Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-3343 State: PUBLISHED Published: 2023-07-13T02:04:14.751Z Last Updated: 2024-10-17T13:41:15.434Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpeverest Products: User Registration – Custom Registration Form, Login Form And User Profile For WordPress Problem Types: CWE-502 Deserialization of Untrusted Data Description: The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1 via deserialization of untrusted input from the 'profile-pic-url' parameter. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present
s authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3590277a-3319-4707-b728-d75ea59e8ad9?source=cve - https://plugins.trac.wordpress.org/browser/user-registration/tags/3.0.1/includes/functions-ur-core.php#L3156 - https://plugins.trac.wordpress.org/changeset/2932199/use
-registration/tags/3.0.1/includes/functions-ur-core.php#L3156 - https://plugins.trac.wordpress.org/changeset/2932199/user-registration/trunk/includes/functions-ur-core.php#file0
CVE ID: CVE-2023-3344 State: PUBLISHED Published: 2023-07-24T10:20:24.383Z Last Updated: 2025-05-05T15:55:12.748Z Vendors: Unknown Products: Auto Location for WP Job Manager via Google Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Auto Location for WP Job Manager via Google WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d27bc628-3de1-4
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d27bc628-3de1-421e-8a67-150e9d7a96dd
CVE ID: CVE-2023-3345 State: PUBLISHED Published: 2023-07-31T09:37:36.423Z Last Updated: 2024-08-30T13:34:18.185Z Vendors: Unknown Products: LMS by Masteriyo Problem Types: CWE-863 Incorrect Authorization Description: The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possible for any students to retrieve email addresses of other students Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0d07423e-98d2-43a3-824d-562747a3d65a
CVE ID: CVE-2023-3346 State: PUBLISHED Published: 2023-08-03T04:00:43.294Z Last Updated: 2024-12-04T15:16:48.710Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Mitsubishi Electric Corporation Products: MITSUBISHI CNC M800V Series M800VW, MITSUBISHI CNC M800V Series M800VS, MITSUBISHI CNC M80V Series M80V, MITSUBISHI CNC M80V Series M80VW, MITSUBISHI CNC M800 Series M800W, MITSUBISHI CNC M800 Series M800S, MITSUBISHI CNC M80 Series M80, MITSUBISHI CNC M80 Series M80W, MITSUBISHI CNC E80 Series E80, MITSUBISHI CNC C80 Series C80, MITSUBISHI CNC M700V Series M720VW, MITSUBISHI CNC M700V Series M730VW, MITSUBISHI CNC M700V Series M750VW, MITSUBISHI CNC M700V
HI CNC M700V Series M720VW, MITSUBISHI CNC M700V Series M730VW, MITSUBISHI CNC M700V Series M750VW, MITSUBISHI CNC M700V Series M720VS, MITSUBISHI CNC M700V Series M730VS, MITSUBISHI CNC M700V Series M750VS, MITSUBISHI CNC M70V Series M70V, MITSUBISHI CNC E70 Series E70, MITSUBISHI CNC IoT Unit Remote Service Gateway Unit, MITSUBISHI CNC IoT Unit Data Acquisition Unit Problem Types: CWE-120 Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause Denial of Service (DoS) condition and execute arbitrary code on the product by sending specially crafted packets. In addition, system
ice (DoS) condition and execute arbitrary code on the product by sending specially crafted packets. In addition, system reset is required for recovery. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-007_en.pdf - https://jvn.jp/vu/JVNVU90352157/index.html - https://www.cisa.gov/news-events/ics-advisories/icsa-23-208-03
CVE ID: CVE-2023-3347 State: PUBLISHED Published: 2023-07-20T14:54:05.525Z Last Updated: 2025-11-20T17:26:17.194Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Storage 3 Problem Types: CWE-347 Description: A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middl
