Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-7180 State: PUBLISHED Published: 2023-12-30T17:31:03.922Z Last Updated: 2024-09-09T20:44:23.232Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Tongda Products: OA 2017 Problem Types: CWE-89 Description: A vulnerability has been found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this vulnerability is an unknown functionality of the file general/project/proj/delete.php. The manipulation of the argument PROJ_ID_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The associ
pgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-249367. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249367 - https://vuldb.com/?ctiid.249367 - https://github.com/Bobjones7/cve/blob/main/sql.md
CVE ID: CVE-2023-7181 State: PUBLISHED Published: 2023-12-30T18:00:05.216Z Last Updated: 2024-11-20T16:54:58.291Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: Muyun Products: DedeBIZ Problem Types: CWE-434 Description: A vulnerability was found in Muyun DedeBIZ up to 6.2.12 and classified as critical. Affected by this issue is some unknown functionality of the component Add Attachment Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249368. NOTE: The vendor was contacted early about this disclosure but did not respond in any way
s vulnerability is VDB-249368. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249368 - https://vuldb.com/?ctiid.249368 - https://github.com/JTZ-a/SRC/blob/master/DedeBIZ/DedeBIZ%20-%20file%20upload/README.md
CVE ID: CVE-2023-7182 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:01.904Z Description: No description available.
CVE ID: CVE-2023-7183 State: PUBLISHED Published: 2023-12-31T10:31:03.773Z Last Updated: 2025-04-17T19:48:53.584Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: 7-card Products: Fakabao Problem Types: CWE-89 Description: A vulnerability has been found in 7-card Fakabao up to 1.0_build20230805 and classified as critical. Affected by this vulnerability is an unknown functionality of the file shop/alipay_notify.php. The manipulation of the argument out_trade_no leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249385 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclo
ed. The identifier VDB-249385 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249385 - https://vuldb.com/?ctiid.249385 - https://note.zhaoj.in/share/NjPfD9xxhVRr
CVE ID: CVE-2023-7184 State: PUBLISHED Published: 2023-12-31T11:00:05.504Z Last Updated: 2024-08-02T08:57:34.080Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: 7-card Products: Fakabao Problem Types: CWE-89 Description: A vulnerability was found in 7-card Fakabao up to 1.0_build20230805 and classified as critical. Affected by this issue is some unknown functionality of the file shop/notify.php. The manipulation of the argument out_trade_no leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-249386 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not re
the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.249386 - https://vuldb.com/?ctiid.249386 - https://note.zhaoj.in/share/Jo8N3eSeLx9c
CVE ID: CVE-2023-7185 State: PUBLISHED Published: 2023-12-31T11:31:03.892Z Last Updated: 2024-08-02T08:57:34.115Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: 7-card Products: Fakabao Problem Types: CWE-89 Description: A vulnerability was found in 7-card Fakabao up to 1.0_build20230805. It has been classified as critical. This affects an unknown part of the file shop/wxpay_notify.php. The manipulation of the argument out_trade_no leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249387. NOTE: The vendor was contacted early about this disclosure but did not respond i
er of this vulnerability is VDB-249387. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.249387 - https://vuldb.com/?ctiid.249387 - https://note.zhaoj.in/share/mqHZlle8Pcg8
CVE ID: CVE-2023-7186 State: PUBLISHED Published: 2023-12-31T13:00:04.987Z Last Updated: 2024-08-26T20:20:22.945Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: 7-card Products: Fakabao Problem Types: CWE-89 Description: A vulnerability was found in 7-card Fakabao up to 1.0_build20230805. It has been declared as critical. This vulnerability affects unknown code of the file member/notify.php. The manipulation of the argument out_trade_no leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249388. NOTE: The vendor was contacted early about this disclosure but did not respond in any
this vulnerability is VDB-249388. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249388 - https://vuldb.com/?ctiid.249388 - https://note.zhaoj.in/share/xHPvSBwWtR4z
CVE ID: CVE-2023-7187 State: PUBLISHED Published: 2023-12-31T14:00:04.569Z Last Updated: 2024-08-02T08:57:34.113Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Totolink Products: N350RT Problem Types: CWE-121 Description: A vulnerability was found in Totolink N350RT 9.3.5u.6139_B20201216. It has been rated as critical. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi?action=login&flag=ie8 of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. The exploit has been disclosed to the public and may be used. The identifier VDB-249389 was assigned to this vulnerability. NOTE: The vendor was c
osed to the public and may be used. The identifier VDB-249389 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.249389 - https://vuldb.com/?ctiid.249389 - https://github.com/jylsec/vuldb/blob/main/TOTOLINK/N350RT/1/README.md
