Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-46853 State: PUBLISHED Published: 2023-10-27T00:00:00 Last Updated: 2024-09-09T15:31:32.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/memcached/memcached/compare/1.6.21...1.6.22 - https://github.com/memcached/memcached/commit/6987918e9a3094ec4fc8976f01f769f624d790fa
CVE ID: CVE-2023-46854 State: PUBLISHED Published: 2023-10-28T00:00:00 Last Updated: 2024-09-09T14:36:09.313Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Proxmox proxmox-widget-toolkit before 4.0.9, as used in multiple Proxmox products, allows XSS via the edit notes feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.proxmox.com/?p=proxmox-widget-toolkit.git%3Ba=commit%3Bh=89699c6466cfd9cc3a81fbc926b62f122c33c23c - https://git.proxmox.com/?p=proxmox-widget-toolkit.git%3Ba=commit%3Bh=1326f771b959e576d140da2249c8b5424da6c80d - https://pve.proxmox.co
oxmox.com/?p=proxmox-widget-toolkit.git%3Ba=commit%3Bh=1326f771b959e576d140da2249c8b5424da6c80d - https://pve.proxmox.com/wiki/Package_Repositories#sysadmin_test_repo
CVE ID: CVE-2023-46857 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T20:53:21.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for exploitation. Additional Analyst Notes: - CVE Program Container: References: - https://support.squidex.io/c/news/9 - http://www.openwall.com/lists/oss-security/2023/11/08/4 - https://census-labs.com/news/2023/11/08/weak-svg-asset-filtering-
p://www.openwall.com/lists/oss-security/2023/11/08/4 - https://census-labs.com/news/2023/11/08/weak-svg-asset-filtering-mechanism-in-squidex-cms/
CVE ID: CVE-2023-46858 State: PUBLISHED Published: 2023-10-29T00:00:00 Last Updated: 2024-08-02T20:53:21.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher. NOTE: the Moodle Security FAQ link states "Some forms of rich content [are] used by teachers to enhance their courses ... admins and teachers can post XSS-capable content, but students can not." Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/Abid-Ahmad/12d2b4878eb731e8871b96b7d55125cd - https://docs.moodle.org/403/en/Security_FAQ#I_have_discovered_Cross_Sit
om/Abid-Ahmad/12d2b4878eb731e8871b96b7d55125cd - https://docs.moodle.org/403/en/Security_FAQ#I_have_discovered_Cross_Site_Scripting_.28XSS.29_is_possible_with_Moodle - https://packetstormsecurity.com/files/175277/Moodle-4.3-Cross-Site-Scripting.html
CVE ID: CVE-2023-46862 State: PUBLISHED Published: 2023-10-29T00:00:00 Last Updated: 2024-08-02T20:53:21.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/7644b1a1c9a7ae8ab99175989bfc8676055edb46 - https://bugzilla.kernel.org/show_bug.cgi?id=218032#c4 - https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html
CVE ID: CVE-2023-46863 State: PUBLISHED Published: 2023-10-29T00:00:00 Last Updated: 2024-09-09T14:26:33.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ POST request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Peppermint-Lab/peppermint/issues/108
CVE ID: CVE-2023-46864 State: PUBLISHED Published: 2023-10-29T00:00:00 Last Updated: 2024-09-09T14:23:50.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Peppermint-Lab/peppermint/issues/171
CVE ID: CVE-2023-46865 State: PUBLISHED Published: 2023-10-30T00:00:00 Last Updated: 2024-08-02T20:53:21.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: /api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an image/png IDAT chunk of a Company Logo image. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/crater-invoice/crater/issues/1267 - https://github.com/crater-invoice/crater/pull/1271 - https://github.com/asylumdx/Crater-CVE-2023-46865-RCE - https://notes.netbytesec.com/2023/11/post-auth-rce-in-crater-invoice.html
CVE ID: CVE-2023-46866 State: PUBLISHED Published: 2023-10-30T00:00:00 Last Updated: 2024-09-09T20:25:07.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: In International Color Consortium DemoIccMAX 79ecb74, CIccCLUT::Interp3d in IccProfLib/IccTagLut.cpp in libSampleICC.a attempts to access array elements at out-of-bounds indexes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/InternationalColorConsortium/DemoIccMAX/pull/53 - https://github.com/InternationalColorConsortium/DemoIccMAX/issues/54