lers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and server, affecting the integrity of the data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:4325 - https://access.redhat.com/errata/RHSA-2023:4328 - https://access.redhat.com/security/cve/CVE-2023-3347 - https://bugzilla.redhat.com/show_bug.cgi?id=2222792 - https://www.samba.org/samba/security/CVE-2023-3347.html
CVE ID: CVE-2023-3348 State: PUBLISHED Published: 2023-08-03T13:47:07.296Z Last Updated: 2024-10-09T20:34:14.644Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Cloudflare Products: Wrangler Problem Types: CWE-22 Description: The Wrangler command line tool (<=wrangler@3.1.0 or <=wrangler@2.20.1) was affected by a directory traversal vulnerability when running a local development server for Pages (wrangler pages dev command). This vulnerability enabled an attacker in the same network as the victim to connect to the local development server and access the victim's files present outside of the directory for the development server. Additional Analyst Notes: - C
and access the victim's files present outside of the directory for the development server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-8c93-4hch-xgxp - https://github.com/cloudflare/workers-sdk - https://developers.cloudflare.com/workers/wrangler/
CVE ID: CVE-2023-3349 State: PUBLISHED Published: 2023-10-03T13:24:44.830Z Last Updated: 2024-09-19T19:47:16.780Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: IBERMATICA Products: IBERMATICA RPS 2019 Problem Types: CWE-200 Description: Information exposure vulnerability in IBERMATICA RPS 2019, which exploitation could allow an unauthenticated user to retrieve sensitive information, such as usernames, IP addresses or SQL queries sent to the application. By accessing the URL /RPS2019Service/status.html, the application enables the logging mechanism by generating the log file, which can be downloaded. Additional Analyst Notes: - CVE Program Container: - CISA A
chanism by generating the log file, which can be downloaded. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ibermatica-rps-2019
CVE ID: CVE-2023-3350 State: PUBLISHED Published: 2023-10-03T13:26:03.410Z Last Updated: 2024-09-23T17:18:21.586Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: IBERMATICA Products: IBERMATICA RPS 2019 Problem Types: cwe-310 Description: A Cryptographic Issue vulnerability has been found on IBERMATICA RPS, affecting version 2019. By firstly downloading the log file, an attacker could retrieve the SQL query sent to the application in plaint text. This log file contains the password hashes coded with AES-CBC-128 bits algorithm, which can be decrypted with a .NET function, obtaining the username's password in plain text. Additional Analyst Notes: - CVE Program C
crypted with a .NET function, obtaining the username's password in plain text. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ibermatica-rps-2019
CVE ID: CVE-2023-3351 State: REJECTED Published: N/A Last Updated: 2023-06-21T11:28:49.486Z Description: No description available.
CVE ID: CVE-2023-3352 State: PUBLISHED Published: 2024-06-21T02:05:43.900Z Last Updated: 2024-08-02T06:55:01.144Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpmudev Products: Smush Image Optimization – Optimize Images | Compress & Lazy Load Images | Convert WebP | Image CDN Problem Types: CWE-862 Missing Authorization Description: The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the delete_resmush_list() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to delete the resmush list for Nextgen or the Media Library. Addit
ckers, with minimal permissions such as a subscriber, to delete the resmush list for Nextgen or the Media Library. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dfbaa3e4-40c2-41d8-996c-232e27a04b73?source=cve - https://plugins.trac.wordpress.org/changeset/3105107/wp-smushit/trunk/app/class-ajax.php
CVE ID: CVE-2023-3353 State: REJECTED Published: N/A Last Updated: 2024-06-20T13:17:26.170Z Description: No description available.
