Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-28770 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-31T18:42:32.309Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Zyxel Products: DX5401-B0 firmware Problem Types: CWE-200 Description: The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to read the system files and to retrieve the password of the supervisor from the encrypted file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/secu
lyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities - http://packetstormsecurity.com/files/172277/Zyxel-Chained-Remote-Code-Execution.html
CVE ID: CVE-2023-28771 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-10-21T23:05:48.400Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: ZyWALL/USG series firmware, VPN series firmware, USG FLEX series firmware, ATP series firmware Problem Types: CWE-78 Description: Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted pack
through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls - http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html
CVE ID: CVE-2023-28772 State: PUBLISHED Published: 2023-03-23T00:00:00.000Z Last Updated: 2025-05-05T16:02:12.798Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.3 - https://github.com/torvalds/linux/commit/d3b16034a24a112bb83aeb669ac5b9b01f744bb7 - https://lore.kernel.org/lkml/20210625122453.5e2fe304%40oasis.local.home/ - https://lkml.kernel.org/r/20210626032156.47889-1-yun.zhou%40windriver.com - https://security.netap
40oasis.local.home/ - https://lkml.kernel.org/r/20210626032156.47889-1-yun.zhou%40windriver.com - https://security.netapp.com/advisory/ntap-20230427-0005/
CVE ID: CVE-2023-28773 State: PUBLISHED Published: 2023-08-08T12:14:56.889Z Last Updated: 2024-08-02T14:48:48.411Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Kolja Nolte Products: Secondary Title Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kolja Nolte Secondary Title plugin <= 2.0.9.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/secondary-title/wordpress-secondary-title-plugin-2-0-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28774 State: PUBLISHED Published: 2023-06-22T12:25:23.663Z Last Updated: 2024-10-10T17:21:07.357Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Grade Us, Inc. Products: Review Stream Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Grade Us, Inc. Review Stream plugin <= 1.6.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/review-stream/wordpress-review-stream-plugin-1-6-5-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-28775 State: PUBLISHED Published: 2024-06-11T09:16:19.210Z Last Updated: 2024-08-02T13:51:38.271Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Yoast Products: Yoast SEO Premium Problem Types: CWE-862 Description: Missing Authorization vulnerability in Yoast Yoast SEO Premium.This issue affects Yoast SEO Premium: from n/a through 20.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wordpress-seo-premium/wordpress-yoast-seo-premium-plugin-20-4-unauthenticated-zapier-api-key-reset-vulnerability?_s_id=cve
CVE ID: CVE-2023-28776 State: PUBLISHED Published: 2023-06-22T11:29:43.390Z Last Updated: 2024-10-10T17:24:29.203Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: I Thirteen Web Solution Products: Continuous Image Carousel With Lightbox Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Continuous Image Carousel With Lightbox plugin <= 1.0.15 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/continuous-image-carousel-with-lightbox/wordpress-continuous-image-carousel-with-lightbox-plugin-1-0-15-ref
ulnerability/continuous-image-carousel-with-lightbox/wordpress-continuous-image-carousel-with-lightbox-plugin-1-0-15-reflected-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE ID: CVE-2023-28777 State: PUBLISHED Published: 2023-10-31T13:58:37.076Z Last Updated: 2024-09-06T18:00:41.434Z Vendors: LearnDash Products: LearnDash LMS Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LearnDash LearnDash LMS allows SQL Injection.This issue affects LearnDash LMS: from n/a through 4.5.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/sfwd-lms/wordpress-learndash-lms-plugin-4-5-3-contributor-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-28778 State: PUBLISHED Published: 2023-06-22T11:34:12.044Z Last Updated: 2024-10-10T17:24:13.199Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: BestWebSoft Products: Pagination Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BestWebSoft Pagination plugin <= 1.2.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/pagination/wordpress-pagination-by-bestwebsoft-1-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28779 State: PUBLISHED Published: 2023-08-10T12:57:15.720Z Last Updated: 2024-09-25T15:02:46.606Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Vladimir Statsenko Products: Terms descriptions Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Vladimir Statsenko Terms descriptions plugin <= 3.4.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/terms-descriptions/wordpress-terms-descriptions-plugin-3-4-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28780 State: PUBLISHED Published: 2023-11-18T22:45:05.817Z Last Updated: 2024-08-02T13:51:38.209Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Yoast Products: Yoast Local Premium Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Yoast Yoast Local Premium.This issue affects Yoast Local Premium: from n/a through 14.8. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wpseo-local/wordpress-yoast-seo-local-plugin-14-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-28781 State: PUBLISHED Published: 2023-04-07T14:08:39.607Z Last Updated: 2025-02-19T21:33:53.457Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Cimatti Consulting Products: WordPress Contact Forms by Cimatti Problem Types: CWE-79 Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.5.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/contact-forms/wordpress-contact-forms-by-cimatti-plugin-1-5-4-unauth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28782 State: PUBLISHED Published: 2023-12-20T14:46:58.105Z Last Updated: 2024-08-02T13:51:38.948Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Rocketgenius Inc. Products: Gravity Forms Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Rocketgenius Inc. Gravity Forms.This issue affects Gravity Forms: from n/a through 2.7.3. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/gravityforms/wordpress-gravity-forms-plugin-2-7-3-unauthenticated-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-28783 State: PUBLISHED Published: 2023-08-17T14:50:26.842Z Last Updated: 2024-09-25T14:48:58.806Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: PHPRADAR Products: Woocommerce Tip/Donation Problem Types: CWE-79 Description: Auth. (shop manager+) Stored Cross-Site Scripting (XSS) vulnerability in PHPRADAR Woocommerce Tip/Donation plugin <= 1.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woo-tipdonation/wordpress-woocommerce-tip-donation-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28784 State: PUBLISHED Published: 2023-06-22T11:21:07.805Z Last Updated: 2024-08-02T14:48:16.813Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Contest Gallery Products: Contest Gallery Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <= 21.1.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/contest-gallery/wordpress-contest-gallery-plugin-21-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28785 State: PUBLISHED Published: 2023-05-28T18:47:17.763Z Last Updated: 2024-10-10T18:56:56.048Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Yoast Products: Yoast SEO: Local Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.9 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wpseo-local/wordpress-yoast-seo-local-plugin-14-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28786 State: PUBLISHED Published: 2023-12-29T09:46:31.612Z Last Updated: 2024-08-27T14:58:06.254Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: SolidWP Products: Solid Security – Password, Two Factor Authentication, and Brute Force Protection Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SolidWP Solid Security – Password, Two Factor Authentication, and Brute Force Protection.This issue affects Solid Security – Password, Two Factor Authentication, and Brute Force Protection: from n/a through 8.1.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
ection: from n/a through 8.1.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/better-wp-security/wordpress-ithemes-security-plugin-8-1-4-open-redirection-via-host-header-vulnerability?_s_id=cve
CVE ID: CVE-2023-28787 State: PUBLISHED Published: 2024-03-26T20:24:27.535Z Last Updated: 2024-08-06T15:16:34.491Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: ExpressTech Products: Quiz And Survey Master Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-8-1-4-unauthenticated-sq
/patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-8-1-4-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-28788 State: PUBLISHED Published: 2023-12-20T17:19:51.573Z Last Updated: 2024-08-02T13:51:38.508Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: Page Visit Counter Products: Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress.This issue affects Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress: from n/a through 6.4.2. Additional Analyst Notes: - CVE Program Container: Refere
Wanted Analytics Plugin for WordPress: from n/a through 6.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/advanced-page-visit-counter/wordpress-advanced-page-visit-counter-plugin-6-4-2-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-28789 State: PUBLISHED Published: 2023-04-07T14:12:32.469Z Last Updated: 2025-02-19T21:33:41.181Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Cimatti Consulting Products: WordPress Contact Forms by Cimatti Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.5.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/contact-forms/wordpress-contact-forms-by-cimatti-plugin-1-5-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28790 State: PUBLISHED Published: 2023-09-27T05:14:37.752Z Last Updated: 2024-09-23T13:29:43.962Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Brett Shumaker Products: Simple Staff List Problem Types: CWE-79 Description: Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Brett Shumaker Simple Staff List plugin <= 2.2.