CVE ID: CVE-2023-46867 State: PUBLISHED Published: 2023-10-30T00:00:00 Last Updated: 2024-09-09T20:28:57.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: In International Color Consortium DemoIccMAX 79ecb74, CIccXformMatrixTRC::GetCurve in IccCmm.cpp in libSampleICC.a has a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/InternationalColorConsortium/DemoIccMAX/pull/53 - https://github.com/InternationalColorConsortium/DemoIccMAX/issues/54
CVE ID: CVE-2023-46870 State: PUBLISHED Published: 2024-05-13T18:36:00.979Z Last Updated: 2025-02-13T15:46:56.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: extcap/nrf_sniffer_ble.py, extcap/nrf_sniffer_ble.sh, extcap/SnifferAPI/*.py in Nordic Semiconductor nRF Sniffer for Bluetooth LE 3.0.0, 3.1.0, 4.0.0, 4.1.0, and 4.1.1 have set incorrect file permission, which allows attackers to do code execution via modified bash and python scripts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Chapoly1305/CVE-2023-46870
CVE ID: CVE-2023-46871 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T20:53:21.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: GPAC version 2.3-DEV-rev602-ged8424300-master in MP4Box contains a memory leak in NewSFDouble scenegraph/vrml_tools.c:300. This vulnerability may lead to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/2658 - https://gist.github.com/ReturnHere/d0899bb03b8f5e8fae118f2b76888486
CVE ID: CVE-2023-46886 State: PUBLISHED Published: 2023-11-29T00:00:00 Last Updated: 2024-10-10T20:21:47.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dreamer CMS before version 4.0.1 is vulnerable to Directory Traversal. Background template management allows arbitrary modification of the template file, allowing system sensitive files to be read. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/iteachyou/dreamer_cms/issues/I6NOFN
CVE ID: CVE-2023-46887 State: PUBLISHED Published: 2023-11-29T00:00:00 Last Updated: 2024-11-26T20:31:21.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/iteachyou/dreamer_cms/issues/I6NDEZ
CVE ID: CVE-2023-46889 State: PUBLISHED Published: 2024-01-23T00:00:00.000Z Last Updated: 2025-06-17T16:11:54.038Z Vendors: n/a Products: n/a Problem Types: n/a Description: Meross MSH30Q 4.5.23 is vulnerable to Cleartext Transmission of Sensitive Information. During the device setup phase, the MSH30Q creates an unprotected Wi-Fi access point. In this phase, MSH30Q needs to connect to the Internet through a Wi-Fi router. This is why MSH30Q asks for the Wi-Fi network name (SSID) and the Wi-Fi network password. When the user enters the password, the transmission of the Wi-Fi password and name between the MSH30Q and mobile application is observed in the Wi-Fi network. Although the Wi-Fi passwor
password and name between the MSH30Q and mobile application is observed in the Wi-Fi network. Although the Wi-Fi password is encrypted, a part of the decryption algorithm is public so we complemented the missing parts to decrypt it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.kth.se/cs/nse/research/software-systems-architecture-and-security/projects/ethical-hacking-1.1279219
CVE ID: CVE-2023-46892 State: PUBLISHED Published: 2024-01-23T00:00:00.000Z Last Updated: 2025-06-17T16:12:41.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: The radio frequency communication protocol being used by Meross MSH30Q 4.5.23 is vulnerable to replay attacks, allowing attackers to record and replay previously captured communication to execute unauthorized commands or actions (e.g., thermostat's temperature). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.kth.se/cs/nse/research/software-systems-architecture-and-security/projects/ethical-hacking-1.1279219
CVE ID: CVE-2023-46894 State: PUBLISHED Published: 2023-11-09T00:00:00 Last Updated: 2024-09-04T14:57:32.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/espressif/esptool/issues/926
CVE ID: CVE-2023-46906 State: PUBLISHED Published: 2024-01-09T00:00:00.000Z Last Updated: 2025-04-17T18:03:19.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: juzaweb <= 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. The payload in the timezone field was not correctly validated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/juzaweb/cms - https://www.sumor.top/index.php/archives/880/
CVE ID: CVE-2023-46911 State: PUBLISHED Published: 2023-11-01T00:00:00 Last Updated: 2024-09-12T19:48:27.724Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a Cross Site Scripting (XSS) vulnerability in the choose_style_tree.do interface of Jspxcms v10.2.0 backend. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/jspxcms/Jspxcms/issues/I8AK2H
