Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-0862 State: PUBLISHED Published: 2023-02-16T09:07:09.930Z Last Updated: 2025-03-18T14:50:42.840Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: NetModule Products: NSRW Problem Types: CWE-22 Description: The NetModule NSRW web administration interface is vulnerable to path traversals, which could lead to arbitrary file uploads and deletion. By uploading malicious files to the web root directory, authenticated users could gain remote command execution with elevated privileges. This issue affects NSRW: from 4.3.0.0 before 4.3.0.119, from 4.4.0.0 before 4.4.0.118, from 4.6.0.0 before 4.6.0.105, from 4.7.0.0 before 4.7.0.103. Additional Analyst N
0.119, from 4.4.0.0 before 4.4.0.118, from 4.6.0.0 before 4.6.0.105, from 4.7.0.0 before 4.7.0.103. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://share.netmodule.com/public/system-software/4.7/4.7.0.103/NRSW-RN-4.7.0.103.pdf - https://onekey.com/blog/security-advisory-netmodule-multiple-vulnerabilities/
CVE ID: CVE-2023-0863 State: PUBLISHED Published: 2023-05-17T07:10:46.122Z Last Updated: 2025-01-22T16:50:53.486Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: Terra AC wallbox (UL40/80A), Terra AC wallbox (UL32A) , Terra AC wallbox (CE) (Terra AC MID), Terra AC wallbox (CE) Terra AC Juno CE, Terra AC wallbox (CE) Terra AC PTB , Terra AC wallbox (CE) Symbiosis, Terra AC wallbox (JP) Problem Types: CWE-287 Description: Improper Authentication vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terra AC MID), ABB Terra AC wallbox (CE) Terra AC Juno CE, ABB Terra AC wallbox (CE) Terra AC PTB,
rra AC wallbox (CE) (Terra AC MID), ABB Terra AC wallbox (CE) Terra AC Juno CE, ABB Terra AC wallbox (CE) Terra AC PTB, ABB Terra AC wallbox (CE) Symbiosis, ABB Terra AC wallbox (JP).This issue affects Terra AC wallbox (UL40/80A): from 1.0;0 through 1.5.5; Terra AC wallbox (UL32A) : from 1.0;0 through 1.6.5; Terra AC wallbox (CE) (Terra AC MID): from 1.0;0 through 1.6.5; Terra AC wallbox (CE) Terra AC Juno CE: from 1.0;0 through 1.6.5; Terra AC wallbox (CE) Terra AC PTB : from 1.0;0 through 1.5.25; Terra AC wallbox (CE) Symbiosis: from 1.0;0 through 1.2.7; Terra AC wallbox (JP): from 1.0;0 through 1.6.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
(JP): from 1.0;0 through 1.6.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108468A1415&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2023-0864 State: PUBLISHED Published: 2023-05-17T07:15:52.371Z Last Updated: 2025-01-22T16:50:21.453Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: ABB Products: Terra AC wallbox (UL40/80A), Terra AC wallbox (UL32A) , Terra AC wallbox (CE) (Terra AC MID), Terra AC wallbox (CE) Terra AC Juno CE, Terra AC wallbox (CE) Terra AC PTB , Terra AC wallbox (CE) Symbiosis, Terra AC wallbox (JP) Problem Types: CWE-319 Description: Cleartext Transmission of Sensitive Information vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terra AC MID), ABB Terra AC wallbox (CE) Terra AC Juno CE, ABB Terra AC wal
wallbox (UL32A), ABB Terra AC wallbox (CE) (Terra AC MID), ABB Terra AC wallbox (CE) Terra AC Juno CE, ABB Terra AC wallbox (CE) Terra AC PTB, ABB Terra AC wallbox (CE) Symbiosis, ABB Terra AC wallbox (JP).This issue affects Terra AC wallbox (UL40/80A): from 1.0;0 through 1.5.5; Terra AC wallbox (UL32A) : from 1.0;0 through 1.6.5; Terra AC wallbox (CE) (Terra AC MID): from 1.0;0 through 1.6.5; Terra AC wallbox (CE) Terra AC Juno CE: from 1.0;0 through 1.6.5; Terra AC wallbox (CE) Terra AC PTB : from 1.0;0 through 1.5.25; Terra AC wallbox (CE) Symbiosis: from 1.0;0 through 1.2.7; Terra AC wallbox (JP): from 1.0;0 through 1.6.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vu
1.2.7; Terra AC wallbox (JP): from 1.0;0 through 1.6.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108468A1415&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2023-0865 State: PUBLISHED Published: 2023-03-20T15:52:15.223Z Last Updated: 2025-02-26T14:33:12.565Z Vendors: Unknown Products: WooCommerce Multiple Customer Addresses & Shipping Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The WooCommerce Multiple Customer Addresses & Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to add/update/duplicate/delete as well as retrieve addresses of other users. Additional Analyst Notes: - CVE Program Container: - CISA
