Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-25283 State: PUBLISHED Published: 2023-03-13T00:00:00.000Z Last Updated: 2025-02-27T19:23:42.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack overflow vulnerability in D-Link DIR820LA1_FW106B02 allows attackers to cause a denial of service via the reserveDHCP_HostName_1.1.1.0 parameter to lan.asp. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/migraine-sudo/D_Link_Vuln/tree/main/stackoverflow%20%20in%20reserveDHCP_HostName_1.1.1.0
CVE ID: CVE-2023-25289 State: PUBLISHED Published: 2023-05-04T00:00:00.000Z Last Updated: 2025-01-29T20:53:24.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in virtualreception Digital Receptie version win7sp1_rtm.101119-1850 6.1.7601.1.0.65792 in embedded web server, allows attacker to gain sensitive information via a crafted GET request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/51142
CVE ID: CVE-2023-25292 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-31T19:07:54.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GO_LANGUAGE cookie. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://group-office.com - http://intermesh.com - https://github.com/brainkok/CVE-2023-25292
CVE ID: CVE-2023-25295 State: PUBLISHED Published: 2024-01-17T00:00:00.000Z Last Updated: 2025-06-17T15:05:17.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability in evewa3ajax.php in GRUEN eVEWA3 Community 31 through 53 allows attackers to obtain escalated privileges via a crafted request to the login panel. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.munz4u.de/posts/2023/03/cve-2023-25295-ato-via-rxss-in-evewa3-community/
CVE ID: CVE-2023-25303 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-13T15:56:00.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: ATLauncher <= 3.4.26.0 is vulnerable to Directory Traversal. A mrpack file can be maliciously crafted to create arbitrary files outside of the installation directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ATLauncher/ATLauncher/security/advisories/GHSA-7cff-8xv4-mvx6 - https://quiltmc.org/en/blog/2023-02-04-five-installer-vulnerabilities/
CVE ID: CVE-2023-25304 State: PUBLISHED Published: 2023-03-06T00:00:00 Last Updated: 2024-11-27T14:53:54.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Prism Launcher up to v6.1 allows attackers to perform a directory traversal via importing a crafted .mrpack file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PrismLauncher/PrismLauncher/security/advisories/GHSA-wxgx-8v36-mj2m
CVE ID: CVE-2023-25305 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-13T15:53:56.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: PolyMC Launcher <= 1.4.3 is vulnerable to Directory Traversal. A mrpack file can be maliciously crafted to create arbitrary files outside of the installation directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://quiltmc.org/en/blog/2023-02-04-five-installer-vulnerabilities/ - https://github.com/PolyMC/PolyMC/security/advisories/GHSA-3rfr-g9g9-7gx2
CVE ID: CVE-2023-25306 State: PUBLISHED Published: 2023-06-26T00:00:00 Last Updated: 2024-12-04T17:02:24.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: MultiMC Launcher <= 0.6.16 is vulnerable to Directory Traversal. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://quiltmc.org/en/blog/2023-02-04-five-installer-vulnerabilities/
CVE ID: CVE-2023-25307 State: PUBLISHED Published: 2023-06-26T00:00:00 Last Updated: 2024-12-04T17:04:39.278Z Vendors: n/a Products: n/a Problem Types: n/a Description: nothub mrpack-install <= v0.16.2 is vulnerable to Directory Traversal. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nothub/mrpack-install/security/advisories/GHSA-r887-gfxh-m9rr - https://quiltmc.org/en/blog/2023-02-04-five-installer-vulnerabilities/
CVE ID: CVE-2023-25309 State: PUBLISHED Published: 2023-05-11T00:00:00.000Z Last Updated: 2025-01-27T17:02:03.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui version 0.5, allows attackers to execute arbitrary code via a crafted url to the delete a feature functionality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://fetlife.com - http://rollout-ui.com - https://packetstormsecurity.com/files/172185/Rollout-UI-0.5-Cross-Site-Scripting.html - https://cxsecurity.com/issue/WLB-2023050012
CVE ID: CVE-2023-25313 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-03T18:54:04.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/WWBN/AVideo/security/advisories/GHSA-pgvh-p3g4-86jw
