Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-34163 State: PUBLISHED Published: 2023-06-19T00:00:00 Last Updated: 2024-12-11T18:51:34.888Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Improper Access Control Description: Permission control vulnerability in the window management module.Successful exploitation of this vulnerability may cause features to perform abnormally. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE ID: CVE-2023-34164 State: PUBLISHED Published: 2023-07-06T12:35:19.114Z Last Updated: 2024-11-19T17:00:51.220Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-476 Description: Vulnerability of incomplete input parameter verification in the communication framework module. Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2023/7/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202307-0000001587168858
CVE ID: CVE-2023-34165 State: PUBLISHED Published: 2023-06-16T06:54:59.538Z Last Updated: 2024-12-17T16:53:22.517Z Vendors: Huawei Products: HarmonyOS Problem Types: Improper Validation of Integrity Check Value Description: Unauthorized access vulnerability in the Save for later feature provided by AI Touch.Successful exploitation of this vulnerability may cause third-party apps to forge a URI for unauthorized access with zero permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202306-0000001560777672
CVE ID: CVE-2023-34166 State: PUBLISHED Published: 2023-06-19T00:00:00 Last Updated: 2024-12-11T18:53:03.668Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Improper Input Validation Description: Vulnerability of system restart triggered by abnormal callbacks passed to APIs.Successful exploitation of this vulnerability may cause the system to restart. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE ID: CVE-2023-34167 State: PUBLISHED Published: 2023-06-19T00:00:00 Last Updated: 2024-12-11T18:53:53.803Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Vulnerability of spoofing trustlists of Huawei desktop Description: Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE ID: CVE-2023-34168 State: PUBLISHED Published: 2023-12-18T22:36:12.774Z Last Updated: 2024-09-24T14:28:06.347Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Alex Raven Products: WP Report Post Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alex Raven WP Report Post allows SQL Injection.This issue affects WP Report Post: from n/a through 2.1.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-report-post/wordpress-wp-report-post-plugin-2-1-2-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-34169 State: PUBLISHED Published: 2023-11-09T19:27:46.935Z Last Updated: 2024-09-04T13:30:39.066Z Vendors: SAKURA Internet Inc. Products: TS Webfonts for さくらのレンタルサーバ Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in SAKURA Internet Inc. TS Webfonts for さくらのレンタルサーバ plugin <= 3.1.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ts-webfonts-for-sakura/wordpress-ts-webfonts-for-plugin-3-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-34170 State: PUBLISHED Published: 2023-06-22T14:26:25.793Z Last Updated: 2025-02-19T21:28:43.117Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: WP Overnight Products: Quick/Bulk Order Form for WooCommerce Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Overnight Quick/Bulk Order Form for WooCommerce plugin <= 3.5.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woocommerce-bulk-order-form/wordpress-quick-bulk-order-form-for-woocommerce-plugin-3-5-7-cross-site-scripting-xss-vulnerability?
rce-bulk-order-form/wordpress-quick-bulk-order-form-for-woocommerce-plugin-3-5-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34171 State: PUBLISHED Published: 2023-11-09T19:22:26.206Z Last Updated: 2024-09-04T13:53:44.300Z Vendors: Alex Raven Products: WP Report Post Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Alex Raven WP Report Post plugin <= 2.1.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-report-post/wordpress-wp-report-post-plugin-2-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-34172 State: PUBLISHED Published: 2023-08-30T14:12:46.542Z Last Updated: 2024-08-02T16:01:54.217Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Miled Products: WordPress Social Login Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Miled WordPress Social Login plugin <= 3.0.4 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wordpress-social-login/wordpress-wordpress-social-login-plugin-3-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34173 State: PUBLISHED Published: 2023-08-30T14:04:10.829Z Last Updated: 2024-09-24T19:20:52.612Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Alexander Semikashev Products: Yandex Metrica Counter Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alexander Semikashev Yandex Metrica Counter plugin <= 1.4.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/counter-yandex-metrica/wordpress-yandex-metrica-counter-plugin-1-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34174 State: PUBLISHED Published: 2023-08-30T13:54:45.609Z Last Updated: 2024-09-24T19:20:59.681Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: BBS e-Theme Products: BBS e-Popup Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in BBS e-Theme BBS e-Popup plugin <= 2.4.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/bbs-e-popup/wordpress-bbs-e-popup-plugin-2-4-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34175 State: PUBLISHED Published: 2023-08-30T13:39:25.858Z Last Updated: 2024-09-24T19:21:09.672Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: GrandSlambert Products: Login Configurator Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GrandSlambert Login Configurator plugin <= 2.