Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-41773 State: PUBLISHED Published: 2023-10-10T17:07:29.720Z Last Updated: 2025-04-14T22:45:57.365Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Wi
08 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-416 Description: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41773
CVE ID: CVE-2023-41774 State: PUBLISHED Published: 2023-10-10T17:07:30.231Z Last Updated: 2025-04-14T22:45:57.829Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Wi
08 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-416 Description: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41774
CVE ID: CVE-2023-41775 State: PUBLISHED Published: 2023-09-08T07:09:03.450Z Last Updated: 2024-09-26T16:05:22.603Z Vendors: L is B Corp. Products: 'direct' Desktop App for macOS Problem Types: Improper access control Description: Improper access control vulnerability in 'direct' Desktop App for macOS ver 2.6.0 and earlier allows a local attacker to bypass access restriction and to use camrea, microphone, etc. of the device where the product is installed without the user's consent. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://status.direct4b.com/2023/08/31/2023083101/ - https://jvn.jp/en/jp/JVN42691027/
CVE ID: CVE-2023-41776 State: PUBLISHED Published: 2024-01-03T01:56:48.148Z Last Updated: 2025-06-16T18:15:21.364Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: ZTE Products: ZXCLOUD iRAI Problem Types: CWE-732 Description: There is a local privilege escalation vulnerability of ZTE's ZXCLOUD iRAI.Attackers with regular user privileges can create a fake process, and to escalate local privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034404
CVE ID: CVE-2023-41779 State: PUBLISHED Published: 2024-01-03T01:40:18.239Z Last Updated: 2024-08-26T19:50:28.646Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: ZTE Products: ZXCLOUD iRAI Problem Types: CWE-119 Description: There is an illegal memory access vulnerability of ZTE's ZXCLOUD iRAI product.When the vulnerability is exploited by an attacker with the common user permission, the physical machine will be crashed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034404
CVE ID: CVE-2023-41780 State: PUBLISHED Published: 2024-01-03T01:52:10.749Z Last Updated: 2024-09-06T17:48:21.970Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ZTE Products: ZXCLOUD iRAI Problem Types: CWE-22 Description: There is an unsafe DLL loading vulnerability in ZTE ZXCLOUD iRAI. Due to the program failed to adequately validate the user's input, an attacker could exploit this vulnerability to escalate local privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034404
CVE ID: CVE-2023-41781 State: PUBLISHED Published: 2024-01-10T06:11:49.198Z Last Updated: 2025-06-03T14:28:12.265Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L) Vendors: ZTE Products: MF258 Problem Types: CWE-20 Description: There is a Cross-site scripting (XSS) vulnerability in ZTE MF258. Due to insufficient input validation of SMS interface parameter, an XSS attack will be triggered. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034684
CVE ID: CVE-2023-41782 State: PUBLISHED Published: 2024-01-05T01:41:36.564Z Last Updated: 2024-09-17T13:00:29.013Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L) Vendors: ZTE Products: ZXCLOUD iRAI Problem Types: CWE-20 Description: There is a DLL hijacking vulnerability in ZTE ZXCLOUD iRAI, an attacker could place a fake DLL file in a specific directory and successfully exploit this vulnerability to execute malicious code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032984
CVE ID: CVE-2023-41783 State: PUBLISHED Published: 2024-01-03T02:02:51.482Z Last Updated: 2025-04-17T18:26:25.592Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: ZTE Products: ZXCLOUD iRAI Problem Types: CWE-94 Description: There is a command injection vulnerability of ZTE's ZXCLOUD iRAI. Due to the program failed to adequately validate the user's input, an attacker could exploit this vulnerability to escalate local privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034404
CVE ID: CVE-2023-41784 State: PUBLISHED Published: 2024-01-04T08:05:11.915Z Last Updated: 2025-06-03T14:42:48.332Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L) Vendors: ZTE Products: Red Magic 8 Pro Problem Types: CWE-269 Description: Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034444
CVE ID: CVE-2023-41786 State: PUBLISHED Published: 2023-11-23T14:27:33.933Z Last Updated: 2024-10-15T18:31:01.529Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pandora FMS on all allows File Discovery. This vulnerability allows users with low privileges to download database backups. This issue affects Pandora FMS: from 700 through 772. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2023-41787 State: PUBLISHED Published: 2023-11-23T14:31:41.618Z Last Updated: 2024-08-02T19:09:48.262Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L) Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-427 Description: Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows access to files with sensitive information. This issue affects Pandora FMS: from 700 through 772. Additional Analyst Notes: - CVE Program Container: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2023-41788 State: PUBLISHED Published: 2023-11-23T14:33:44.933Z Last Updated: 2024-08-02T19:09:48.378Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulnerability allows attackers to execute code via PHP file uploads. This issue affects Pandora FMS: from 700 through 773. Additional Analyst Notes: - CVE Program Container: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2023-41789 State: PUBLISHED Published: 2023-11-23T14:36:55.047Z Last Updated: 2024-08-02T19:09:48.278Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allows an attacker to perform cookie hijacking and log in as that user without the need for credentials. This issue affects Pandora FMS: from 700 through 773. Additional Analyst Notes: - CVE Program Container: References: - https://pandorafms.com/en/security/co