CVE ID: CVE-2023-25314 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-04T16:16:42.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information via the success parameter to /user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/WWBN/AVideo/commit/2b44dee815b208da85e1dcafa9839391c3de2655
CVE ID: CVE-2023-25330 State: PUBLISHED Published: 2023-04-05T00:00:00 Last Updated: 2024-08-02T11:18:36.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in Mybatis plus below 3.5.3.1 allows remote attackers to execute arbitrary SQL commands via the tenant ID valuer. NOTE: the vendor's position is that this can only occur in a misconfigured application; the documentation discusses how to develop applications that avoid SQL injection. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/FCncdn/MybatisPlusTenantPluginSQLInjection-POC/blob/master/Readme.en.md - https://baomidou.com/reference/abo
/github.com/FCncdn/MybatisPlusTenantPluginSQLInjection-POC/blob/master/Readme.en.md - https://baomidou.com/reference/about-cve/
CVE ID: CVE-2023-25341 State: PUBLISHED Published: 2024-03-28T00:00:00 Last Updated: 2024-11-21T15:09:22.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Directory Traversal vulnerability in ladle dev server 2.5.1 and earlier allows an attacker on the same network to read files accessible to the user via GET requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.runjak.codes/posts/2024-03-21-ladle-cve
CVE ID: CVE-2023-25344 State: PUBLISHED Published: 2023-03-15T00:00:00.000Z Last Updated: 2025-02-27T14:28:30.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to execute arbitrary code via crafted Object.prototype anonymous function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/node-swig/swig-templates/issues/89 - https://www.gem-love.com/2023/02/01/Swig%E6%A8%A1%E6%9D%BF%E5%BC%95%E6%93%8E0day%E6%8C%96%E6%8E%98-%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E5%92%8C%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96/
CVE ID: CVE-2023-25345 State: PUBLISHED Published: 2023-03-15T00:00:00.000Z Last Updated: 2025-02-27T18:28:56.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the include or extends tags. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/node-swig/swig-templates/issues/88
CVE ID: CVE-2023-25346 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-03T18:53:25.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM - https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-25346
CVE ID: CVE-2023-25347 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-04T16:13:25.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via input fields. These input fields are located in the "Title" Input Field in EventEditor.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM - https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-25347
CVE ID: CVE-2023-25348 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-04T15:28:54.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM - https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-25348
CVE ID: CVE-2023-25350 State: PUBLISHED Published: 2023-03-24T00:00:00.000Z Last Updated: 2025-02-21T17:50:46.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: Faveo Helpdesk 1.0-1.11.1 is vulnerable to SQL Injection. When the user logs in through the login box, he has no judgment on the validity of the user's input data. The parameters passed from the front end to the back end are controllable, which will lead to SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ladybirdweb/faveo-helpdesk/issues/7827 - https://gist.github.com/Whitehat-Su/8402323c00ea93b4abc21ab9a372101e
CVE ID: CVE-2023-25355 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-13T15:51:55.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: CoreDial sipXcom up to and including 21.04 is vulnerable to Insecure Permissions. A user who has the ability to run commands as the `daemon` user on a sipXcom server can overwrite a service file, and escalate their privileges to `root`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/fulldisclosure/2023/Mar/5
CVE ID: CVE-2023-25356 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-13T15:49:16.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: CoreDial sipXcom up to and including 21.04 is vulnerable to Improper Neutralization of Argument Delimiters in a Command. XMPP users are able to inject arbitrary arguments into a system command, which can be used to read files from, and write files to, the sipXcom server. This can also be leveraged to gain remote command execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/fulldisclosure/2023/Mar/5