CVE ID: CVE-2023-7188 State: PUBLISHED Published: 2023-12-31T14:31:03.814Z Last Updated: 2024-08-26T20:19:44.616Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Shipping 100 Products: Fahuo100 Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in Shipping 100 Fahuo100 up to 1.1. Affected is an unknown function of the file member/login.php. The manipulation of the argument M_pwd leads to sql injection. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. VDB-249390 is the identifier assigned to this vulnerability. NOTE: The ven
been disclosed to the public and may be used. VDB-249390 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249390 - https://vuldb.com/?ctiid.249390 - https://note.zhaoj.in/share/az24SaQJn1UQ
CVE ID: CVE-2023-7189 State: PUBLISHED Published: 2023-12-31T15:00:04.842Z Last Updated: 2024-08-02T08:57:34.065Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: S-CMS Problem Types: CWE-89 Description: A vulnerability classified as critical was found in S-CMS up to 2.0_build20220529-20231006. Affected by this vulnerability is an unknown functionality of the file /s/index.php?action=statistics. The manipulation of the argument lid leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249391. NOTE: The vendor was contacted early about this disclosure but did n
ted identifier of this vulnerability is VDB-249391. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.249391 - https://vuldb.com/?ctiid.249391 - https://note.zhaoj.in/share/9yaojoQvesLu
CVE ID: CVE-2023-7190 State: PUBLISHED Published: 2023-12-31T15:31:03.358Z Last Updated: 2024-08-02T08:57:35.318Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: S-CMS Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in S-CMS up to 2.0_build20220529-20231006. Affected by this issue is some unknown functionality of the file /member/ad.php?action=ad. The manipulation of the argument A_text/A_url/A_contact leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249392. NOTE: The vendor was contacted early about this disclos
may be used. The identifier of this vulnerability is VDB-249392. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.249392 - https://vuldb.com/?ctiid.249392 - https://note.zhaoj.in/share/0ZY7hEQAskqM
CVE ID: CVE-2023-7191 State: PUBLISHED Published: 2023-12-31T16:00:05.206Z Last Updated: 2025-04-17T19:48:09.151Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: S-CMS Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in S-CMS up to 2.0_build20220529-20231006. This affects an unknown part of the file member/reg.php. The manipulation of the argument M_login/M_email leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249393 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
igned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249393 - https://vuldb.com/?ctiid.249393 - https://note.zhaoj.in/share/Fmytf7wBINbP
CVE ID: CVE-2023-7192 State: PUBLISHED Published: 2024-01-02T19:02:45.371Z Last Updated: 2025-11-20T18:07:32.157Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Suppor
SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-401 Description: A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of service (DoS) attack due to a refcount overflow. Addi
local attacker with CAP_NET_ADMIN privileges to cause a denial of service (DoS) attack due to a refcount overflow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:0723 - https://access.redhat.com/errata/RHSA-2024:0725 - https://access.redhat.com/errata/RHSA-2024:1188 - https://access.redhat.com/errata/RHSA-2024:1250 - https://access.redhat.com/errata/RHSA-2024:1306 - https://access.redhat.com/errata/RHSA-2024:1367 - https://access.redhat.com/errata/RHSA-2024:1382 - https://access.redhat.com/errata/RHSA-2024:1404 - https://access.redhat.com/errata/RHSA-2024:2006 - https://access.redhat.com/errata/RHSA-2024:2
m/errata/RHSA-2024:1404 - https://access.redhat.com/errata/RHSA-2024:2006 - https://access.redhat.com/errata/RHSA-2024:2008 - https://access.redhat.com/security/cve/CVE-2023-7192 - https://bugzilla.redhat.com/show_bug.cgi?id=2256279 - https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=ac4893980bbe79ce383daf9a0885666a30fe4c83
CVE ID: CVE-2023-7193 State: PUBLISHED Published: 2023-12-31T16:31:04.072Z Last Updated: 2024-11-20T16:52:32.469Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: MTab Products: Bookmark Problem Types: CWE-284 Description: A vulnerability was found in MTab Bookmark up to 1.2.6 and classified as critical. This issue affects some unknown processing of the file public/install.php of the component Installation. The manipulation leads to improper access controls. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-
t. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249395. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249395 - https://vuldb.com/?ctiid.249395 - https://note.zhaoj.in/share/StNQi1dYnB5w
CVE ID: CVE-2023-7194 State: PUBLISHED Published: 2024-01-22T19:14:25.885Z Last Updated: 2025-05-30T14:22:19.895Z Vendors: Unknown Products: Meris Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Meris WordPress theme through 1.1.2 does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e20292af-939a-4cb1-91e4-5ff6aa0c7fbe
CVE ID: CVE-2023-7195 State: PUBLISHED Published: 2025-05-15T20:09:24.545Z Last Updated: 2025-05-20T15:00:41.246Z Vendors: Unknown Products: WP-Reply Notify Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP-Reply Notify WordPress plugin through 1.1 does not have a CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/72279ca0-6365-4c83-adca-4d8e5808a8c5/