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/simple-staff-list/wordpress-simple-staff-list-plugin-2-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28791 State: PUBLISHED Published: 2023-10-06T13:01:43.555Z Last Updated: 2024-09-19T14:47:07.689Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Gangesh Matta Products: Simple Org Chart Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Gangesh Matta Simple Org Chart plugin <= 2.3.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/simple-org-chart/wordpress-simple-org-chart-plugin-2-3-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-28792 State: PUBLISHED Published: 2023-04-07T14:00:46.304Z Last Updated: 2025-01-10T18:56:24.230Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: I Thirteen Web Solution Products: Continuous Image Carousel With Lightbox Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Continuous Image Carousel With Lightbox plugin <= 1.0.15 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/continuous-image-carousel-with-lightbox/wordpress-continuous-image-carousel-with-lightbox-plugin-1-0-15-ref
ulnerability/continuous-image-carousel-with-lightbox/wordpress-continuous-image-carousel-with-lightbox-plugin-1-0-15-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28793 State: PUBLISHED Published: 2023-10-23T13:26:08.391Z Last Updated: 2025-02-27T20:39:54.588Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Zscaler Products: Client Connector Problem Types: CWE-94 Description: Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.3.1&deployment_date=2022-
ector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.3.1&deployment_date=2022-09-19
CVE ID: CVE-2023-28794 State: PUBLISHED Published: 2023-11-06T07:19:25.606Z Last Updated: 2024-09-05T13:57:13.283Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Zscaler Products: Client Connector Problem Types: CWE-346 Description: Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.3.1&deployment_date=2022-09-19
CVE ID: CVE-2023-28795 State: PUBLISHED Published: 2023-10-23T13:27:24.262Z Last Updated: 2025-02-27T20:39:47.550Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Zscaler Products: Client Connector Problem Types: CWE-346 Description: Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.3.1&deployment_date=2
connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.3.1&deployment_date=2022-09-19
CVE ID: CVE-2023-28796 State: PUBLISHED Published: 2023-10-23T13:28:15.790Z Last Updated: 2025-02-27T20:39:40.997Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Zscaler Products: Client Connector Problem Types: CWE-94 Description: Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.3.1&deployment_date=
-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.3.1&deployment_date=2022-09-19
CVE ID: CVE-2023-28797 State: PUBLISHED Published: 2023-10-23T13:30:38.191Z Last Updated: 2025-02-27T20:39:34.731Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: Zscaler Products: Client Connector Problem Types: CWE-59 Description: Zscaler Client Connector for Windows before 4.1 writes/deletes a configuration file inside specific folders on the disk. A malicious user can replace the folder and execute code as a privileged user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022
CVE ID: CVE-2023-28798 State: PUBLISHED Published: 2024-05-02T13:10:31.933Z Last Updated: 2024-08-02T13:51:38.162Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Zscaler Products: Client Connector Problem Types: CWE-122 Description: An out-of-bounds write to heap in the pacparser library on Zscaler Client Connector on Mac may lead to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=macOS&applicable_version=3.7&deployment_date=2022-08-19&id=1414851
CVE ID: CVE-2023-28799 State: PUBLISHED Published: 2023-06-22T19:06:24.943Z Last Updated: 2024-12-05T17:43:58.739Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: Zscaler Products: Client Connector Problem Types: CWE-1287 Description: A URL parameter during login flow was vulnerable to injection. An attacker could insert a malicious domain in this parameter, which would redirect the user after auth and send the authorization token to the redirected domain. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021?applicable_category=Windo
- https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021?applicable_category=Windows&applicable_version=3.7&deployment_date=2021-11-26&id=1386541 - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Chrome%20OS&applicable_version=1.10.1&deployment_date=2023-03-10&id=1447771 - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Android&applicable_version=1.10.2&deployment_date=2023-03-09&id=1447706 - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=iOS&applicable_version=1.9.3&deployment_date=2023-
nnector/client-connector-app-release-summary-2023?applicable_category=iOS&applicable_version=1.9.3&deployment_date=2023-03-03&id=1447071 - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.4&deployment_date=2022-10-31&id=1420246 - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=macOS&applicable_version=3.9&deployment_date=2023-01-25&id=1443546
CVE ID: CVE-2023-28800 State: PUBLISHED Published: 2023-06-22T19:15:55.258Z Last Updated: 2024-12-06T15:13:35.280Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Zscaler Products: Client Connector Problem Types: CWE-79 Description: When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021?applicable_category=Windows&applicable_version=3.7&deployment_date=2021-11-26&id=1386541 - https://help