uplicate/delete as well as retrieve addresses of other users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e39c0171-ed4a-4143-9a31-c407e3555eec
CVE ID: CVE-2023-0866 State: PUBLISHED Published: 2023-02-16T00:00:00.000Z Last Updated: 2025-03-18T15:32:00.545Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: gpac Products: gpac/gpac Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3.0-DEV. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/7d3c5792-d20b-4cb6-9c6d-bb14f3430d7f - https://github.com/gpac/gpac/commit/b964fe4226f1424cf676d5822ef898b6b01f5937 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2023-0867 State: PUBLISHED Published: 2023-02-23T14:49:30.832Z Last Updated: 2024-08-02T05:24:34.746Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: The OpenNMS Group Products: Meridian, Horizon Problem Types: CWE-79, CWE-20 Description: Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks a
izon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenNMS/opennms/pull/5765 - https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13
CVE ID: CVE-2023-0868 State: PUBLISHED Published: 2023-02-23T14:46:03.437Z Last Updated: 2024-08-02T05:24:34.709Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: The OpenNMS Group Products: Meridian, Horizon Problem Types: CWE-20, CWE-79 Description: Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Inte
intended for installation within an organization's private networks and should not be directly accessible from the Internet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenNMS/opennms/pull/5740 - https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13
CVE ID: CVE-2023-0869 State: PUBLISHED Published: 2023-02-23T14:43:40.950Z Last Updated: 2024-08-02T05:24:34.701Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: The OpenNMS Group , The OpenNMS Group Products: Meridian, Horizon Problem Types: CWE-20, CWE-79 Description: Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be
instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenNMS/opennms/pull/5734 - https://docs.opennms.com/meridian/2023/releasenotes/changelog.html#releasenotes-changelog-Meridian-2023.1.0
CVE ID: CVE-2023-0870 State: PUBLISHED Published: 2023-03-22T18:16:42.537Z Last Updated: 2025-02-25T18:40:53.228Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: The OpenNMS Group , The OpenNMS Group Products: Meridian, Horizon Problem Types: CWE-352 Description: A form can be manipulated with cross-site request forgery in multiple versions of OpenNMS Meridian and Horizon. This can potentially allow an attacker to gain access to confidential information and compromise integrity. The solution is to upgrade to Meridian 2023.1.1 or Horizon 31.0.6 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organ
6 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenNMS/opennms/pull/5835/files - https://docs.opennms.com/meridian/2023/releasenotes/changelog.html#releasenotes-changelog-Meridian-2023.1.1
CVE ID: CVE-2023-0871 State: PUBLISHED Published: 2023-08-11T16:13:50.714Z Last Updated: 2024-10-01T19:13:29.380Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L) Vendors: The OpenNMS Group Products: Horizon, Meridian Problem Types: CWE-611 Description: XXE injection in /rtc/post/ endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to XML external entity (XXE) injection, which can be used for instance to force Horizon to make arbitrary HTTP requests to internal and external services. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon insta
to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter and Moshe Apelbaum for reporting this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenNMS/opennms/pull/6355 - https://docs.opennms.com/horizon/32/releasenotes/changelog.html