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/login-configurator/wordpress-login-configurator-plugin-2-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34176 State: PUBLISHED Published: 2023-08-30T13:33:20.320Z Last Updated: 2024-09-24T19:21:18.003Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Chilexpress Products: Chilexpress woo oficial Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Chilexpress Chilexpress woo oficial plugin <= 1.2.9 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/chilexpress-oficial/wordpress-chilexpress-woo-oficial-plugin-1-2-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34177 State: PUBLISHED Published: 2023-11-09T19:11:12.978Z Last Updated: 2024-09-04T13:23:50.800Z Vendors: Kenth Hagström Products: WP-Cache.com Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Kenth Hagström WP-Cache.Com plugin <= 1.1.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-cachecom/wordpress-wp-cache-com-plugin-1-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-34178 State: PUBLISHED Published: 2023-11-09T19:07:27.288Z Last Updated: 2024-09-03T18:32:25.221Z Vendors: Groundhogg Inc. Products: Groundhogg Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Groundhogg Inc. Groundhogg plugin <= 2.7.11 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/groundhogg/wordpress-groundhogg-plugin-2-7-10-3-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2023-34179 State: PUBLISHED Published: 2023-11-03T16:48:01.889Z Last Updated: 2024-09-05T18:46:00.287Z Vendors: Groundhogg Inc. Products: Groundhogg Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Groundhogg Inc. Groundhogg allows SQL Injection.This issue affects Groundhogg: from n/a through 2.7.11. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/groundhogg/wordpress-groundhogg-plugin-2-7-10-3-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-34180 State: PUBLISHED Published: 2023-08-30T13:43:26.404Z Last Updated: 2024-08-02T16:01:54.206Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: KAPlugins Products: Google Fonts For WordPress Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in KAPlugins Google Fonts For WordPress plugin <= 3.0.0 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/free-google-fonts/wordpress-google-fonts-for-wordpress-plugin-3-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34181 State: PUBLISHED Published: 2023-11-09T19:03:50.071Z Last Updated: 2024-09-03T18:35:00.097Z Vendors: WP-Cirrus Products: WP-Cirrus Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WP-Cirrus plugin <= 0.6.11 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-cirrus/wordpress-wp-cirrus-plugin-0-6-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-34182 State: PUBLISHED Published: 2023-11-09T19:01:04.963Z Last Updated: 2024-09-03T18:37:43.849Z Vendors: Peter Shaw Products: LH Password Changer Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Peter Shaw LH Password Changer plugin <= 1.55 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/lh-password-changer/wordpress-lh-password-changer-plugin-1-55-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-34183 State: PUBLISHED Published: 2023-08-30T13:07:02.118Z Last Updated: 2024-09-24T19:22:30.812Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Valiano Products: Unite Gallery Lite Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Valiano Unite Gallery Lite plugin <= 1.7.61 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/unite-gallery-lite/wordpress-unite-gallery-lite-plugin-1-7-60-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34184 State: PUBLISHED Published: 2023-08-30T13:28:58.159Z Last Updated: 2024-09-24T19:22:23.009Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Bhavik Patel Products: Woocommerce Order address Print Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Bhavik Patel Woocommerce Order address Print plugin <= 3.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woocommerce-order-address-print/wordpress-woocommerce-order-address-print-plugin-3-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34185 State: PUBLISHED Published: 2023-07-11T11:17:41.340Z Last Updated: 2025-02-19T21:28:16.095Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: John Brien Products: WordPress NextGen GalleryView Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in John Brien WordPress NextGen GalleryView plugin <= 0.5.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wordpress-nextgen-galleryview/wordpress-wordpress-nextgen-galleryview-plugin-0-5-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-34186 State: PUBLISHED Published: 2024-05-17T06:46:31.518Z Last Updated: 2024-08-02T16:01:54.230Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Imran Sayed Products: Headless CMS Problem Types: CWE-862 Description: Missing Authorization vulnerability in Imran Sayed Headless CMS.This issue affects Headless CMS: from n/a through 2.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/headless-cms/wordpress-headless-cms-plugin-2-0-3-broken-authentication-vulnerability?_s_id=cve
CVE ID: CVE-2023-34187 State: PUBLISHED Published: 2023-08-30T13:00:49.061Z Last Updated: 2024-09-24T19:22:39.585Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Alan Tien Products: Call Now Icon Animate Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alan Tien Call Now Icon Animate plugin <= 0.1.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/call-now-icon-animate/wordpress-call-now-icon-animate-plugin-0-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-34188 State: PUBLISHED Published: 2023-06-23T00:00:00.000Z Last Updated: 2025-02-28T13:07:27.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cesanta/mongoose/commit/4663090a8fb036146dfe77718cff612b0101cb0f - https://github.com/cesanta/mongoose/pull/2197 - https://github.co
