Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-3479 State: PUBLISHED Published: 2023-06-30T09:55:14.511Z Last Updated: 2024-11-06T19:56:50.942Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: hestiacp Products: hestiacp/hestiacp Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/6ac5cf87-6350-4645-8930-8f2876427723 - https://github.com/hestiacp/hestiacp/commit/2326aa525a7ba14513af783f29cb5e62a476e67a
CVE ID: CVE-2023-3481 State: PUBLISHED Published: 2023-08-21T10:04:23.880Z Last Updated: 2024-09-27T18:42:14.245Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: Google Chrome Labs Products: Critters Problem Types: CWE-80, CWE-116 Description: Critters versions 0.0.17-0.0.19 have an issue when parsing the HTML, which leads to a potential cross-site scripting (XSS) bug. We recommend upgrading to version 0.0.20 of the extension. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/GoogleChromeLabs/critters/security/advisories/GHSA-cx3j-qqxj-9597
CVE ID: CVE-2023-3482 State: PUBLISHED Published: 2023-07-05T09:01:13.962Z Last Updated: 2025-02-13T16:55:39.002Z Vendors: Mozilla Products: Firefox Problem Types: Block all cookies bypass for localstorage Description: When Firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by using an iframe with a source of 'about:blank'. This could have led to malicious websites storing tracking data without permission. This vulnerability affects Firefox < 115. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1839464 - https://www.mozilla.org/security/advisories/mfs
nt: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1839464 - https://www.mozilla.org/security/advisories/mfsa2023-22/ - https://security.gentoo.org/glsa/202401-10
CVE ID: CVE-2023-3483 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:57.964Z Description: No description available.
CVE ID: CVE-2023-3484 State: PUBLISHED Published: 2023-07-21T13:01:03.770Z Last Updated: 2025-11-20T04:07:48.264Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in GitLab EE affecting all versions starting from 12.8 before 15.11.11, all versions starting from 16.0 before 16.0.7, all versions starting from 16.1 before 16.1.2. An attacker could change the name or path of a public top-level group in certain situations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/416773 - https://hackero
nrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/416773 - https://hackerone.com/reports/2035687
CVE ID: CVE-2023-3485 State: PUBLISHED Published: 2023-06-30T17:37:57.772Z Last Updated: 2024-10-28T13:05:11.946Z Severity: LOW (CVSS 3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L) Vendors: Temporal Technologies Inc. Products: Temporal Server Problem Types: CWE-863, CWE-1188 Description: Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires the namespace UUID and information from the workflow history for the target namespace. Under these conditions, it
uires the namespace UUID and information from the workflow history for the target namespace. Under these conditions, it is possible to interfere with pending tasks in other namespaces, such as marking a task failed or completed. If a task is targeted for completion by the attacker, the targeted namespace must also be using the same data converter configuration as the initial, valid, namespace for the task completion payload to be decoded by workers in the target namespace. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/temporalio/temporal/releases/tag/v1.20.0
CVE ID: CVE-2023-3486 State: PUBLISHED Published: 2023-07-25T12:50:42.477Z Last Updated: 2024-10-23T19:02:59.209Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: PaperCut Products: PaperCut NG Problem Types: CWE-434 Description: An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated attacker to upload arbitrary files to the PaperCut NG host’s file storage. This could exhaust system resources and prevent the service from operating as expected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-23 - https://www.p
Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-23 - https://www.papercut.com/kb/Main/SecurityBulletinJuly2023/
CVE ID: CVE-2023-3487 State: PUBLISHED Published: 2023-10-20T14:12:44.805Z Last Updated: 2024-09-25T15:47:54.946Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: silabs.com Products: GSDK Problem Types: CWE-125, CWE-787 Description: An integer overflow in Silicon Labs Gecko Bootloader version 4.3.1 and earlier allows unbounded memory access when reading from or writing to storage slots. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/SiliconLabs/gecko_sdk/releases - https://community.silabs.com/s/contentdocument/0698Y00000ZmXqLQAV