CVE ID: CVE-2023-46914 State: PUBLISHED Published: 2024-02-07T00:00:00 Last Updated: 2024-08-19T20:10:40.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in RM bookingcalendar module for PrestaShop versions 2.7.9 and before, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via ics_export.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2024/02/06/bookingcalendar.html
CVE ID: CVE-2023-46916 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-10-10T17:43:20.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: Maxima Max Pro Power 1.0 486A devices allow BLE traffic replay. An attacker can use GATT characteristic handle 0x0012 to perform potentially disruptive actions such as starting a Heart Rate monitor. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.maximawatches.com/products/max-pro-power - http://packetstormsecurity.com/files/175660
CVE ID: CVE-2023-46918 State: PUBLISHED Published: 2023-12-27T00:00:00 Last Updated: 2024-08-02T21:01:21.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phlox com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus has an Android manifest file that contains an entry with the android:allowBackup attribute set to true. This could be leveraged by an attacker with physical access to the device. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/actuator/com.phlox.simpleserver/blob/main/CWE-321.md
CVE ID: CVE-2023-46919 State: PUBLISHED Published: 2023-12-27T00:00:00 Last Updated: 2024-11-26T14:50:31.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phlox com.phlox.simpleserver (aka Simple HTTP Server) 1.8 and com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus have a hardcoded aKySWb2jjrr4dzkYXczKRt7K (AES) encryption key. An attacker with physical access to the application's source code or binary can extract this key & use it decrypt the TLS secret. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/actuator/com.phlox.simpleserver/blob/main/CWE-321.md
CVE ID: CVE-2023-46925 State: PUBLISHED Published: 2023-11-02T00:00:00 Last Updated: 2024-09-05T19:17:01.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reportico 7.1.21 is vulnerable to Cross Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/reportico-web/reportico/issues/47
CVE ID: CVE-2023-46927 State: PUBLISHED Published: 2023-11-01T00:00:00 Last Updated: 2024-09-12T18:05:53.928Z Vendors: n/a Products: n/a Problem Types: n/a Description: GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in gf_isom_use_compact_size gpac/src/isomedia/isom_write.c:3403:3 in gpac/MP4Box. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gpac/gpac/issues/2657 - https://github.com/gpac/gpac/commit/a7b467b151d9b54badbc4dd71e7a366b7c391817
CVE ID: CVE-2023-46928 State: PUBLISHED Published: 2023-11-01T00:00:00 Last Updated: 2024-09-06T18:11:01.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_media_change_pl /afltest/gpac/src/media_tools/isom_tools.c:3293:42. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gpac/gpac/issues/2661 - https://github.com/gpac/gpac/commit/0753bf6d867343a80a044bf47a27d0b7accc8bf1
CVE ID: CVE-2023-46929 State: PUBLISHED Published: 2024-01-03T00:00:00.000Z Last Updated: 2025-06-18T15:28:43.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gf_avc_change_vui /afltest/gpac/src/media_tools/av_parsers.c:6872:55 allows attackers to crash the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gpac/gpac/issues/2662 - https://github.com/gpac/gpac/commit/4248def5d24325aeb0e35cacde3d56c9411816a6
CVE ID: CVE-2023-46930 State: PUBLISHED Published: 2023-11-01T00:00:00 Last Updated: 2024-09-06T18:11:13.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_isom_find_od_id_for_track /afltest/gpac/src/isomedia/media_odf.c:522:14. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gpac/gpac/issues/2666 - https://github.com/gpac/gpac/commit/3809955065afa3da1ad580012ec43deadbb0f2c8
CVE ID: CVE-2023-46931 State: PUBLISHED Published: 2023-11-01T00:00:00 Last Updated: 2024-09-06T18:11:21.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in ffdmx_parse_side_data /afltest/gpac/src/filters/ff_dmx.c:202:14 in gpac/MP4Box. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gpac/gpac/issues/2664 - https://github.com/gpac/gpac/commit/671976fccc971b3dff8d3dcf6ebd600472ca64bf.