oose/commit/4663090a8fb036146dfe77718cff612b0101cb0f - https://github.com/cesanta/mongoose/pull/2197 - https://github.com/cesanta/mongoose/compare/7.9...7.10 - https://blog.narfindustries.com/blog/narf-discovers-critical-vulnerabilities-in-cesanta-mongoose-http-server
CVE ID: CVE-2023-34189 State: PUBLISHED Published: 2023-07-25T07:08:53.608Z Last Updated: 2025-02-13T16:55:21.374Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-668 Description: Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The attacker could use general users to delete and update the process, which only the admin can operate occurrences. Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8109 to solve it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
long/pull/8109 to solve it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/smxqyx43hxjvzv4w71n2n3rfho9p378s - http://www.openwall.com/lists/oss-security/2023/07/25/2
CVE ID: CVE-2023-34192 State: PUBLISHED Published: 2023-07-06T00:00:00.000Z Last Updated: 2025-10-21T23:05:44.005Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
CVE ID: CVE-2023-34193 State: PUBLISHED Published: 2023-07-06T00:00:00 Last Updated: 2024-11-19T19:04:30.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the ClientUploader function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
CVE ID: CVE-2023-34194 State: PUBLISHED Published: 2023-12-13T00:00:00.000Z Last Updated: 2025-11-04T18:14:41.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: StringEqual in TiXmlDeclaration::Parse in tinyxmlparser.cpp in TinyXML through 2.6.2 has a reachable assertion (and application exit) via a crafted XML document with a '\0' located after whitespace. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/tinyxml/git/ci/master/tree/tinyxmlparser.cpp - https://www.forescout.com/resources/sierra21-vulnerabilities - https://lists.debian.org/debian-lts-announce/2023/12/msg00024.html - https://lists.fedoraproject.org/archives/list/package-ann
//lists.debian.org/debian-lts-announce/2023/12/msg00024.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QCR5PIOBGDIDS6SYRESTMDJSEDFSCOE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOMBSHRIW5Q34SQSXYURYAOYDZD2NQF6/
CVE ID: CVE-2023-34195 State: PUBLISHED Published: 2023-09-18T00:00:00 Last Updated: 2024-09-25T18:44:59.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SystemFirmwareManagementRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The implementation of the GetImage method retrieves the value of a runtime variable named GetImageProgress, and later uses this value as a function pointer. This variable is wiped out by the same module near the end of the function. By setting this UEFI variable from the OS to point into custom code, an attacker could achieve arbitrary code execution in the DXE phase, before several chipset locks are set. Additional
, an attacker could achieve arbitrary code execution in the DXE phase, before several chipset locks are set. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2023052
CVE ID: CVE-2023-34196 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T16:37:58.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue. In configurations using OAuth, disclosure of CA certificates (attributes and public keys) to unauthenticated or less privileged users may occur. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://keyfactor.com - https://support.keyfactor.com/hc/en-us/articles/16671824556827-EJBCA-Security-Advisory-Partial-denial-of-servic
or.com - https://support.keyfactor.com/hc/en-us/articles/16671824556827-EJBCA-Security-Advisory-Partial-denial-of-service-attack-on-certificate-distribution-servlet-ejbca-ra-cert
CVE ID: CVE-2023-34197 State: PUBLISHED Published: 2023-07-07T00:00:00 Last Updated: 2024-11-13T21:03:43.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerability in the Release module that allows unprivileged users to access the Reminders of a release ticket and make modifications. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/service-desk/CVE-2023-34197.html
CVE ID: CVE-2023-34198 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-02T16:01:54.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Stormshield Network Security (SNS) 1.0.0 through 3.7.36 before 3.7.37, 3.8.0 through 3.11.24 before 3.11.25, 4.0.0 through 4.3.18 before 4.3.19, 4.4.0 through 4.6.5 before 4.6.6, and 4.7.0 before 4.7.1, the usage of a Network object created from an inactive DHCP interface in the filtering slot results in the usage of an object of the :any" type, which may have unexpected results for access control. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.stormshield.eu/20
onal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.stormshield.eu/2023-019
CVE ID: CVE-2023-34203 State: PUBLISHED Published: 2023-06-23T00:00:00 Last Updated: 2024-12-02T14:50:19.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a remote user (who has any OEM or OEE role) could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and 12.3.x through 12.6.x before 12.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.progress.com/openedge
CVE ID: CVE-2023-34204 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-10T20:46:24.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: imapsync through 2.229 uses predictable paths under /tmp and /var/tmp in its default mode of operation. Both of these are typically world-writable, and thus (for example) an attacker can modify imapsync's cache and overwrite files belonging to the user who runs it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/imapsync/imapsync/issues/399