CVE ID: CVE-2023-25358 State: PUBLISHED Published: 2023-03-02T00:00:00.000Z Last Updated: 2025-03-07T15:58:48.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.webkit.org/show_bug.cgi?id=242683 - http://www.openwall.com/lists/oss-security/2023/04/21/3 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QL5OGMSHRQ26FTYWZUXVNWB2VHOSVXK/ - https://lists.fedoraproject.org/archives/list/package-announc
oraproject.org/message/6QL5OGMSHRQ26FTYWZUXVNWB2VHOSVXK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5OKKVEUQAAGH3NHMX3WHWKRPYU4QFKTQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KC7DMUX37BRCLAI4VPQYHDUVEGTNYN5A/ - https://security.gentoo.org/glsa/202305-32
CVE ID: CVE-2023-25360 State: PUBLISHED Published: 2023-03-02T00:00:00.000Z Last Updated: 2025-03-07T16:12:28.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: A use-after-free vulnerability in WebCore::RenderLayer::renderer in WebKitGTK before 2.36.8 allows attackers to execute code remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.webkit.org/show_bug.cgi?id=242686 - http://www.openwall.com/lists/oss-security/2023/04/21/3 - https://security.gentoo.org/glsa/202305-32
CVE ID: CVE-2023-25361 State: PUBLISHED Published: 2023-03-02T00:00:00.000Z Last Updated: 2025-03-07T16:19:37.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: A use-after-free vulnerability in WebCore::RenderLayer::setNextSibling in WebKitGTK before 2.36.8 allows attackers to execute code remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.webkit.org/show_bug.cgi?id=244249 - http://www.openwall.com/lists/oss-security/2023/04/21/3 - https://security.gentoo.org/glsa/202305-32
CVE ID: CVE-2023-25362 State: PUBLISHED Published: 2023-03-02T00:00:00.000Z Last Updated: 2025-03-07T17:26:32.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute code remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.webkit.org/show_bug.cgi?id=244802 - http://www.openwall.com/lists/oss-security/2023/04/21/3 - https://security.gentoo.org/glsa/202305-32
CVE ID: CVE-2023-25363 State: PUBLISHED Published: 2023-03-02T00:00:00.000Z Last Updated: 2025-03-07T17:24:22.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: A use-after-free vulnerability in WebCore::RenderLayer::updateDescendantDependentFlags in WebKitGTK before 2.36.8 allows attackers to execute code remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.webkit.org/show_bug.cgi?id=242684 - http://www.openwall.com/lists/oss-security/2023/04/21/3 - https://security.gentoo.org/glsa/202305-32
CVE ID: CVE-2023-25364 State: PUBLISHED Published: 2024-03-27T00:00:00 Last Updated: 2024-11-05T14:49:20.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: Opswat Metadefender Core before 5.2.1 does not properly defend against potential HTML injection and XSS attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.opswat.com/mdcore/release-notes/archived-release-notes#version-v521
CVE ID: CVE-2023-25365 State: PUBLISHED Published: 2024-02-08T00:00:00.000Z Last Updated: 2025-06-17T15:06:38.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cupc4k3.medium.com/cve-2023-25365-xss-via-file-upload-bypass-ddf4d2a106a7
CVE ID: CVE-2023-25366 State: PUBLISHED Published: 2023-06-16T00:00:00 Last Updated: 2024-12-12T19:00:36.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS, insecure SCPI interface discloses web password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://siglent.com - https://github.com/BretMcDanel/CVE/blob/main/CVE-2023-25366.md
CVE ID: CVE-2023-25367 State: PUBLISHED Published: 2023-06-14T00:00:00 Last Updated: 2025-01-03T17:11:45.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS allows unfiltered user input resulting in Remote Code Execution (RCE) with SCPI interface or web server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://siglent.com - https://github.com/BretMcDanel/CVE/blob/main/CVE-2023-25367.md
CVE ID: CVE-2023-25368 State: PUBLISHED Published: 2023-06-14T00:00:00 Last Updated: 2025-01-03T17:09:21.737Z Vendors: n/a Products: n/a Problem Types: n/a Description: Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS is vulnerable to Incorrect Access Control. An unauthenticated attacker can overwrite firmnware. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/BretMcDanel/CVE/blob/main/CVE-2023-25368.md
CVE ID: CVE-2023-25369 State: PUBLISHED Published: 2023-06-14T00:00:00 Last Updated: 2025-01-03T17:08:02.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS is vulnerable to Denial of Service on the user interface triggered by malformed SCPI command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/BretMcDanel/CVE/blob/main/CVE-2023-25369.md
