Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-3372 State: PUBLISHED Published: 2024-01-16T15:55:36.145Z Last Updated: 2025-06-20T17:01:54.093Z Vendors: Unknown Products: Lana Shortcodes Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Lana Shortcodes WordPress plugin before 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3396b734-9a10-4070-802d-f9d01cc6eb74/
CVE ID: CVE-2023-3373 State: PUBLISHED Published: 2023-08-03T23:44:40.341Z Last Updated: 2025-02-27T21:11:06.051Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L) Vendors: Mitsubishi Electric Corporation Products: GOT2000 Series GT21 model, GOT SIMPLE Series GS21 model Problem Types: CWE-342 Description: Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SIMPLE Series GS21 model versions 01.49.000 and prior allows a remote unauthenticated attacker to hijack data connections (session hijacking) or prevent legitimate users from establishing data connections (to caus
r to hijack data connections (session hijacking) or prevent legitimate users from establishing data connections (to cause DoS condition) by guessing the listening port of the data connection on FTP server and connecting to it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-006_en.pdf - https://jvn.jp/vu/JVNVU92167394/index.html - https://www.cisa.gov/news-events/ics-advisories/icsa-23-215-01
CVE ID: CVE-2023-3374 State: PUBLISHED Published: 2023-09-05T16:29:04.728Z Last Updated: 2024-09-27T13:31:24.021Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Unisign Products: Bookreen Problem Types: CWE-184 Description: Incomplete List of Disallowed Inputs vulnerability in Unisign Bookreen allows Privilege Escalation.This issue affects Bookreen: before 3.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0489
CVE ID: CVE-2023-3375 State: PUBLISHED Published: 2023-09-05T16:35:31.190Z Last Updated: 2024-09-27T13:30:55.520Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Unisign Products: Bookreen Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Unisign Bookreen allows OS Command Injection.This issue affects Bookreen: before 3.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0489
CVE ID: CVE-2023-3376 State: PUBLISHED Published: 2023-07-17T13:11:40.174Z Last Updated: 2024-10-30T14:51:34.162Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Digital Strategy Products: Zekiweb Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digital Strategy Zekiweb allows SQL Injection.This issue affects Zekiweb: before 2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0408
CVE ID: CVE-2023-3377 State: PUBLISHED Published: 2023-11-23T08:30:25.283Z Last Updated: 2025-06-03T14:11:37.028Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Veribilim Software Computer Products: Veribase Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veribilim Software Computer Veribase allows SQL Injection.This issue affects Veribase: through 20231123. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://https://www.usom.gov.tr/
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://https://www.usom.gov.tr/bildirim/tr-23-0655
CVE ID: CVE-2023-3378 State: REJECTED Published: N/A Last Updated: 2023-09-15T05:25:46.808Z Description: No description available.
CVE ID: CVE-2023-3379 State: PUBLISHED Published: 2023-11-20T07:23:41.887Z Last Updated: 2024-10-02T05:34:25.860Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: WAGO, Wago Products: Compact Controller 100 (751-9301), PFC100 (750-810x/xxx-xxx), PFC200 (750-820x/xxx-xxx), PFC200 (750-821x/xxx-xxx), Touch Panel 600 Advanced Line (762-5xxx), Touch Panel 600 Marine Line (762-6xxx), Touch Panel 600 Standard Line (762-4xxx), Edge Controller (752-8303/8000-002) Problem Types: CWE-863 Description: Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus t
a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2023-015/
CVE ID: CVE-2023-3380 State: PUBLISHED Published: 2023-06-23T09:31:03.911Z Last Updated: 2024-08-02T06:55:03.103Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: Wavlink Products: WN579X3 Problem Types: CWE-74 Description: A vulnerability classified as critical has been found in Wavlink WN579X3 up to 20230615. Affected is an unknown function of the file /cgi-bin/adm.cgi of the component Ping Test. The manipulation of the argument pingIp leads to injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-232236. NOTE: The vendor was contacted early about this disclosure but did
. The identifier of this vulnerability is VDB-232236. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.232236 - https://vuldb.com/?ctiid.232236 - https://github.com/sleepyvv/vul_report/blob/main/WAVLINK/WAVLINK-WN579X3-RCE.md
CVE ID: CVE-2023-3381 State: PUBLISHED Published: 2023-06-23T09:31:04.940Z Last Updated: 2024-11-21T16:04:32.215Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Online School Fees System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in SourceCodester Online School Fees System 1.0. Affected by this vulnerability is an unknown functionality of the file /paysystem/datatable.php of the component GET Parameter Handler. The manipulation of the argument doj leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-232237 was assigne
e launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-232237 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.232237 - https://vuldb.com/?ctiid.232237 - https://github.com/M9KJ-TEAM/CVEReport/blob/main/XSS2.md
CVE ID: CVE-2023-3382 State: PUBLISHED Published: 2023-06-23T10:00:04.761Z Last Updated: 2024-11-07T19:49:42.175Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Game Result Matrix System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Game Result Matrix System 1.0. Affected by this issue is some unknown functionality of the file /dipam/save-delegates.php of the component GET Parameter Handler. The manipulation of the argument del_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-232238 is the id
The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-232238 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.232238 - https://vuldb.com/?ctiid.232238 - https://github.com/M9KJ-TEAM/CVEReport/blob/main/XSS3.md