CVE ID: CVE-2023-46932 State: PUBLISHED Published: 2023-12-09T00:00:00.000Z Last Updated: 2025-05-27T15:12:59.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows attackers to execute arbitrary code and cause a denial of service (DoS) via str2ulong class in src/media_tools/avilib.c in gpac/MP4Box. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gpac/gpac/issues/2669
CVE ID: CVE-2023-46935 State: PUBLISHED Published: 2023-11-21T00:00:00 Last Updated: 2024-08-10T15:36:45.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: eyoucms v1.6.4 is vulnerable Cross Site Scripting (XSS), which can lead to stealing sensitive information of logged-in users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/weng-xianhu/eyoucms/issues/55
CVE ID: CVE-2023-46942 State: PUBLISHED Published: 2024-01-13T00:00:00.000Z Last Updated: 2025-06-03T14:03:22.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://devhub.checkmarx.com/cve-details/Cx00cea2d5-d2c5/ - https://devhub.checkmarx.com/cve-details/CVE-2023-46942/ - https://advisory.checkmarx.net/advisory/CVE-2023-46942
CVE ID: CVE-2023-46943 State: PUBLISHED Published: 2024-01-13T00:00:00 Last Updated: 2024-08-30T19:08:51.910Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://devhub.checkmarx.com/cve-details/CVE-2023-46943/ - https://advisory.checkm
CISA ADP Vulnrichment: References: - https://devhub.checkmarx.com/cve-details/CVE-2023-46943/ - https://advisory.checkmarx.net/advisory/CVE-2023-46943/
CVE ID: CVE-2023-46944 State: PUBLISHED Published: 2023-11-28T00:00:00 Last Updated: 2024-08-02T21:01:22.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in GitKraken GitLens before v.14.0.0 allows an attacker to execute arbitrary code via a crafted file to the Visual Studio Codes workspace trust component. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gitkraken/vscode-gitlens/commit/ee2a0c42a92d33059a39fd15fbbd5dd3d5ab6440 - https://www.sonarsource.com/blog/vscode-security-markdown-vulnerabilities-in-extensions/
CVE ID: CVE-2023-46947 State: PUBLISHED Published: 2023-11-03T00:00:00 Last Updated: 2024-09-06T16:04:38.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: Subrion 4.2.1 has a remote command execution vulnerability in the backend. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/intelliants/subrion/issues/909
CVE ID: CVE-2023-46948 State: PUBLISHED Published: 2024-09-23T00:00:00 Last Updated: 2024-09-23T17:44:19.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected Cross-Site Scripting (XSS) vulnerability was found on Temenos T24 Browser R19.40 that enables a remote attacker to execute arbitrary JavaScript code via the skin parameter in the about.jsp and genrequest.jsp components. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://temenos.com - https://github.com/AzraelsBlade/CVE-2023-46948
CVE ID: CVE-2023-46950 State: PUBLISHED Published: 2024-03-01T00:00:00 Last Updated: 2024-09-16T19:57:04.342263 Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted URL to the filter functions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mhenrixon/sidekiq-unique-jobs/security/advisories/GHSA-cmh9-rx85-xj38 - https://github.com/mhenrixon/sidekiq-unique-jobs/releases/tag/v8.0.7 - https://www.mgm-sp.com/cve/sidekiq-unique-jobs-reflected-xss-cve-2023-46950-cve-2023-46951 - https://github.com/
8.0.7 - https://www.mgm-sp.com/cve/sidekiq-unique-jobs-reflected-xss-cve-2023-46950-cve-2023-46951 - https://github.com/mhenrixon/sidekiq-unique-jobs/pull/829
CVE ID: CVE-2023-46951 State: PUBLISHED Published: 2024-03-01T00:00:00.000Z Last Updated: 2025-04-22T15:45:39.488Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted payload to the uniquejobs function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.link.com - https://link.org - https://github.com/mhenrixon/sidekiq-unique-jobs/security/advisories/GHSA-cmh9-rx85-xj38 - https://github.com/mhenrixon/sidekiq-unique-jobs/releases/tag/v8.0.7 - https://www.mgm-sp.com/cve/sidekiq-unique-jobs-reflected-xss
hub.com/mhenrixon/sidekiq-unique-jobs/releases/tag/v8.0.7 - https://www.mgm-sp.com/cve/sidekiq-unique-jobs-reflected-xss-cve-2023-46950-cve-2023-46951 - https://github.com/mhenrixon/sidekiq-unique-jobs/pull/829
CVE ID: CVE-2023-46952 State: PUBLISHED Published: 2024-01-17T00:00:00.000Z Last Updated: 2025-06-02T15:06:53.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in ABO.CMS v.5.9.3 allows an attacker to execute arbitrary code via a crafted payload to the Referer header. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://abo.com - http://abocms.com - https://github.com/SadFox/ABO.CMS-Blind-XSS
CVE ID: CVE-2023-46953 State: PUBLISHED Published: 2024-01-06T00:00:00.000Z Last Updated: 2025-06-17T14:35:49.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in ABO.CMS v.5.9.3, allows remote attackers to execute arbitrary code via the d parameter in the Documents module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cxsecurity.com/issue/WLB-2023120036
CVE ID: CVE-2023-46954 State: PUBLISHED Published: 2023-11-03T00:00:00 Last Updated: 2024-09-06T16:16:47.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Relativity ODA LLC RelativityOne v.12.1.537.3 Patch 2 and earlier allows a remote attacker to execute arbitrary code via the name parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jakedmurphy1/CVE-2023-46954