CVE ID: CVE-2023-3354 State: PUBLISHED Published: 2023-07-11T16:16:56.294Z Last Updated: 2025-02-13T16:55:08.379Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a, Red Hat, Fedora Products: qemu, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8 Advanced Virtualization, Red Hat Enterprise Linux 9, Red Hat OpenStack Platform 13 (Queens), Fedora, Extra Packages for Enterprise Linux Problem Types: CWE-476 Description: A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so,
onnects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so, cleans up the previous connection. If the previous connection happens to be in the handshake phase and fails, QEMU cleans up the connection again, resulting in a NULL pointer dereference issue. This could allow a remote unauthenticated client to cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-3354 - https://bugzilla.redhat.com/show_bug.cgi?id=2216478 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MURWGXDIF2WTDXV36T6HFJDBL632AO7R/ - ht
.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MURWGXDIF2WTDXV36T6HFJDBL632AO7R/ - https://lists.debian.org/debian-lts-announce/2024/03/msg00012.html
CVE ID: CVE-2023-3355 State: PUBLISHED Published: 2023-06-28T00:00:00.000Z Last Updated: 2025-03-05T18:55:32.966Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a, Red Hat, Fedora Products: kernel, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Fedora Problem Types: CWE-476 Description: A NULL pointer dereference flaw was found in the Linux kernel's drivers/gpu/drm/msm/msm_gem_submit.c code in the submit_lookup_cmds function, which fails because it lacks a check of the return value of kmalloc(). This issue allows a local user to crash the system. Additional Analyst Notes: - CVE Program Conta
rn value of kmalloc(). This issue allows a local user to crash the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-3355 - https://bugzilla.redhat.com/show_bug.cgi?id=2217820 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d839f0811a31322c087a859c2b181e2383daa7be
CVE ID: CVE-2023-3356 State: PUBLISHED Published: 2023-08-30T14:21:59.863Z Last Updated: 2024-10-01T18:32:54.412Z Vendors: Unknown Products: Subscribers Text Counter Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Subscribers Text Counter WordPress plugin before 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/93faad5b
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/93faad5b-e1e8-4e49-b19e-b91343d68b51
CVE ID: CVE-2023-3357 State: PUBLISHED Published: 2023-06-28T00:00:00.000Z Last Updated: 2025-03-10T21:07:03.944Z Vendors: n/a Products: Kernel Problem Types: CWE-476 Description: A NULL pointer dereference flaw was found in the Linux kernel AMD Sensor Fusion Hub driver. This flaw allows a local user to crash the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=53ffa6a9f83b2170c60591da1ead8791d5a42e81
CVE ID: CVE-2023-3358 State: PUBLISHED Published: 2023-06-28T00:00:00.000Z Last Updated: 2025-03-10T21:07:50.792Z Vendors: n/a Products: Kernel Problem Types: CWE-476 Description: A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b3d40c3ec3dc4ad78017de6c3a38979f57aaaab8
CVE ID: CVE-2023-3359 State: PUBLISHED Published: 2023-06-28T00:00:00.000Z Last Updated: 2025-03-07T15:15:11.992Z Vendors: n/a Products: Kernel Problem Types: CWE-476 Description: An issue was discovered in the Linux kernel brcm_nvram_parse in drivers/nvmem/brcm_nvram.c. Lacks for the check of the return value of kzalloc() can cause the NULL Pointer Dereference. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0576ade3aaf24b376ea1a4406ae138e2a22b0c0
CVE ID: CVE-2023-3361 State: PUBLISHED Published: 2023-10-04T11:34:57.746Z Last Updated: 2024-09-19T19:18:31.545Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: n/a, Red Hat Products: odh-dashboard, Red Hat OpenShift Data Science (RHODS) Problem Types: CWE-200 Description: A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 credentials from the cluster (ds pipeline server) and saves them in plain text in the generated output instead of an ID for a Kubernetes secret. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https
for a Kubernetes secret. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-3361 - https://bugzilla.redhat.com/show_bug.cgi?id=2216588 - https://github.com/opendatahub-io/odh-dashboard/issues/1415
CVE ID: CVE-2023-3362 State: PUBLISHED Published: 2023-07-13T02:08:46.856Z Last Updated: 2024-11-05T15:10:55.758Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-209 Description: An information disclosure issue in GitLab CE/EE affecting all versions from 16.0 prior to 16.0.6, and version 16.1.0 allows unauthenticated actors to access the import error information if a project was imported from GitHub. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/415131