700 through 773. Additional Analyst Notes: - CVE Program Container: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2023-41790 State: PUBLISHED Published: 2023-11-23T14:38:45.504Z Last Updated: 2024-08-02T19:09:48.367Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-427 Description: Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows to access the server configuration file and to compromise the database. This issue affects Pandora FMS: from 700 through 773. Additional Analyst Notes: - CVE Program Container: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2023-41791 State: PUBLISHED Published: 2023-11-23T14:41:46.802Z Last Updated: 2025-06-03T14:10:44.953Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:H) Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed users with low privileges to introduce Javascript executables via a translation string that could affect the integrity of some configuration files. This issue affects Pandora FMS: from 700 through 773. Additional Analyst Notes: - CVE Program Container:
uration files. This issue affects Pandora FMS: from 700 through 773. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2023-41792 State: PUBLISHED Published: 2023-11-23T14:45:33.842Z Last Updated: 2024-08-02T19:09:48.346Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be executed in the SNMP Trap Editor. This issue affects Pandora FMS: from 700 through 773. Additional Analyst Notes: - CVE Program Container: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2023-41793 State: PUBLISHED Published: 2024-03-19T16:34:48.358Z Last Updated: 2024-08-02T19:22:18.510Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-35 Description: : Path Traversal vulnerability in Pandora FMS on all allows Path Traversal. This vulnerability allowed changing directories and creating files and downloading them outside the allowed directories. This issue affects Pandora FMS: from 700 through <776. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2023-41796 State: PUBLISHED Published: 2023-12-20T13:42:21.899Z Last Updated: 2024-09-12T18:56:12.423Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: WP Sunshine Products: Sunshine Photo Cart: Free Client Galleries for Photographers Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in WP Sunshine Sunshine Photo Cart: Free Client Galleries for Photographers.This issue affects Sunshine Photo Cart: Free Client Galleries for Photographers: from n/a before 3.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/sunsh
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/sunshine-photo-cart/wordpress-sunshine-photo-cart-plugin-2-9-25-order-manipulation-vulnerability?_s_id=cve
CVE ID: CVE-2023-41797 State: PUBLISHED Published: 2023-10-02T08:17:03.893Z Last Updated: 2024-09-20T15:21:37.059Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Gold Plugins Products: Locations Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gold Plugins Locations plugin <= 4.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/locations/wordpress-locations-plugin-4-0-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-41798 State: PUBLISHED Published: 2023-11-07T17:19:25.795Z Last Updated: 2025-02-19T21:19:15.250Z Vendors: wpWax Products: Directorist – WordPress Business Directory Plugin with Classified Ads Listings Problem Types: CWE-1236 Description: Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listing.This issue affects Directorist – WordPress Business Directory Plugin with Classified Ads Listings: from n/a through 7.7.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/directorist/wordpress-dire
ntainer: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/directorist/wordpress-directorist-plugin-7-7-0-csv-injection?_s_id=cve
CVE ID: CVE-2023-41800 State: PUBLISHED Published: 2023-10-02T08:24:20.434Z Last Updated: 2024-09-20T15:22:05.610Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: UniConsent Products: UniConsent CMP for GDPR CPRA GPP TCF Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in UniConsent UniConsent CMP for GDPR CPRA GPP TCF plugin <= 1.4.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/uniconsent-cmp/wordpress-uniconsent-cookie-consent-cmp-for-gdpr-ccpa-plugin-1-4-2-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-41801 State: PUBLISHED Published: 2023-10-06T14:48:03.723Z Last Updated: 2024-09-19T14:57:51.367Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: AWP Classifieds Team Products: Ad Directory & Listings by AWP Classifieds Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in AWP Classifieds Team Ad Directory & Listings by AWP Classifieds plugin <= 4.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/another-wordpress-classifieds-plugin/wordpress-classifieds-plugin-ad-directory-listings-plugin-4-3-cross-site-request-
y/another-wordpress-classifieds-plugin/wordpress-classifieds-plugin-ad-directory-listings-plugin-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-41802 State: PUBLISHED Published: 2024-12-13T14:24:17.069Z Last Updated: 2024-12-13T21:17:57.260Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Team Heateor Products: Super Socializer Problem Types: CWE-862 Description: Missing Authorization vulnerability in Team Heateor Super Socializer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Socializer: from n/a through 7.13.54. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/super-socializer/vulnerability/wordpress-super-socializer-plugin-7-13-54-broken-access-control-vulnerability?
