c16df81538a5 - https://github.com/rapier1/hpn-ssh/releases - https://github.com/proftpd/proftpd/issues/456 - https://github.com/TeraTermProject/teraterm/releases/tag/v5.1 - https://github.com/mwiede/jsch/compare/
tpd/issues/456 - https://github.com/TeraTermProject/teraterm/releases/tag/v5.1 - https://github.com/mwiede/jsch/compare/jsch-0.2.14...jsch-0.2.15 - https://oryx-embedded.com/download/#changelog - https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update - https://github.com/connectbot/sshlib/compare/2.2.21...2.2.22 - https://github.com/connectbot/sshlib/commit/5c8b534f6e97db7ac0e0e579331213aa25c173ab - https://github.com/mscdex/ssh2/commit/97b223f8891b96d6fc054df5ab1d5a1a545da2a3 - https://nest.pijul.com/pijul/thrussh/changes/D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC - https://crates.io/crates/thrussh/versions - https://github.com/NixOS/nixpkgs/pull/275249 - http://www.openwall.c
QFRQC - https://crates.io/crates/thrussh/versions - https://github.com/NixOS/nixpkgs/pull/275249 - http://www.openwall.com/lists/oss-security/2023/12/19/5 - https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc - https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/ - http://www.openwall.com/lists/oss-security/2023/12/20/3 - http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html - https://github.com/proftpd/proftpd/blob/d21e7a2e47e9b38f709bec58e3fa711f759ad0e1/RELEASE_NOTES - https://github.com/proftpd/proftpd/blob/0a7ea9b0ba9fcdf368374a226370d08f10397d99/RELEASE_NOTES - https://gith
SE_NOTES - https://github.com/proftpd/proftpd/blob/0a7ea9b0ba9fcdf368374a226370d08f10397d99/RELEASE_NOTES - https://github.com/apache/mina-sshd/issues/445 - https://github.com/hierynomus/sshj/issues/916 - https://github.com/janmojzis/tinyssh/issues/81 - https://www.openwall.com/lists/oss-security/2023/12/20/3 - https://security-tracker.debian.org/tracker/source-package/trilead-ssh2 - https://github.com/net-ssh/net-ssh/blob/2e65064a52d73396bfc3806c9196fc8108f33cd8/CHANGES.txt#L14-L16 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/ - https://www.debian.org/security/2023/dsa-5586 - https://www.lancom-systems.de
essage/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/ - https://www.debian.org/security/2023/dsa-5586 - https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise#c243508 - https://www.theregister.com/2023/12/20/terrapin_attack_ssh - https://filezilla-project.org/versions.php - https://nova.app/releases/#v11.8 - https://roumenpetrov.info/secsh/#news20231220 - https://www.vandyke.com/products/securecrt/history.txt - https://help.panic.com/releasenotes/transmit5/ - https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v9.5.0.0p1-Beta - https://github.com/PowerShell/Win32-OpenSSH/issues/2189 - https://winscp.net/eng/docs/history#6.2.2 - https://www.bitvise.com/ssh-client-version-history
n32-OpenSSH/issues/2189 - https://winscp.net/eng/docs/history#6.2.2 - https://www.bitvise.com/ssh-client-version-history#933 - https://github.com/cyd01/KiTTY/issues/520 - https://www.debian.org/security/2023/dsa-5588 - https://github.com/ssh-mitm/ssh-mitm/issues/165 - https://news.ycombinator.com/item?id=38732005 - https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html - https://security.gentoo.org/glsa/202312-16 - https://security.gentoo.org/glsa/202312-17 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/me
LIHDB5QCXQEX7HXHAWMOKPP5O/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7EYCFQCTSGJXWO3ZZ44MGKFC5HA7G3Y/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QI3EHAHABFQK7OABNCSF5GMYP6TONTI7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KMZCVGUGJZZVDPCVDA7TEB22VUCNEXDD/ - https://security.netapp.com/advisory/ntap-20240105-0004/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
tapp.com/advisory/ntap-20240105-0004/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CAYYW35MUTNO65RVAELICTNZZFMT2XS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BL5KTLOSLH2KHRN4HCXJPK3JUVLDGEL6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSH
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/ - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0002 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYEDEXIKFKTUJ
YLWD6P/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/ - https://lists.debian.org/debian-lts-announce/2024/01/msg00013.html - https://lists.debian.org/debian-lts-announce/2024/01/msg00014.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/ - https://support.appl
rchives/list/package-announce%40lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/ - https://support.apple.com/kb/HT214084 - http://seclists.org/fulldisclosure/2024/Mar/21 - https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html - http://www.openwall.com/lists/oss-security/2024/04/17/8 - http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE ID: CVE-2023-48796 State: PUBLISHED Published: 2023-11-24T07:56:43.542Z Last Updated: 2025-02-13T17:18:22.311Z Vendors: Apache Software Foundation Products: Apache DolphinScheduler Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable `MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus` to workaround this, or add the following section in the `application.yaml` file ``` management: endpoints: web: exposure: inc
rkaround this, or add the following section in the `application.yaml` file ``` management: endpoints: web: exposure: include: health,metrics,prometheus ``` This issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the issue. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/ffrmkcwgr2lcz0f5nnnyswhpn3fytsvo - http://www.openwall.com/lists/oss-security/2023/11/24/1
