Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-3800 State: PUBLISHED Published: 2023-07-20T23:00:04.741Z Last Updated: 2024-10-24T14:52:14.944Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: EasyAdmin8 Problem Types: CWE-434 Description: A vulnerability was found in EasyAdmin8 2.0.2.2. It has been classified as problematic. Affected is an unknown function of the file /admin/index/index.html#/admin/mall.goods/index.html of the component File Upload Module. The manipulation leads to unrestricted upload. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vuln
ility is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235068. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.235068 - https://vuldb.com/?ctiid.235068 - https://github.com/wolf-leo/EasyAdmin8/issues/1
CVE ID: CVE-2023-3801 State: PUBLISHED Published: 2023-07-20T23:31:03.186Z Last Updated: 2024-08-02T07:08:50.170Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBOS Products: OA Problem Types: CWE-89 Description: A vulnerability was found in IBOS OA 4.5.5. It has been declared as critical. Affected by this vulnerability is the function actionEdit of the file ?r=officialdoc/officialdoc/edit of the component Mobile Notification Handler. The manipulation leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-235069 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure b
e identifier VDB-235069 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.235069 - https://vuldb.com/?ctiid.235069 - https://github.com/funnn7/cve/blob/main/sql.md - https://github.com/Wkingxc/CVE/blob/master/ibos_OA_1.md
CVE ID: CVE-2023-3802 State: PUBLISHED Published: 2023-07-21T00:00:07.715Z Last Updated: 2024-08-02T07:08:50.464Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Chengdu Products: Flash Flood Disaster Monitoring and Warning System Problem Types: CWE-434 Description: A vulnerability was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /Controller/Ajaxfileupload.ashx. The manipulation of the argument file leads to unrestricted upload. The exploit has been disclosed to the public and may be used. VDB-235070 is the identifier assigned to thi
icted upload. The exploit has been disclosed to the public and may be used. VDB-235070 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.235070 - https://vuldb.com/?ctiid.235070 - https://github.com/GUIqizsq/cve/blob/main/upload_1.md
CVE ID: CVE-2023-3803 State: PUBLISHED Published: 2023-07-21T00:31:03.420Z Last Updated: 2024-08-02T07:08:50.377Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Chengdu Products: Flash Flood Disaster Monitoring and Warning System Problem Types: CWE-330 Description: A vulnerability classified as problematic has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This affects an unknown part of the file /Service/ImageStationDataService.asmx of the component File Name Handler. The manipulation leads to insufficiently random values. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has bee
ndom values. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235071. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.235071 - https://vuldb.com/?ctiid.235071 - https://github.com/GUIqizsq/cve/blob/main/upload_2.md
CVE ID: CVE-2023-3804 State: PUBLISHED Published: 2023-07-21T01:00:04.439Z Last Updated: 2024-08-02T07:08:50.020Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Chengdu Products: Flash Flood Disaster Monitoring and Warning System Problem Types: CWE-434 Description: A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability affects unknown code of the file /Service/FileHandler.ashx. The manipulation of the argument userFile leads to unrestricted upload. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235072. NOTE: The vendo
it has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235072. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.235072 - https://vuldb.com/?ctiid.235072 - https://github.com/yueying638/cve/blob/main/upload.md
CVE ID: CVE-2023-3805 State: PUBLISHED Published: 2023-07-21T01:31:03.740Z Last Updated: 2024-08-02T07:08:50.356Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Xiamen Four Letter Products: Video Surveillance Management System Problem Types: CWE-285 Description: A vulnerability, which was classified as critical, has been found in Xiamen Four Letter Video Surveillance Management System up to 20230712. This issue affects some unknown processing in the library UserInfoAction.class of the component Login. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235073 was
k may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235073 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.235073 - https://vuldb.com/?ctiid.235073 - https://github.com/GUIqizsq/cve/blob/main/login.md
CVE ID: CVE-2023-3806 State: PUBLISHED Published: 2023-07-21T02:00:05.253Z Last Updated: 2024-10-24T14:33:32.935Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: House Rental and Property Listing System Problem Types: CWE-434 Description: A vulnerability, which was classified as critical, was found in SourceCodester House Rental and Property Listing System 1.0. Affected is an unknown function of the file btn_functions.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-235074 is the identifier assigned to this vulnerability. Additional Analyst