CVE ID: CVE-2023-25392 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-02-11T16:10:57.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: Allegro Tech BigFlow <1.6 is vulnerable to Missing SSL Certificate Validation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/allegro/bigflow/pull/357 - https://lutrasecurity.com/en/articles/cve-2023-25392/
CVE ID: CVE-2023-25394 State: PUBLISHED Published: 2023-05-16T00:00:00.000Z Last Updated: 2025-01-23T17:27:07.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: Videostream macOS app 0.5.0 and 0.4.3 has a Race Condition. The Updater privileged script attempts to update Videostream every 5 hours. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://getvideostream.com/ - https://danrevah.github.io/2023/05/03/CVE-2023-25394-VideoStream-LPE/ - https://www.kb.cert.org/vuls/id/757109
CVE ID: CVE-2023-25395 State: PUBLISHED Published: 2023-03-08T00:00:00 Last Updated: 2024-08-02T11:18:36.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOlink A7100RU V7.4cu.2313_B20191024 router was discovered to contain a command injection vulnerability via the ou parameter at /setting/delStaticDhcpRules. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Am1ngl/ttt/tree/main/22
CVE ID: CVE-2023-25396 State: PUBLISHED Published: 2023-02-08T00:00:00.000Z Last Updated: 2025-03-25T13:58:13.375Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Privilege escalation in the MSI repair functionality in Caphyon Advanced Installer 20.0 and below allows attackers to access and manipulate system files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.advancedinstaller.com/release-20.1.html
CVE ID: CVE-2023-25399 State: PUBLISHED Published: 2023-07-05T00:00:00 Last Updated: 2024-08-02T11:18:36.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function. Note: This is disputed as a bug and not a vulnerability. SciPy is not designed to be exposed to untrusted users or data directly. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/scipy/scipy/issues/16235 - https://github.com/scipy/scipy/pull/16397 - http://www.square16.org/achievement/cve-2023-25399/ - https://github.com/scipy/scipy/issues/
om/scipy/scipy/pull/16397 - http://www.square16.org/achievement/cve-2023-25399/ - https://github.com/scipy/scipy/issues/16235#issuecomment-1625361328
CVE ID: CVE-2023-25402 State: PUBLISHED Published: 2023-03-03T00:00:00.000Z Last Updated: 2025-03-06T20:43:39.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: CleverStupidDog yf-exam 1.8.0 is vulnerable to File Upload. There is no restriction on the suffix of the uploaded file, resulting in any file upload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CleverStupidDog/yf-exam/issues/1 - https://github.com/Fw-fW-fw/UPDATE-CVE/blob/main/CVE-2023-25402
CVE ID: CVE-2023-25403 State: PUBLISHED Published: 2023-03-03T00:00:00.000Z Last Updated: 2025-03-07T16:39:28.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: CleverStupidDog yf-exam v 1.8.0 is vulnerable to Authentication Bypass. The program uses a fixed JWT key, and the stored key uses username format characters. Any user who logged in within 24 hours. A token can be forged with his username to bypass authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CleverStupidDog/yf-exam/issues/2 - https://github.com/Fw-fW-fw/UPDATE-CVE/blob/main/CVE-2023-25403
CVE ID: CVE-2023-25407 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-11T16:42:53.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. Restricted users have read access to administrator credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.pentagrid.ch/en/blog/multiple-vulnerabilities-in-aten-PE8108-power-distribution-unit/
CVE ID: CVE-2023-25409 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-11T16:41:25.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. Restricted users have access to other users outlets. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.pentagrid.ch/en/blog/multiple-vulnerabilities-in-aten-PE8108-power-distribution-unit
CVE ID: CVE-2023-25411 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-11T16:40:04.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aten PE8108 2.4.232 is vulnerable to Cross Site Request Forgery (CSRF). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.pentagrid.ch/en/blog/multiple-vulnerabilities-in-aten-PE8108-power-distribution-unit/
CVE ID: CVE-2023-25413 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-11T16:38:39.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. The device allows unauthenticated access to Telnet and SNMP credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.pentagrid.ch/en/blog/multiple-vulnerabilities-in-aten-PE8108-power-distribution-unit/