CVE ID: CVE-2023-48799 State: PUBLISHED Published: 2023-12-04T00:00:00 Last Updated: 2024-08-02T21:46:27.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK-X6000R Firmware-V9.4.0cu.852_B20230719 is vulnerable to Command Execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.notion.so/X6000R-632dd667b4574a2c84b04035d04afb5c?pvs=4 - https://palm-jump-676.notion.site/CVE-2023-48799-632dd667b4574a2c84b04035d04afb5c
CVE ID: CVE-2023-48800 State: PUBLISHED Published: 2023-12-04T00:00:00 Last Updated: 2024-08-02T21:46:27.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_417338 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resulting in a command execution vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.notion.so/X6000R-sub_417338-ad96548d06c645738daf3ab77575fd74?pvs=4 - https://palm-jump-676.notion.site/CVE-2023-48800-ad96548d06c645738daf3ab77575fd74
CVE ID: CVE-2023-48801 State: PUBLISHED Published: 2023-12-01T00:00:00 Last Updated: 2024-11-26T19:09:58.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_415534 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resulting in a command execution vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.notion.so/X6000R-sub_415534-40d4553fc7a649fe833201fcecf76f2b?pvs=4 - https://palm-jump-676.notion.site/CVE-2023-48801-40d4553fc7a649fe833201fcecf76f2b
CVE ID: CVE-2023-48802 State: PUBLISHED Published: 2023-11-30T00:00:00.000Z Last Updated: 2025-06-05T13:33:33.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.notion.so/X6000R-sub_4119A0-6-9541a9b3387a40de856a1cad692ba8d4?pvs=4
CVE ID: CVE-2023-48803 State: PUBLISHED Published: 2023-11-30T00:00:00 Last Updated: 2024-08-02T21:46:28.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.notion.so/X6000R-sub_4119A0-4-aead0a851416422ea2e282409eec3351?pvs=4
CVE ID: CVE-2023-48804 State: PUBLISHED Published: 2023-11-30T00:00:00 Last Updated: 2024-08-02T21:46:27.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.notion.so/X6000R-sub_4119A0-1-e9697e90e8b04e05a6d10c9fb7288750?pvs=4
CVE ID: CVE-2023-48805 State: PUBLISHED Published: 2023-11-30T00:00:00 Last Updated: 2024-08-02T21:46:27.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.notion.so/X6000R-sub_4119A0-2-6a912e23617244409ae8c5837d4288b4?pvs=4
CVE ID: CVE-2023-48806 State: PUBLISHED Published: 2023-11-30T00:00:00 Last Updated: 2024-08-02T21:46:27.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.notion.so/X6000R-sub_4119A0-5-92b3d1e22e764ae7a18cdf0d8ac24e4f?pvs=4
CVE ID: CVE-2023-48807 State: PUBLISHED Published: 2023-11-30T00:00:00 Last Updated: 2024-08-02T21:46:27.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.notion.so/X6000R-sub_4119A0-3-1e21686eebf94cee8a7819d1d7aa29b9?pvs=4
CVE ID: CVE-2023-48808 State: PUBLISHED Published: 2023-11-30T00:00:00 Last Updated: 2024-08-02T21:46:27.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.notion.so/X6000R-sub_4119A0-9-075ccc78275a4381a65e114eb1fddd6e?pvs=4
CVE ID: CVE-2023-48810 State: PUBLISHED Published: 2023-11-30T00:00:00 Last Updated: 2024-08-02T21:46:27.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.notion.so/X6000R-sub_4119A0-7-d5387bf8d16846c2b4f19b15a808aa4c?pvs=4
CVE ID: CVE-2023-48811 State: PUBLISHED Published: 2023-11-30T00:00:00 Last Updated: 2024-08-02T21:46:27.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function that when passed to the CsteSystem function creates a command execution vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.notion.so/X6000R-sub_4119A0-8-2332305e3d8044c09f093404a8ae59f4?pvs=4
CVE ID: CVE-2023-48812 State: PUBLISHED Published: 2023-11-30T00:00:00 Last Updated: 2024-11-26T15:47:25.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function that when passed to the CsteSystem function creates a command execution vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.notion.so/X6000R-sub_4119A0-10-82467d98d07c45a59ec3729ec712cb57?pvs=4
CVE ID: CVE-2023-48813 State: PUBLISHED Published: 2023-12-01T00:00:00 Last Updated: 2024-08-02T21:46:28.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: Senayan Library Management Systems (Slims) 9 Bulian v9.6.1 is vulnerable to SQL Injection via admin/modules/reporting/customs/fines_report.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/komangsughosa/CVE-ID-not-yet/blob/main/slims/slims9_bulian-9.6.1-SQLI-fines_report.md - https://github.com/slims/slims9_bulian/issues/217
CVE ID: CVE-2023-48815 State: PUBLISHED Published: 2023-12-04T00:00:00 Last Updated: 2024-08-02T21:46:27.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: kkFileView v4.3.0 is vulnerable to Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kekingcn/kkFileView - https://github.com/varzhang/There-is-a-vulnerability-in-kkFileView/blob/main/README.md
CVE ID: CVE-2023-48823 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T21:46:28.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Blind SQL injection issue in ajax.php in GaatiTrack Courier Management System 1.0 allows an unauthenticated attacker to inject a payload via the email parameter during login. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/176030
CVE ID: CVE-2023-48824 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T21:46:27.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: BoidCMS 2.0.1 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the title, subtitle, footer, or keywords parameter in a page=create action. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/176031