CVE ID: CVE-2023-0872 State: PUBLISHED Published: 2023-08-14T17:21:58.203Z Last Updated: 2024-10-03T20:25:29.936Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L) Vendors: The OpenNMS Group Products: Horizon, Meridian Problem Types: CWE-269 Description: The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should
llation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.opennms.com/horizon/32/releasenotes/changelog.html - https://github.com/OpenNMS/opennms/pull/6354
CVE ID: CVE-2023-0873 State: PUBLISHED Published: 2023-06-27T13:17:15.735Z Last Updated: 2024-11-27T19:38:28.851Z Vendors: Unknown Products: Kanban Boards for WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Kanban Boards for WordPress plugin before 2.5.21 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8816d4c1-9e8e-4b6f-a36a-10a98a7ccfcd
CVE ID: CVE-2023-0874 State: PUBLISHED Published: 2023-04-10T13:18:03.854Z Last Updated: 2025-02-11T21:15:48.838Z Vendors: Unknown Products: Klaviyo Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Klaviyo WordPress plugin before 3.0.10 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/495e39db-793d-454b-9ef1-dd91cae2c49b
CVE ID: CVE-2023-0875 State: PUBLISHED Published: 2023-03-20T15:52:21.908Z Last Updated: 2025-02-26T18:53:41.230Z Vendors: Unknown Products: WP Meta SEO Problem Types: CWE-89 SQL Injection Description: The WP Meta SEO WordPress plugin before 4.5.3 does not properly sanitize and escape inputs into SQL queries, leading to a blind SQL Injection vulnerability that can be exploited by subscriber+ users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d44e9a45-cbdf-46b1-8b48-7d934b617534
CVE ID: CVE-2023-0876 State: PUBLISHED Published: 2023-03-20T15:52:08.281Z Last Updated: 2025-02-26T18:48:38.355Z Vendors: Unknown Products: WP Meta SEO Problem Types: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') Description: The WP Meta SEO WordPress plugin before 4.5.3 does not authorize several ajax actions, allowing low-privilege users to make updates to certain data and leading to an arbitrary redirect vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1a8c97f9-98fa-4e29-b7f7-bb9abe0c42ea
CVE ID: CVE-2023-0877 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-18T16:01:15.779Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: froxlor Products: froxlor/froxlor Problem Types: CWE-94 Description: Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/b29cf038-06f1-4fb0-9437-08f2991f92a8 - https://github.com/froxlor/froxlor/commit/aa48ffca2bcaf7ae57be3b8147bb3138abdab984
CVE ID: CVE-2023-0878 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-18T16:00:33.154Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nuxt Products: nuxt/framework Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Generic in GitHub repository nuxt/framework prior to 3.2.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/a892caf7-b8c2-4638-8cee-eb779d51066a - https://github.com/nuxt/framework/commit/7aa35ff958eec0c7d071d3fcd481db57281dbcd9
CVE ID: CVE-2023-0879 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-18T15:59:02.927Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: btcpayserver Products: btcpayserver/btcpayserver Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.12. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/9464e3c6-961d-4e23-8b3d-07cbb31de541 - https://github.com/btcpayserver/btcpayserver/pull/4635/commits/f2f3b245c4d8980d8e54e4708c796df82332c3d7
CVE ID: CVE-2023-0880 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-18T15:57:06.819Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-115 Description: Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/14fc4841-0f5d-4e12-bf9e-1b60d2ac6a6c - https://github.com/thorsten/phpmyfaq/commit/a67dca41576834a1ddfee61b9e799b686b75d4fa
CVE ID: CVE-2023-0881 State: PUBLISHED Published: 2025-03-31T13:28:09.841Z Last Updated: 2025-03-31T14:28:53.864Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ubuntu Products: Ubuntu package linux-bluefield Problem Types: CWE-20 Description: Running DDoS on tcp port 22 will trigger a kernel crash. This issue is introduced by the backport of a commit regarding nft_lookup without the subsequent fixes that were introduced after this commit. The resolution of this CVE introduces those commits to the linux-bluefield package. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugs.launchpad.net/ubuntu/+source/linux-bluefield/+bug/2006397