ess/plugin/super-socializer/vulnerability/wordpress-super-socializer-plugin-7-13-54-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-41803 State: PUBLISHED Published: 2024-12-13T14:24:18.104Z Last Updated: 2024-12-13T19:10:18.497Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: BitPay Products: BitPay Checkout for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in BitPay BitPay Checkout for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BitPay Checkout for WooCommerce: from n/a through 4.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bitpay-checkout-for-woocommerce/vulnerability/wordpress-bitpay-checkout-for-wo
/patchstack.com/database/wordpress/plugin/bitpay-checkout-for-woocommerce/vulnerability/wordpress-bitpay-checkout-for-woocommerce-plugin-4-1-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-41804 State: PUBLISHED Published: 2023-12-07T10:58:43.110Z Last Updated: 2024-08-02T19:09:48.911Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: Brainstorm Force Products: Starter Templates — Elementor, WordPress & Beaver Builder Templates Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates.This issue affects Starter Templates — Elementor, WordPress & Beaver Builder Templates: from n/a through 3.2.4. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/astra-sites/wo
ional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/astra-sites/wordpress-starter-templates-plugin-3-2-4-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-41805 State: PUBLISHED Published: 2024-06-19T12:25:19.021Z Last Updated: 2024-08-02T19:09:48.298Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Brainstorm Force Products: Premium Starter Templates, Starter Templates Problem Types: CWE-862 Description: Missing Authorization vulnerability in Brainstorm Force Premium Starter Templates, Brainstorm Force Starter Templates astra-sites.This issue affects Premium Starter Templates: from n/a through 3.2.5; Starter Templates: from n/a through 3.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/astra-pro-sites/
ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/astra-pro-sites/wordpress-premium-starter-templates-plugin-3-2-5-broken-access-control-vulnerability?_s_id=cve - https://patchstack.com/database/vulnerability/astra-sites/wordpress-starter-templates-plugin-3-2-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-41806 State: PUBLISHED Published: 2023-11-23T14:47:54.186Z Last Updated: 2024-08-02T19:09:48.955Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:H) Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability causes that a bad privilege assignment could cause a DOS attack that affects the availability of the Pandora FMS server. This issue affects Pandora FMS: from 700 through 773. Additional Analyst Notes: - CVE Program Container: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2023-41807 State: PUBLISHED Published: 2023-11-23T14:49:41.335Z Last Updated: 2024-10-15T18:30:51.821Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows a user to escalate permissions on the system shell. This issue affects Pandora FMS: from 700 through 773. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2023-41808 State: PUBLISHED Published: 2023-11-23T14:51:17.223Z Last Updated: 2024-12-02T19:36:21.120Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows an unauthorised user to escalate and read sensitive files as if they were root. This issue affects Pandora FMS: from 700 through 773. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2023-41810 State: PUBLISHED Published: 2023-11-23T14:52:59.306Z Last Updated: 2024-08-02T19:09:48.815Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be executed in some Widgets' text box. This issue affects Pandora FMS: from 700 through 773. Additional Analyst Notes: - CVE Program Container: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2023-41811 State: PUBLISHED Published: 2023-11-23T14:54:41.510Z Last Updated: 2024-08-02T19:09:48.647Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L) Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be executed in the news section of the web console. This issue affects Pandora FMS: from 700 through 773. Additional Analyst Notes: - CVE Program Container: References: - https://pandorafms.com/en/security/common-vulnerabilities-and