CVE ID: CVE-2023-7196 State: PUBLISHED Published: 2025-05-15T20:09:24.742Z Last Updated: 2025-05-20T14:56:13.210Z Vendors: Unknown Products: Ultimate Noindex Nofollow Tool Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Ultimate Noindex Nofollow Tool WordPress plugin through 1.1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/15ea1ffd-5a0c-422c-8c9c-7b632516a156/
CVE ID: CVE-2023-7197 State: PUBLISHED Published: 2025-05-15T20:09:24.934Z Last Updated: 2025-05-20T14:31:37.744Z Vendors: Unknown Products: Marketing Twitter Bot Problem Types: CWE-352 Cross-Site Request Forgery (CSRF), CWE-79 Cross-Site Scripting (XSS) Description: The Marketing Twitter Bot WordPress plugin through 1.11 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/26deaa7c-e331-42a0-9310-31d08871154c/
CVE ID: CVE-2023-7198 State: PUBLISHED Published: 2024-02-27T08:30:27.438Z Last Updated: 2025-03-24T20:02:50.419Z Vendors: Unknown Products: WP Dashboard Notes Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The WP Dashboard Notes WordPress plugin before 1.0.11 is vulnerable to Insecure Direct Object References (IDOR) in post_id= parameter. Authenticated users are able to delete private notes associated with different user accounts. This poses a significant security risk as it violates the principle of least privilege and compromises the integrity and privacy of user data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referen
integrity and privacy of user data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/75fbee63-d622-441f-8675-082907b0b1e6/
CVE ID: CVE-2023-7199 State: PUBLISHED Published: 2024-01-29T14:44:19.919Z Last Updated: 2025-05-29T15:09:51.643Z Vendors: Unknown Products: Relevanssi, Relevanssi Premium Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private posts via a crafted request Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0c96a128-4473-41f5-82ce-94bba33ca4a3/ - https://www.relevanssi.com/release-notes/premium-2-25-free-4-22-release-notes/
CVE ID: CVE-2023-7200 State: PUBLISHED Published: 2024-01-29T14:44:26.854Z Last Updated: 2025-06-02T18:50:10.698Z Vendors: Unknown Products: EventON Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The EventON WordPress plugin before 4.4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/586cf0a5-515c-43ea-8c03-f2f47ed13c2c/
CVE ID: CVE-2023-7201 State: PUBLISHED Published: 2024-04-15T05:00:01.572Z Last Updated: 2024-08-09T20:01:33.240Z Vendors: Unknown Products: Everest Backup Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Everest Backup WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/64ba4461-bbba-45eb-981f-bb5f2e5e56e1/
CVE ID: CVE-2023-7202 State: PUBLISHED Published: 2024-02-27T08:30:23.406Z Last Updated: 2024-10-28T00:09:36.117Z Vendors: Unknown Products: Fatal Error Notify Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The Fatal Error Notify WordPress plugin before 1.5.3 does not have authorisation and CSRF checks in its test_error AJAX action, allowing any authenticated users, such as subscriber to call it and spam the admin email address with error messages. The issue is also exploitable via CSRF Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/d923ba5b-1c20-40ee-ac69-cd0bb65
DP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/d923ba5b-1c20-40ee-ac69-cd0bb65b375a/ - https://research.cleantalk.org/cve-2023-7202-fatal-error-notify-error-email-sending-csrf/
CVE ID: CVE-2023-7203 State: PUBLISHED Published: 2024-02-27T08:30:25.017Z Last Updated: 2024-08-27T20:28:00.266Z Vendors: Unknown Products: Smart Forms Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as low as subscriber to call them and perform unauthorised actions such as deleting entries. The plugin also lacks CSRF checks in some places which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as deleting entries. Additional Analyst Notes: - CVE Program Containe
ers perform unwanted actions via CSRF attacks such as deleting entries. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b514b631-c3e3-4793-ab5d-35ed0c38b011/
CVE ID: CVE-2023-7204 State: PUBLISHED Published: 2024-01-29T14:44:21.464Z Last Updated: 2025-06-11T16:46:26.223Z Vendors: Unknown Products: WP STAGING WordPress Backup Plugin Problem Types: CWE-200 Information Exposure Description: The WP STAGING WordPress Backup plugin before 3.2.0 allows access to cache files during the cloning process which provides Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/65a8cf83-d6cc-4d4c-a482-288a83a69879/
CVE ID: CVE-2023-7206 State: PUBLISHED Published: 2024-01-15T22:22:01.676Z Last Updated: 2024-11-13T21:23:40.535Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Horner Automation Products: Cscape Problem Types: CWE-121 Description: In Horner Automation Cscape versions 9.90 SP10 and prior, local attackers are able to exploit this vulnerability if a user opens a malicious CSP file, which would result in execution of arbitrary code on affected installations of Cscape. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-04 - https://hornerautomation.com/cscape-softwa
eferences: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-04 - https://hornerautomation.com/cscape-software/
CVE ID: CVE-2023-7207 State: PUBLISHED Published: 2024-01-05T00:39:49.690Z Last Updated: 2025-05-07T20:19:53.516Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Debian Products: Debian cpio Description: Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since provided a proper fix to --no-absolute-filenames. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=376d663340a9dc91c91a5849e5713f07571c1628 - https://bugs.debian.org/cgi-bin/