CVE ID: CVE-2023-3488 State: PUBLISHED Published: 2023-07-28T15:36:29.124Z Last Updated: 2024-10-11T14:07:41.204Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: silabs.com Products: Gecko Bootloader Problem Types: CWE-908 Description: Uninitialized buffer in GBL parser in Silicon Labs GSDK v4.3.0 and earlier allows attacker to leak data from Secure stack via malformed GBL file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/SiliconLabs/gecko_sdk/releases - https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000Wi3HwQAJ?operationContext=S1
CVE ID: CVE-2023-3489 State: PUBLISHED Published: 2023-08-30T23:56:07.070Z Last Updated: 2025-02-13T16:55:40.581Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Brocade Products: Fabric OS Problem Types: CWE-312 Description: The firmwaredownload command on Brocade Fabric OS v9.2.0 could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a downgrade from Fabric OS v9.2.0 to any earlier version of Fabric OS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/22510 - https://secur
/support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/22510 - https://security.netapp.com/advisory/ntap-20231124-0003/
CVE ID: CVE-2023-3490 State: PUBLISHED Published: 2023-06-30T21:09:30.821Z Last Updated: 2024-11-04T20:57:59.515Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: fossbilling Products: fossbilling/fossbilling Problem Types: CWE-89 Description: SQL Injection in GitHub repository fossbilling/fossbilling prior to 0.5.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/4e60ebc1-e00f-48cb-b011-3cefce688ecd - https://github.com/fossbilling/fossbilling/commit/2ddb7438ee0d05f9a9d01555edcfed820960f114
CVE ID: CVE-2023-3491 State: PUBLISHED Published: 2023-06-30T21:11:09.527Z Last Updated: 2024-11-04T20:57:03.914Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: fossbilling Products: fossbilling/fossbilling Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type in GitHub repository fossbilling/fossbilling prior to 0.5.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/043bd900-ac78-44d2-a340-84ddd0bc4a1d - https://github.com/fossbilling/fossbilling/commit/2ddb7438ee0d05f9a9d01555edcfed820960f114
CVE ID: CVE-2023-3492 State: PUBLISHED Published: 2023-08-07T14:31:19.856Z Last Updated: 2024-08-02T06:55:03.585Z Vendors: Unknown Products: WP Shopping Pages Problem Types: CWE-352 Cross-Site Request Forgery (CSRF), CWE-79 Cross-Site Scripting (XSS) Description: The WP Shopping Pages WordPress plugin through 1.14 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/01b9b1c2-439e-44df-bf01-026cb13d7d40
CVE ID: CVE-2023-3493 State: PUBLISHED Published: 2023-06-30T21:14:49.035Z Last Updated: 2024-11-04T20:56:19.656Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: fossbilling Products: fossbilling/fossbilling Problem Types: CWE-1236 Description: Improper Neutralization of Formula Elements in a CSV File in GitHub repository fossbilling/fossbilling prior to 0.5.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/e9a272ca-b050-441d-a8cb-4fdecb76ccce - https://github.com/fossbilling/fossbilling/commit/9402d6c4d44b77ccd68d98d1e6cedf782bd913dc
CVE ID: CVE-2023-3494 State: PUBLISHED Published: 2023-08-01T22:13:21.634Z Last Updated: 2025-02-13T16:55:41.138Z Vendors: FreeBSD Products: FreeBSD Problem Types: CWE-120 Description: The fwctl driver implements a state machine which is executed when a bhyve guest accesses certain x86 I/O ports. The interface lets the guest copy a string into a buffer resident in the bhyve process' memory. A bug in the state machine implementation can result in a buffer overflowing when copying this string. Malicious, privileged software running in a guest VM can exploit the buffer overflow to achieve code execution on the host in the bhyve userspace process, which typically runs as root, mitigated by the c
w to achieve code execution on the host in the bhyve userspace process, which typically runs as root, mitigated by the capabilities assigned through the Capsicum sandbox available to the bhyve process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-23:07.bhyve.asc - https://security.netapp.com/advisory/ntap-20230831-0006/
CVE ID: CVE-2023-3495 State: PUBLISHED Published: 2023-08-23T01:32:12.229Z Last Updated: 2024-08-02T06:55:03.575Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Hitachi Products: EH-VIEW Problem Types: CWE-787 Description: ** UNSUPPORTED WHEN ASSIGNED ** Out-of-bounds Write vulnerability in Hitachi EH-VIEW (KeypadDesigner) allows local attackers to potentially execute arbitray code on affected EH-VIEW installations. User interaction is required to exploit the vulnerabilities in that the user must open a malicious file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichme
ty only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hitachi.com/hirt/hitachi-sec/2023/002.html
CVE ID: CVE-2023-3496 State: REJECTED Published: N/A Last Updated: 2023-07-17T13:05:54.759989Z Description: No description available.