CVE ID: CVE-2023-3383 State: PUBLISHED Published: 2023-06-23T10:00:05.798Z Last Updated: 2024-08-02T06:55:03.359Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Game Result Matrix System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Game Result Matrix System 1.0. This affects an unknown part of the file /dipam/athlete-profile.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is
otely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-232239. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.232239 - https://vuldb.com/?ctiid.232239 - https://github.com/M9KJ-TEAM/CVEReport/blob/main/SQL2.md
CVE ID: CVE-2023-3384 State: PUBLISHED Published: 2023-07-24T15:19:20.552Z Last Updated: 2025-11-07T00:08:14.932Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat Quay 3 Problem Types: CWE-79 Description: A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex (validation.py), the same validation is not performed when the label comes from an image. This flaw allows an attacker to publish a malicious image to a public registry containing a script that can be executed via Cross-site scripting (XSS). Additional Analyst Notes: - CISA ADP Vulnrich
y containing a script that can be executed via Cross-site scripting (XSS). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-3384 - https://bugzilla.redhat.com/show_bug.cgi?id=2216924
CVE ID: CVE-2023-3385 State: PUBLISHED Published: 2023-08-01T23:35:55.776Z Last Updated: 2025-11-20T04:07:23.274Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-22 Description: An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file. This was due to a bug in `tar`, fixed in [`tar-1.35`](https://lists.gnu.org/archive/html/info-gnu/2023-07/
crafted file. This was due to a bug in `tar`, fixed in [`tar-1.35`](https://lists.gnu.org/archive/html/info-gnu/2023-07/msg00005.html). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/416161 - https://hackerone.com/reports/2032730
CVE ID: CVE-2023-3386 State: PUBLISHED Published: 2023-08-08T15:11:32.519Z Last Updated: 2024-10-11T16:55:56.230Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: a2 Products: Camera Trap Tracking System Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 Camera Trap Tracking System allows SQL Injection.This issue affects Camera Trap Tracking System: before 3.1905. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0444
CVE ID: CVE-2023-3387 State: PUBLISHED Published: 2023-06-24T02:00:19.324Z Last Updated: 2025-02-05T19:42:27.722Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: lanacodes Products: Lana Text to Image Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Lana Text to Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lana_text_to_image' and 'lana_text_to_img' shortcode in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributo
tion and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8acb7893-85b2-404a-b3fe-b4c1a835b3eb?source=cve - https://plugins.trac.wordpress.org/changeset/2929913/lana-text-to-image - https://plugins.trac.wordpress.org/browser/lana-text-to-image/tags/1.0.0/lana-text-to-image.php#L97
CVE ID: CVE-2023-3388 State: PUBLISHED Published: 2023-06-24T02:00:18.847Z Last Updated: 2025-02-05T19:42:36.939Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: nikelschubert Products: Beautiful Cookie Consent Banner Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages
ation and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A partial patch was made available in 2.10.1 and the issue was fully patched in 2.10.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/542a4079-b1a2-49bc-9ddd-ba7978c9992e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2857982%40beautiful-and-responsive-cookie-consent&new=2857982%40beautiful-and-responsive-cookie-consent&sfp_email=&sfph_mail= - https://www.wordfence.c
ive-cookie-consent&new=2857982%40beautiful-and-responsive-cookie-consent&sfp_email=&sfph_mail= - https://www.wordfence.com/blog/2023/05/wordfence-firewall-blocks-bizarre-large-scale-xss-campaign/
CVE ID: CVE-2023-3389 State: PUBLISHED Published: 2023-06-28T19:33:55.097Z Last Updated: 2025-03-05T18:55:17.919Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Kernel Problem Types: CWE-416 Description: A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59 (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and 0e388fce7aec40992eadee654193cad345d62663 for 5.15 stable). Additional Analyst Notes: - CVE Pr
24ac04 for 5.10 stable and 0e388fce7aec40992eadee654193cad345d62663 for 5.15 stable). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.15.y&id=0e388fce7aec40992eadee654193cad345d62663 - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=4716c73b188566865bdd79c3a6709696a224ac04 - https://kernel.dance/0e388fce7aec40992eadee654193cad345d62663 - https://kernel.dance/4716c73b188566865bdd79c3a6709696a224ac04 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ef7dfac51d8ed961b742218f526bd589f3900a59 - https:/
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ef7dfac51d8ed961b742218f526bd589f3900a59 - https://kernel.dance/ef7dfac51d8ed961b742218f526bd589f3900a59 - https://security.netapp.com/advisory/ntap-20230731-0001/ - https://www.debian.org/security/2023/dsa-5480 - http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html - https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
CVE ID: CVE-2023-3390 State: PUBLISHED Published: 2023-06-28T20:02:07.389Z Last Updated: 2025-02-13T16:55:10.098Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Linux Kernel Problem Types: CWE-416 Description: A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97. Ad
s to cause a privilege escalation issue. We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1240eb93f0616b21c675416516ff3d74798fdc97 - https://kernel.dance/1240eb93f0616b21c675416516ff3d74798fdc97 - https://www.debian.org/security/2023/dsa-5448 - https://www.debian.org/security/2023/dsa-5461 - https://lists.debian.org/debian-lts-announce/2023/08/msg00001.html - https://security.netapp.com/advisory/ntap-20230818-0004/ - http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html - https://lists.