CVE ID: CVE-2023-3363 State: PUBLISHED Published: 2023-07-13T02:08:35.069Z Last Updated: 2024-11-05T15:14:10.202Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-532 Description: An information disclosure issue in Gitlab CE/EE affecting all versions from 13.6 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1, resulted in the Sidekiq log including webhook tokens when the log format was set to `default`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/409034
CVE ID: CVE-2023-3364 State: PUBLISHED Published: 2023-08-01T23:36:00.662Z Last Updated: 2025-11-20T04:07:18.275Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-1333 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use AutolinkFilter to the preview_markdown endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/
endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/415995 - https://hackerone.com/reports/1959727
CVE ID: CVE-2023-3365 State: PUBLISHED Published: 2023-08-07T14:31:21.483Z Last Updated: 2024-10-10T20:20:54.656Z Vendors: Unknown Products: MultiParcels Shipping For WooCommerce Problem Types: CWE-862 Missing Authorization Description: The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.14 does not have authorisation when deleting shipment, allowing any authenticated users, such as subscriber to delete arbitrary shipment Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/21ce5baa-8085-4053-8d8b-f7d3e2ae70c1
CVE ID: CVE-2023-3366 State: PUBLISHED Published: 2023-08-21T12:29:50.443Z Last Updated: 2024-10-03T20:02:05.325Z Vendors: Unknown Products: MultiParcels Shipping For WooCommerce Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.2 does not have CRSF check when deleting a shipment, allowing attackers to make any logged in user, delete arbitrary shipment via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b2f06223-9352-4227-ae94-32061e2c5611
CVE ID: CVE-2023-3368 State: PUBLISHED Published: 2023-11-28T07:05:26.659Z Last Updated: 2025-06-03T13:58:32.131Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Chamilo Products: Chamilo Problem Types: CWE-78 Description: Command injection in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. This is a bypass of CVE-2023-34960. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.chamilo.org/projects/chamilo-18/wiki/security_issues#Issue-121-2023-07-05-Critical-impac
: References: - https://support.chamilo.org/projects/chamilo-18/wiki/security_issues#Issue-121-2023-07-05-Critical-impact-High-risk-Unauthenticated-Command-Injection-CVE-2023-3368 - https://starlabs.sg/advisories/23/23-3368/ - https://github.com/chamilo/chamilo-lms/commit/37be9ce7243a30259047dd4517c48ff8b21d657a - https://https://github.com/chamilo/chamilo-lms/commit/4c69b294f927db62092e01b70ac9bd6e32d5b48b
CVE ID: CVE-2023-3369 State: PUBLISHED Published: 2023-07-12T04:38:48.300Z Last Updated: 2025-02-05T19:40:12.756Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: d3wp Products: About Me 3000 widget Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The About Me 3000 widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pag
ible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/be6f660f-041a-42f2-ab5b-72aedf75727d?source=cve - https://plugins.trac.wordpress.org/browser/about-me-3000/trunk/aboutme3000.php
CVE ID: CVE-2023-3370 State: REJECTED Published: N/A Last Updated: 2023-07-02T21:50:51.619260Z Description: No description available.
CVE ID: CVE-2023-3371 State: PUBLISHED Published: 2023-06-27T01:55:28.259Z Last Updated: 2024-12-02T21:39:22.961Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: wpdevteam Products: EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor Problem Types: CWE-321 Use of Hard-coded Cryptographic Key Description: The User Registration plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'lock_content_form_handler' and 'display_password_form' function in versions up to, and including, 3.7.3. This makes it possible for unauthenticated attackers t
_password_form' function in versions up to, and including, 3.7.3. This makes it possible for unauthenticated attackers to decrypt and view the password protected content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c1033b4d-82a0-4484-aebf-f35d6a2a9a13?source=cve - https://plugins.trac.wordpress.org/browser/embedpress/tags/3.7.3/Gutenberg/block-backend/block-embedpress.php#L30 - https://plugins.trac.wordpress.org/browser/embedpress/tags/3.7.3/EmbedPress/Includes/Classes/Helper.php#L231 - https://plugins.trac.wordpress.org/browser/embedpress/tags/3.7.3/EmbedPress/Includes/Classes/Helper.php#
lper.php#L231 - https://plugins.trac.wordpress.org/browser/embedpress/tags/3.7.3/EmbedPress/Includes/Classes/Helper.php#L278 - https://plugins.trac.wordpress.org/changeset/2930523/embedpress#file10 - https://plugins.trac.wordpress.org/changeset/2930523/embedpress#file28