Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
Vulnrichment: References: - https://www.smilecdr.com/our-blog/statement-on-cve-2023-24057-smile-digital-health - https://www.smilecdr.com/our-blog - https://github.com/advisories/GHSA-9654-pr4f-gh6m
CVE ID: CVE-2023-28466 State: PUBLISHED Published: 2023-03-15T00:00:00.000Z Last Updated: 2025-05-05T16:02:32.757Z Vendors: n/a Products: n/a Problem Types: n/a Description: do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=49c47cc21b5b7a3d8deb18fc57b0aa2ab1286962 - https://security.netapp.com/advisory/ntap-20230427-0006/ - https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
CVE ID: CVE-2023-28467 State: PUBLISHED Published: 2023-05-22T00:00:00 Last Updated: 2025-01-21T15:26:10.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MyBB before 1.8.34, there is XSS in the User CP module via the user email field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mybb.com - https://github.com/mybb/mybb/security/advisories/GHSA-3q8x-9fh2-v646
CVE ID: CVE-2023-28468 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T20:05:38.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The FvbServicesRuntimeDxe SMM module exposes an SMI handler that allows an attacker to interact with the SPI flash at run-time from the OS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2023039
CVE ID: CVE-2023-28469 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-08T20:11:17.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory. This affects Valhall r29p0 through r42p0 before r43p0, and Arm's GPU Architecture Gen5 r41p0 through r42p0 before r43p0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE ID: CVE-2023-28470 State: PUBLISHED Published: 2023-03-23T00:00:00.000Z Last Updated: 2025-02-24T15:19:04.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Couchbase Server 5 through 7 before 7.1.4, the nsstats endpoint is accessible without authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.couchbase.com/tags/security - https://www.couchbase.com/downloads - https://docs.couchbase.com/server/current/release-notes/relnotes.html - https://www.couchbase.com/alerts/
CVE ID: CVE-2023-28471 State: PUBLISHED Published: 2023-04-28T00:00:00.000Z Last Updated: 2025-01-31T16:10:53.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS via a container name. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://concretecms.com - https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20 - https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates
CVE ID: CVE-2023-28472 State: PUBLISHED Published: 2023-04-28T00:00:00 Last Updated: 2024-08-02T12:38:25.362Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 does not have Secure and HTTP only attributes set for ccmPoll cookies. Additional Analyst Notes: - CVE Program Container: References: - https://concretecms.com - https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20 - https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release
CVE ID: CVE-2023-28473 State: PUBLISHED Published: 2023-04-28T00:00:00 Last Updated: 2024-11-27T14:41:21.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://concretecms.com - https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20 - https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release
CVE ID: CVE-2023-28474 State: PUBLISHED Published: 2023-04-28T00:00:00 Last Updated: 2024-11-27T15:09:29.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://concretecms.com - https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20 - https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates
CVE ID: CVE-2023-28475 State: PUBLISHED Published: 2023-04-28T00:00:00 Last Updated: 2024-08-02T12:38:25.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized. Additional Analyst Notes: - CVE Program Container: References: - https://concretecms.com - https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20 - https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release
CVE ID: CVE-2023-28476 State: PUBLISHED Published: 2023-04-28T00:00:00 Last Updated: 2024-08-02T12:38:25.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Tags on uploaded files. Additional Analyst Notes: - CVE Program Container: References: - https://concretecms.com - https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20 - https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates
CVE ID: CVE-2023-28477 State: PUBLISHED Published: 2023-04-28T00:00:00 Last Updated: 2024-08-02T12:38:25.329Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:L/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://concretecms.com - https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20 - https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-re
3-04-20 - https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release
CVE ID: CVE-2023-28478 State: PUBLISHED Published: 2023-06-12T00:00:00 Last Updated: 2025-01-06T16:57:06.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link EC-70 devices through 2.3.4 Build 20220902 rel.69498 have a Buffer Overflow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0006.md
CVE ID: CVE-2023-28479 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-10-08T20:46:42.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tigergraph Enterprise 3.7.0. The TigerGraph platform installs a full development toolchain within every TigerGraph deployment. An attacker is able to compile new executables on each Tigergraph system and modify system and Tigergraph binaries. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://neo4j.com/security/cve-2023-28479/