CVE ID: CVE-2023-3497 State: PUBLISHED Published: 2023-07-03T16:54:10.292Z Last Updated: 2024-08-02T06:55:03.574Z Vendors: Google Products: Chrome Problem Types: Out of bounds read Description: Out of bounds read in Google Security Processor firmware in Google Chrome on Chrome OS prior to 114.0.5735.90 allowed a local attacker to perform denial of service via physical access to the device. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-chromeos.html - https://crbug.com/1459277
CVE ID: CVE-2023-3499 State: PUBLISHED Published: 2023-09-04T11:27:01.030Z Last Updated: 2025-04-23T16:18:03.979Z Vendors: Unknown Products: Photo Gallery, Images, Slider in Rbs Image Gallery Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.16 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerabilit
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ea29413b-494e-410e-ae42-42f96284899c
CVE ID: CVE-2023-3500 State: PUBLISHED Published: 2023-08-02T00:07:15.239Z Last Updated: 2025-11-20T04:07:53.323Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-79 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML diagrams that allowed the attacker to perform arbitrary actions on behalf of victims. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitl
ehalf of victims. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/416902 - https://hackerone.com/reports/2010926
CVE ID: CVE-2023-3501 State: PUBLISHED Published: 2023-08-30T14:22:00.740Z Last Updated: 2025-04-23T16:19:12.728Z Vendors: Unknown Products: FormCraft Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The FormCraft WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d3fb4a2b-ed51-4654-b7c1-4b0f59cd1ecf
CVE ID: CVE-2023-3502 State: PUBLISHED Published: 2023-07-04T14:00:04.782Z Last Updated: 2024-08-02T06:55:03.587Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Shopping Website Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Shopping Website 1.0. Affected is an unknown function of the file search-result.php. The manipulation of the argument product leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-232950 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container:
be used. VDB-232950 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.232950 - https://vuldb.com/?ctiid.232950 - https://github.com/MoeMion233/VulHub/blob/main/Shopping%20Website%20(E-Commerce)%20search-result.php%20has%20Sqlinjection.pdf
CVE ID: CVE-2023-3503 State: PUBLISHED Published: 2023-07-04T14:31:03.508Z Last Updated: 2024-10-31T19:46:51.594Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Shopping Website Problem Types: CWE-434 Description: A vulnerability has been found in SourceCodester Shopping Website 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file insert-product.php. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-232951. Additional Analyst Notes: - CVE Program Container
e used. The associated identifier of this vulnerability is VDB-232951. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.232951 - https://vuldb.com/?ctiid.232951 - https://github.com/Turbo51/CveHubList/blob/main/Shopping%20Website%20(E-Commerce)%20%20insert-product.php%20has%20a%20file%20upload%20(RCE)%20vulnerability.pdf
CVE ID: CVE-2023-3504 State: PUBLISHED Published: 2023-07-04T15:00:04.402Z Last Updated: 2024-08-02T06:55:03.700Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SmartWeb Infotech Products: Job Board Problem Types: CWE-434 Description: A vulnerability was found in SmartWeb Infotech Job Board 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /settings/account of the component My Profile Page. The manipulation of the argument filename leads to unrestricted upload. The attack may be launched remotely. The identifier of this vulnerability is VDB-232952. NOTE: The vendor was contacted early about this disclosure but did not respond in an
f this vulnerability is VDB-232952. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.232952 - https://vuldb.com/?ctiid.232952