CVE ID: CVE-2023-0882 State: PUBLISHED Published: 2023-02-17T06:44:51.711Z Last Updated: 2025-03-12T20:11:39.684Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Kron Tech Products: Single Connect Problem Types: CWE-639 Description: Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Kron Tech Single Connect on Windows allows Privilege Abuse. This issue affects Single Connect: 2.16. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.krontech.com/singleconnect-2-16/update-patch-rdp-proxy-idor-vulnerability - https://www.usom.gov.tr/bildirim/tr-23-0092
CVE ID: CVE-2023-0883 State: PUBLISHED Published: 2023-02-17T08:14:47.105Z Last Updated: 2024-08-02T05:24:34.592Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Pizza Ordering System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file /php-opos/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-221350 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE
he public and may be used. VDB-221350 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221350 - https://vuldb.com/?ctiid.221350 - https://github.com/awans2023/CVE
CVE ID: CVE-2023-0884 State: REJECTED Published: N/A Last Updated: 2023-02-23T00:00:00 Description: No description available.
CVE ID: CVE-2023-0885 State: REJECTED Published: N/A Last Updated: 2023-02-23T00:00:00 Description: No description available.
CVE ID: CVE-2023-0886 State: REJECTED Published: N/A Last Updated: 2023-02-23T00:00:00 Description: No description available.
CVE ID: CVE-2023-0887 State: PUBLISHED Published: 2023-02-17T08:20:10.479Z Last Updated: 2025-03-12T20:10:52.014Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: phjounin Products: TFTPD64-SE Problem Types: CWE-428 Description: A vulnerability was found in phjounin TFTPD64-SE 4.64 and classified as critical. This issue affects some unknown processing of the file tftpd64_svc.exe. The manipulation leads to unquoted search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The associated identifier of this vulnerability is VDB-221351. Additional Analyst Notes: - CVE Program Container:
icult. The associated identifier of this vulnerability is VDB-221351. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.221351 - https://vuldb.com/?ctiid.221351
CVE ID: CVE-2023-0888 State: PUBLISHED Published: 2023-03-13T08:14:32.358Z Last Updated: 2025-02-27T18:17:42.996Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: B. Braun Products: Space Battery Pack SP with Wi-Fi Problem Types: CWE-95 Description: An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web serv
WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module. This could be used as a vector to start further attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bbraun.com/productsecurity - https://www.bbraunusa.com/productsecurity
CVE ID: CVE-2023-0889 State: PUBLISHED Published: 2023-04-17T12:17:43.182Z Last Updated: 2025-02-06T15:27:40.905Z Vendors: Unknown Products: Themeflection Numbers Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, such as enabling registration and set the default role to administrator Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
tration and set the default role to administrator Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c39473a7-47fc-4bce-99ad-28d03f41e74e
CVE ID: CVE-2023-0890 State: PUBLISHED Published: 2023-03-20T15:52:16.009Z Last Updated: 2025-02-26T14:32:01.811Z Vendors: Unknown Products: WordPress Shortcodes Plugin — Shortcodes Ultimate Problem Types: CWE-862 Missing Authorization Description: The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the request, allowing any authenticated users such as subscriber to view draft, private or even password protected posts. It is also possible to leak the password of protected posts Additional Analyst Notes: - CVE Program Container: - CISA ADP V
is also possible to leak the password of protected posts Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8a466f15-f112-4527-8b02-4544a8032671