CVE ID: CVE-2023-28480 State: PUBLISHED Published: 2023-08-14T00:00:00 Last Updated: 2024-10-09T16:20:51.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tigergraph Enterprise 3.7.0. The TigerGraph platform allows users to define new User Defined Functions (UDFs) from C/C++ code. To support this functionality TigerGraph allows users to upload custom C/C++ code which is then compiled and installed into the platform. An attacker who has filesystem access on a remote TigerGraph system can alter the behavior of the database against the will of the database administrator; thus effectively bypassing the built in RBAC controls. Additional Analyst Notes: - C
will of the database administrator; thus effectively bypassing the built in RBAC controls. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://neo4j.com/security/cve-2023-28480/
CVE ID: CVE-2023-28481 State: PUBLISHED Published: 2023-08-14T00:00:00 Last Updated: 2024-10-09T16:20:07.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tigergraph Enterprise 3.7.0. There is unsecured write access to SSH authorized keys file. Any code running as the tigergraph user is able to add their SSH public key into the authorised keys file. This allows an attacker to obtain password-less SSH key access by using their own SSH key. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://neo4j.com/security/cve-2023-28481/
CVE ID: CVE-2023-28482 State: PUBLISHED Published: 2023-08-14T00:00:00 Last Updated: 2024-10-09T16:19:28.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tigergraph Enterprise 3.7.0. A single TigerGraph instance can host multiple graphs that are accessed by multiple different users. The TigerGraph platform does not protect the confidentiality of any data uploaded to the remote server. In this scenario, any user that has permissions to upload data can browse data uploaded by any other user (irrespective of their permissions). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://neo4j.com/security/cve-2023-2
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://neo4j.com/security/cve-2023-28482/
CVE ID: CVE-2023-28483 State: PUBLISHED Published: 2023-08-14T00:00:00 Last Updated: 2024-10-09T16:18:52.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tigergraph Enterprise 3.7.0. The GSQL query language provides users with the ability to write data to files on a remote TigerGraph server. The locations that a query is allowed to write to are configurable via the GSQL.FileOutputPolicy configuration setting. GSQL queries that contain UDFs can bypass this configuration setting and, as a consequence, can write to any file location to which the administrative user has access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
which the administrative user has access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://neo4j.com/security/cve-2023-28483/
CVE ID: CVE-2023-28484 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-05-30T19:44:30.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4 - https://gitlab.gnome.org/GNOME/libxml2/-/issues/491 - https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html - https://security.netapp.com/advisory/ntap-20230601-0006/ - htt
ts.debian.org/debian-lts-announce/2023/04/msg00031.html - https://security.netapp.com/advisory/ntap-20230601-0006/ - https://security.netapp.com/advisory/ntap-20240201-0005/
CVE ID: CVE-2023-28485 State: PUBLISHED Published: 2023-06-26T00:00:00 Last Updated: 2024-12-04T17:10:55.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script or HTML via names of file attachments. Any user can obtain the privilege to rename within their own board (where they have BoardAdmin access), and renameAttachment does not block XSS payloads. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wekan.github.io/ - https://wekan.github.io/hall-of-fame/filebleed/ - http://packe
DP Vulnrichment: References: - https://wekan.github.io/ - https://wekan.github.io/hall-of-fame/filebleed/ - http://packetstormsecurity.com/files/172649/Wekan-6.74-Cross-Site-Scripting.html
CVE ID: CVE-2023-28486 State: PUBLISHED Published: 2023-03-16T00:00:00 Last Updated: 2024-08-02T12:38:25.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sudo before 1.9.13 does not escape control characters in log messages. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sudo-project/sudo/commit/334daf92b31b79ce68ed75e2ee14fca265f029ca - https://github.com/sudo-project/sudo/releases/tag/SUDO_1_9_13 - https://security.netapp.com/advisory/ntap-20230420-0002/ - https://security.gentoo.org/glsa/202309-12 - https://lists.debian.org/debian-lts-announce/2024/02/msg00002.html
CVE ID: CVE-2023-28487 State: PUBLISHED Published: 2023-03-16T00:00:00 Last Updated: 2024-08-02T12:38:25.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sudo before 1.9.13 does not escape control characters in sudoreplay output. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sudo-project/sudo/commit/334daf92b31b79ce68ed75e2ee14fca265f029ca - https://github.com/sudo-project/sudo/releases/tag/SUDO_1_9_13 - https://security.netapp.com/advisory/ntap-20230420-0002/ - https://security.gentoo.org/glsa/202309-12 - https://lists.debian.org/debian-lts-announce/2024/02/msg00002.html
CVE ID: CVE-2023-28488 State: PUBLISHED Published: 2023-04-12T00:00:00.000Z Last Updated: 2025-02-08T02:37:47.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-based buffer overflow and denial of service, terminating the connman process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kernel.googlesource.com/pub/scm/network/connman/connman/+/99e2c16ea1cced34a5dc450d76287a1c3e762138 - https://github.com/moehw/poc_exploits/tree/master/CVE-2023-28488 - https://lists.debian.org/debian-lts-announce/
62138 - https://github.com/moehw/poc_exploits/tree/master/CVE-2023-28488 - https://lists.debian.org/debian-lts-announce/2023/04/msg00024.html - https://www.debian.org/security/2023/dsa-5416
CVE ID: CVE-2023-28489 State: PUBLISHED Published: 2023-04-11T09:03:04.302Z Last Updated: 2025-02-13T16:48:43.223Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: CP-8031 MASTER MODULE, CP-8050 MASTER MODULE Problem Types: CWE-77 Description: A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). Affected devices are vulnerable to command injection via the web server port 443/tcp, if the parameter “Remote Operation” is enabled. The parameter is disabled by default. The vulnerability could allow an unauthenticated remote attacker to perform