CVE ID: CVE-2023-3505 State: PUBLISHED Published: 2023-07-04T15:31:03.633Z Last Updated: 2024-10-28T17:43:33.331Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Onest Products: CRM Problem Types: CWE-79 Description: A vulnerability was found in Onest CRM 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/project/update/2 of the component Project List Handler. The manipulation of the argument name with the input <script>alert(1)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-232953 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but di
ntifier VDB-232953 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.232953 - https://vuldb.com/?ctiid.232953
CVE ID: CVE-2023-3506 State: PUBLISHED Published: 2023-07-04T16:00:04.180Z Last Updated: 2024-08-02T06:55:03.643Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Active It Zone Products: Active eCommerce CMS Problem Types: CWE-79 Description: A vulnerability was found in Active It Zone Active eCommerce CMS 6.5.0. It has been declared as problematic. This vulnerability affects unknown code of the file /ecommerce/support_ticket of the component Create Ticket Page. The manipulation of the argument details with the input <script>alert(1)</script> leads to cross site scripting. The attack can be initiated remotely. VDB-232954 is the identifier assigned to this vulnerability. NOTE: The
scripting. The attack can be initiated remotely. VDB-232954 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.232954 - https://vuldb.com/?ctiid.232954
CVE ID: CVE-2023-3507 State: PUBLISHED Published: 2023-07-31T09:37:37.183Z Last Updated: 2025-04-23T16:19:48.556Z Vendors: Unknown Products: WooCommerce Pre-Orders Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-orders, which could allow attackers to make logged in admins cancel arbitrary pre-orders via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e72bbe9b-e51d-40ab-820d-404e0cb86ee6
CVE ID: CVE-2023-3508 State: PUBLISHED Published: 2023-07-31T09:37:37.921Z Last Updated: 2025-04-23T16:19:41.696Z Vendors: Unknown Products: WooCommerce Pre-Orders Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when processing its tab actions, which could allow attackers to make logged in admins email pre-orders customer, change the released date, mark all pre-orders of a specific product as complete or cancel via CSRF attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/064c7acb-db57-4537-8a6d-32f7ea31c738
CVE ID: CVE-2023-3509 State: PUBLISHED Published: 2024-02-21T22:57:15.488Z Last Updated: 2025-11-20T04:07:58.271Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in GitLab affecting all versions before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for group members with sub-maintainer role to change the title of privately accessible deploy keys associated with projects in the group. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gi
ditional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/416945 - https://hackerone.com/reports/2037814
CVE ID: CVE-2023-3510 State: PUBLISHED Published: 2023-09-11T19:46:07.825Z Last Updated: 2024-08-02T06:55:03.467Z Vendors: Unknown Products: FTP Access Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The FTP Access WordPress plugin through 1.0 does not have authorisation and CSRF checks when updating its settings and is missing sanitisation as well as escaping in them, allowing any authenticated users, such as subscriber to update them with XSS payloads, which will be triggered when an admin will view the settings of the plugin. The attack could also be perform via CSRF against any authenticated user. Additional Analyst Notes: - CVE Pr
the plugin. The attack could also be perform via CSRF against any authenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/76abf4ac-5cc1-41a0-84c3-dff42c659581
CVE ID: CVE-2023-3511 State: PUBLISHED Published: 2023-12-15T15:31:04.966Z Last Updated: 2025-11-20T04:08:03.264Z Severity: LOW (CVSS 2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in GitLab EE affecting all versions starting from 8.17 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible for auditor users to fork and submit merge requests to private projects they're not a member of. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/416961 - https://hackerone.com/r
s: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/416961 - https://hackerone.com/reports/2046752