8-0004/ - http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html - https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
CVE ID: CVE-2023-3391 State: PUBLISHED Published: 2023-06-23T16:00:03.694Z Last Updated: 2024-11-21T16:01:29.673Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Human Resource Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Human Resource Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file detailview.php. The manipulation of the argument employeeid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-232288. Additional Analyst Notes: -
isclosed to the public and may be used. The identifier of this vulnerability is VDB-232288. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.232288 - https://vuldb.com/?ctiid.232288 - https://github.com/mohdkey/Human-Resource-Management-System/blob/main/Human%20Resource%20Management%20System%20detailview.php%20has%20Sqlinjection.pdf
CVE ID: CVE-2023-3392 State: PUBLISHED Published: 2023-10-16T08:32:44.792Z Last Updated: 2024-09-16T15:43:45.758Z Vendors: Unknown Products: Read More & Accordion Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Read More & Accordion WordPress plugin before 3.2.7 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1e733ccf-8026-4831-9863-e505c2aecba6
CVE ID: CVE-2023-3393 State: PUBLISHED Published: 2023-06-23T18:11:49.879Z Last Updated: 2024-11-07T20:37:47.738Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: fossbilling Products: fossbilling/fossbilling Problem Types: CWE-94 Description: Code Injection in GitHub repository fossbilling/fossbilling prior to 0.5.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/e4df9280-900a-407a-a07e-e7fef3345914 - https://github.com/fossbilling/fossbilling/commit/47343fb58db5c17c14bc6941dacbeb9c96957351
CVE ID: CVE-2023-3394 State: PUBLISHED Published: 2023-06-23T18:12:04.642Z Last Updated: 2024-11-07T20:33:55.596Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: fossbilling Products: fossbilling/fossbilling Problem Types: CWE-384 Description: Session Fixation in GitHub repository fossbilling/fossbilling prior to 0.5.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/84bf3e85-cdeb-4b8d-9ea4-74156dbda83f - https://github.com/fossbilling/fossbilling/commit/b9c35a174750f1463aea86168524efce6cd48ef7
CVE ID: CVE-2023-3395 State: PUBLISHED Published: 2023-07-03T20:04:17.653Z Last Updated: 2024-10-24T19:53:58.951Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Ovarro Products: TBox MS-CPU32, ​TBox MS-CPU32-S2, TBox LT2, TBox TG2, TBox RM2 Problem Types: CWE-256 Description: ​All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file to load the document into memory, including sensitive information associated with document, such as password. The attacker could then obtain the plaintext password by using a memory viewer. Additional Analyst Notes: - CVE Program C
he attacker could then obtain the plaintext password by using a memory viewer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-03
CVE ID: CVE-2023-3396 State: PUBLISHED Published: 2023-06-25T18:31:03.220Z Last Updated: 2024-11-07T17:20:41.354Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Retro Cellphone Online Store Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Retro Cellphone Online Store 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/index.php. The manipulation of the argument username/password leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-232351. Addition
as been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-232351. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.232351 - https://vuldb.com/?ctiid.232351 - https://github.com/bao22033/bao/blob/main/Retro%20Cellphone%20Online%20Store%20-%20vlun%201.pdf
CVE ID: CVE-2023-3397 State: PUBLISHED Published: 2023-11-01T19:05:39.080Z Last Updated: 2025-11-20T17:26:26.211Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-416 Description: A race condition occurred between the functions lmLogClose and txEnd in JFS, in the Linux Kernel, executed in different threads. This flaw allows a local attacker with normal user privileges to crash the system or leak internal kernel information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https