bled. The parameter is disabled by default. The vulnerability could allow an unauthenticated remote attacker to perform arbitrary code execution on the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-472454.pdf - http://seclists.org/fulldisclosure/2023/Jul/14 - http://packetstormsecurity.com/files/173370/Siemens-A8000-CP-8050-CP-8031-Code-Execution-Command-Injection.html
CVE ID: CVE-2023-28490 State: PUBLISHED Published: 2023-09-27T05:05:19.138Z Last Updated: 2024-09-23T13:30:06.526Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Estatik Products: Estatik Mortgage Calculator Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Estatik Estatik Mortgage Calculator plugin <= 2.0.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/estatik-mortgage-calculator/wordpress-wordpress-mortgage-calculator-estatik-plugin-2-0-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28491 State: PUBLISHED Published: 2023-12-20T17:23:19.842Z Last Updated: 2024-08-02T12:38:25.446Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: Tribulant Products: Slideshow Gallery LITE Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Slideshow Gallery LITE.This issue affects Slideshow Gallery LITE: from n/a through 1.7.6. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/slideshow-gallery/wordpress-slideshow-gallery-lite-plugin-1-7-6-sql-injection?_s_id=cve
CVE ID: CVE-2023-28492 State: PUBLISHED Published: 2024-06-03T22:09:38.211Z Last Updated: 2024-08-02T12:38:25.345Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: CodePeople Products: CP Multi View Event Calendar Problem Types: CWE-862 Description: Missing Authorization vulnerability in CodePeople CP Multi View Event Calendar allows Functionality Misuse.This issue affects CP Multi View Event Calendar: from n/a through 1.4.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/cp-multi-view-calendar/wordpress-calendar-event-multi-view-plugin-1-4-10-missing-authorization-leadi
abase/vulnerability/cp-multi-view-calendar/wordpress-calendar-event-multi-view-plugin-1-4-10-missing-authorization-leading-to-feedback-submission-vulnerability?_s_id=cve
CVE ID: CVE-2023-28493 State: PUBLISHED Published: 2023-05-08T14:25:41.651Z Last Updated: 2025-01-09T15:24:33.561Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Macho Themes Products: NewsMag Problem Types: CWE-79 Description: Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes NewsMag theme <= 2.4.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/newsmag/wordpress-newsmag-theme-2-4-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28494 State: PUBLISHED Published: 2024-06-04T07:06:01.935Z Last Updated: 2024-08-02T12:38:25.446Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: CodePeople Products: Contact Form Email Problem Types: CWE-862 Description: Missing Authorization vulnerability in CodePeople Contact Form Email allows Functionality Misuse.This issue affects Contact Form Email: from n/a through 1.3.31. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/contact-form-to-email/wordpress-contact-form-email-plugin-1-3-31-missing-authorization-leading-to-feedback-submission-vulnerabilit
rm-to-email/wordpress-contact-form-email-plugin-1-3-31-missing-authorization-leading-to-feedback-submission-vulnerability?_s_id=cve
CVE ID: CVE-2023-28495 State: PUBLISHED Published: 2023-11-12T22:07:02.921Z Last Updated: 2024-08-30T19:27:50.532Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: MyThemeShop Products: WP Shortcode by MyThemeShop Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop WP Shortcode by MyThemeShop plugin <= 1.4.16 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-shortcode/wordpress-wp-shortcode-by-mythemeshop-plugin-1-4-16-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-28496 State: PUBLISHED Published: 2023-06-22T08:24:44.600Z Last Updated: 2024-10-10T17:25:33.987Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: SMTP2GO Products: SMTP2GO – Email Made Easy Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SMTP2GO – Email Made Easy plugin <= 1.4.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/smtp2go/wordpress-smtp2go-plugin-1-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28497 State: PUBLISHED Published: 2023-11-12T22:01:56.040Z Last Updated: 2024-08-02T14:49:03.513Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Tribulant Products: Slideshow Gallery LITE Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Slideshow Gallery LITE plugin <= 1.7.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/slideshow-gallery/wordpress-slideshow-gallery-lite-plugin-1-7-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-28498 State: PUBLISHED Published: 2023-11-12T21:57:22.327Z Last Updated: 2024-08-30T19:28:10.065Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: MotoPress Products: Hotel Booking Lite Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in MotoPress Hotel Booking Lite plugin <= 4.6.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/motopress-hotel-booking-lite/wordpress-hotel-booking-lite-plugin-4-6-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-28499 State: PUBLISHED Published: 2023-11-07T17:34:48.417Z Last Updated: 2024-08-02T12:38:25.367Z Vendors: simonpedge Products: Slide Anything – Responsive Content / HTML Slider and Carousel Problem Types: CWE-79 Description: Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in simonpedge Slide Anything – Responsive Content / HTML Slider and Carousel plugin <= 2.4.9 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/slide-anything/wordpress-slide-anything-plugin-2-4-7-cross-site-scripting-xss-vulnerability?_s_id=cve