isclosed to the public and may be used. VDB-235074 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.235074 - https://vuldb.com/?ctiid.235074 - https://github.com/GZRsecurity/Cve-System/blob/main/House%20Rental%20and%20Property%20Listing%20System%20register.php%20has%20%20File%20Upload(RCE)%20Vulnerability.pdf
CVE ID: CVE-2023-3807 State: PUBLISHED Published: 2023-07-21T02:31:03.744Z Last Updated: 2024-08-02T07:08:50.324Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Beauty Salon Management System Problem Types: CWE-89 Description: A vulnerability has been found in Campcodes Beauty Salon Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file edit_product.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235075. Additional Analyst No
osed to the public and may be used. The associated identifier of this vulnerability is VDB-235075. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.235075 - https://vuldb.com/?ctiid.235075 - https://github.com/E1CHO/cve_hub/blob/main/Beauty%20Salon%20Management%20System%20-%20vuln%202.pdf
CVE ID: CVE-2023-3808 State: PUBLISHED Published: 2023-07-21T03:00:05.799Z Last Updated: 2024-08-02T07:08:50.209Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: Hospital Management System Problem Types: CWE-89 Description: A vulnerability was found in Hospital Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file patientforgotpassword.php. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235076. Additional Analyst Notes: - CVE Program Container: References: - https://vuld
ifier of this vulnerability is VDB-235076. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.235076 - https://vuldb.com/?ctiid.235076 - https://github.com/GZRsecurity/Cve-System/blob/main/Hospital%20Management%20System%20patientforgotpassword.php%20has%20Sqlinjection.pdf
CVE ID: CVE-2023-3809 State: PUBLISHED Published: 2023-07-21T03:31:03.395Z Last Updated: 2024-08-02T07:08:50.467Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: Hospital Management System Problem Types: CWE-89 Description: A vulnerability was found in Hospital Management System 1.0. It has been classified as critical. This affects an unknown part of the file patient.php. The manipulation of the argument address leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235077 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References
identifier VDB-235077 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.235077 - https://vuldb.com/?ctiid.235077 - https://github.com/GZRsecurity/Cve-System/blob/main/Hospital%20Management%20System%20patient.php%20has%20Sqlinjection.pdf
CVE ID: CVE-2023-3810 State: PUBLISHED Published: 2023-07-21T04:00:05.955Z Last Updated: 2024-08-02T07:08:50.193Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: Hospital Management System Problem Types: CWE-89 Description: A vulnerability was found in Hospital Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file patientappointment.php. The manipulation of the argument loginid/password/mobileno/appointmentdate/appointmenttime/patiente/dob/doct/city leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-235078 is the identifier assigned to
itiated remotely. The exploit has been disclosed to the public and may be used. VDB-235078 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.235078 - https://vuldb.com/?ctiid.235078 - https://github.com/GZRsecurity/Cve-System/blob/main/Hospital%20Management%20System%20patientappointment.php%20has%20Sqlinjection.pdf
CVE ID: CVE-2023-3811 State: PUBLISHED Published: 2023-07-21T04:31:03.748Z Last Updated: 2024-08-02T07:08:50.461Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: Hospital Management System Problem Types: CWE-89 Description: A vulnerability was found in Hospital Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file patientprofile.php. The manipulation of the argument address leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235079. Additional Analyst Notes: - CISA ADP Vulnrichment: - C
d. The associated identifier of this vulnerability is VDB-235079. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.235079 - https://vuldb.com/?ctiid.235079 - https://github.com/GZRsecurity/Cve-System/blob/main/Hospital%20Management%20System%20patientprofile.php%20has%20Sqlinjection.pdf
CVE ID: CVE-2023-3812 State: PUBLISHED Published: 2023-07-24T15:19:21.817Z Last Updated: 2025-11-06T21:00:37.422Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterpr
x 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-787 Description: An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This fl
driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2023:6799 - https://access.redhat.com/errata/RHSA-2023:6813 - https://access.redhat.com/errata/RHSA-2023:7370 - https://access.redhat.com/errata/RHSA-2023:7379 - https://access.redhat.com/errata/RHSA-2023:7382 - https://access.redhat.com/errata/RHSA-2023:7389 - https://access.redhat.com/errata/RHSA-2023:7411 - https://access.redhat.com/errata/RHSA-2023:7418 - ht
/RHSA-2023:7389 - https://access.redhat.com/errata/RHSA-2023:7411 - https://access.redhat.com/errata/RHSA-2023:7418 - https://access.redhat.com/errata/RHSA-2023:7548 - https://access.redhat.com/errata/RHSA-2023:7549 - https://access.redhat.com/errata/RHSA-2023:7554 - https://access.redhat.com/errata/RHSA-2024:0340 - https://access.redhat.com/errata/RHSA-2024:0378 - https://access.redhat.com/errata/RHSA-2024:0412 - https://access.redhat.com/errata/RHSA-2024:0461 - https://access.redhat.com/errata/RHSA-2024:0554 - https://access.redhat.com/errata/RHSA-2024:0562 - https://access.redhat.com/errata/RHSA-2024:0563 - https://access.redhat.com/errata/RHSA-2024:0575 - https://access.redhat.com/errata
ss.redhat.com/errata/RHSA-2024:0563 - https://access.redhat.com/errata/RHSA-2024:0575 - https://access.redhat.com/errata/RHSA-2024:0593 - https://access.redhat.com/errata/RHSA-2024:1961 - https://access.redhat.com/errata/RHSA-2024:2006 - https://access.redhat.com/errata/RHSA-2024:2008 - https://access.redhat.com/security/cve/CVE-2023-3812 - https://bugzilla.redhat.com/show_bug.cgi?id=2224048 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=363a5328f4b0
CVE ID: CVE-2023-3813 State: PUBLISHED Published: 2023-07-21T02:04:26.822Z Last Updated: 2025-02-05T19:38:50.652Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: artbees/ Products: Jupiter X Core Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 2.5.0. This makes it possible for unauthenticated attackers to download the contents of arbitrary files on the server, which can contain sensitive information. The requires the premium version of the plugin to be activated. Additional Analyst
ch can contain sensitive information. The requires the premium version of the plugin to be activated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f767d94b-fe92-4b69-9d81-96de51e12983?source=cve - https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/extensions/raven/includes/utils.php?rev=2777235#L425
CVE ID: CVE-2023-3814 State: PUBLISHED Published: 2023-09-04T11:27:01.778Z Last Updated: 2025-03-06T16:03:22.116Z Vendors: Unknown Products: Advanced File Manager Problem Types: CWE-863 Incorrect Authorization Description: The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ca954ec6-6ebd-4d72-a323-570474e2e339
CVE ID: CVE-2023-3815 State: PUBLISHED Published: 2023-07-21T05:00:04.905Z Last Updated: 2024-10-17T20:10:28.413Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: y_project Products: RuoYi Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in y_project RuoYi up to 4.7.7. Affected by this issue is the function uploadFilesPath of the component File Upload. The manipulation of the argument originalFilenames leads to cross site scripting. The attack may be launched remotely. VDB-235118 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vu
this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.235118 - https://vuldb.com/?ctiid.235118 - https://gitee.com/y_project/RuoYi/issues/I7IL85
CVE ID: CVE-2023-3817 State: PUBLISHED Published: 2023-07-31T15:34:13.627Z Last Updated: 2025-05-05T15:53:49.014Z Vendors: OpenSSL Products: OpenSSL Problem Types: CWE-606 Description: Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q paramete
H_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this
ons. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20230731.txt - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5 - https://git.openssl.org/gitweb/?p=opens
/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644
CVE ID: CVE-2023-3819 State: PUBLISHED Published: 2023-07-21T14:37:57.468Z Last Updated: 2024-10-16T13:57:28.106Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pimcore/pimcore prior to 10.6.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/be5e4d4c-1b0b-4c01-a1fc-00533135817c - https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54
CVE ID: CVE-2023-3820 State: PUBLISHED Published: 2023-07-21T14:44:44.799Z Last Updated: 2024-10-16T13:54:24.107Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-89 Description: SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/b00a38b6-d040-494d-bf46-38f46ac1a1db - https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97
CVE ID: CVE-2023-3821 State: PUBLISHED Published: 2023-07-21T14:50:39.925Z Last Updated: 2024-10-16T13:47:02.189Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.6.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/599ba4f6-c900-4161-9127-f1e6a6e29aaa - https://github.com/pimcore/pimcore/commit/92811f07d39e4ad95c92003868f5f7309489d79c
CVE ID: CVE-2023-3822 State: PUBLISHED Published: 2023-07-21T14:52:05.707Z Last Updated: 2024-10-16T13:44:53.274Z Severity: MEDIUM (CVSS 6 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/2a3a13fe-2a9a-4d1a-8814-fd8ed1e3b1d5 - https://github.com/pimcore/pimcore/commit/d75888a9b14baaad591548463cca09dfd1395236