Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-36656 State: PUBLISHED Published: 2023-07-17T00:00:00 Last Updated: 2024-10-30T15:29:38.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Jaegertracing Jaeger UI before v.1.31.0 allows a remote attacker to execute arbitrary code via the KeyValuesTable component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jaegertracing/jaeger-ui/pull/1498 - https://github.com/mafintosh/json-markup/pull/15 - https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r
CVE ID: CVE-2023-36657 State: PUBLISHED Published: 2023-09-15T00:00:00 Last Updated: 2024-09-25T18:14:33.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Built-in features of Windows (desktop shortcuts, narrator) can be abused for privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.opswat.com/mdkiosk - https://docs.opswat.com/mdkiosk/release-notes/cve-2023-36657
CVE ID: CVE-2023-36658 State: PUBLISHED Published: 2023-09-15T00:00:00 Last Updated: 2024-09-25T18:13:58.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. It has an unquoted service path that can be abused locally. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.opswat.com/mdkiosk - https://docs.opswat.com/mdkiosk/release-notes/cve-2023-36658
CVE ID: CVE-2023-36659 State: PUBLISHED Published: 2023-09-15T00:00:00 Last Updated: 2024-09-25T18:11:39.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Long inputs were not properly processed, which allows remote attackers to cause a denial of service (loss of communication). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.opswat.com/mdkiosk - https://docs.opswat.com/mdkiosk/release-notes/cve-2023-36659
CVE ID: CVE-2023-36660 State: PUBLISHED Published: 2023-06-25T00:00:00 Last Updated: 2024-08-02T16:52:54.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1212112 - https://git.lysator.liu.se/nettle/nettle/-/commit/867a4548b95705291a3afdd66d76e7f17ba2618f - https://git.lysator.liu.se/nettle/nettle/-/compare/nettle_3.9_release_20230514...nettle_3.9.1_release_20230601 - https://security.gentoo.org/glsa/202401-24
CVE ID: CVE-2023-36661 State: PUBLISHED Published: 2023-06-25T00:00:00.000Z Last Updated: 2025-05-05T15:56:49.910Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.debian.org/security/2023/dsa-5432 - https://shibboleth.net/community/advisories/secadv_20230612.txt
CVE ID: CVE-2023-36662 State: PUBLISHED Published: 2023-06-26T00:00:00 Last Updated: 2024-12-03T18:50:55.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. This affects User Management for Jira 2.0.0 through 2.17.1, User Management for Confluence 2.0.0 through 2.15.24, and User Management for Bitbucket 2.2.2 through 2.15.24. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://techtime.co.nz/display/TECHTIME/Security+Vulnerability+Affecting+User+Management
CVE ID: CVE-2023-36663 State: PUBLISHED Published: 2023-06-25T00:00:00 Last Updated: 2024-12-05T15:00:13.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: it-novum openITCOCKPIT (aka open IT COCKPIT) 4.6.4 before 4.6.5 allows SQL Injection (by authenticated users) via the sort parameter of the API interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/it-novum/openITCOCKPIT/pull/1519/files - https://openitcockpit.io/2023/2023/06/13/openitcockpit-4-6-5-released-security-update/
CVE ID: CVE-2023-36664 State: PUBLISHED Published: 2023-06-25T00:00:00 Last Updated: 2024-12-05T14:54:10.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.ghostscript.com/show_bug.cgi?id=706761 - https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=505eab7782b429017eb434b2b95120855f2b0e3c - https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=0974e4f2ac0005d3731e0b5c13ebc7e965540f4d - https://www.debian.org/security/2023/dsa
t.com/?p=ghostpdl.git%3Ba=commit%3Bh=0974e4f2ac0005d3731e0b5c13ebc7e965540f4d - https://www.debian.org/security/2023/dsa-5446 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5EWMEK2UPCUU3ZLL7VASE5CEHDQY4VKV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ICXN5VPF3WJCYKMPSYER5KHTPJXSTJZ/ - https://security.gentoo.org/glsa/202309-03
CVE ID: CVE-2023-36665 State: PUBLISHED Published: 2023-07-05T00:00:00 Last Updated: 2024-08-02T16:52:54.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: "protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption a
s by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.2.3...protobufjs-v7.2.4 - https://github.com/protobufjs/protobuf.js/commit/e66379f451b0393c27d87b37fa7d271619e16b0d - https://www.code-intelligence.com/blog/cve-protobufjs-prototype-pollution-cve-2023-36665 - https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.2.4 - https://github.com/protobufjs/protobuf.js/pull/1899 - https://security.netapp.com/advisory/ntap-20240628-0006/
CVE ID: CVE-2023-36666 State: PUBLISHED Published: 2023-06-25T00:00:00 Last Updated: 2024-12-05T14:50:57.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: INEX IXP-Manager before 6.3.1 allows XSS. list-preamble.foil.php, page-header-preamble.foil.php, edit-form.foil.php, page-header-preamble.foil.php, overview.foil.php, cust.foil.php, and view.foil.php may be affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/inex/IXP-Manager/commit/fddbc38adb477c9cd46a462655ffed96d3d42229 - https://github.com/inex/IXP-Manager/compare/v6.3.0...v6.3.1
CVE ID: CVE-2023-36667 State: PUBLISHED Published: 2023-11-08T00:00:00 Last Updated: 2024-09-04T19:01:42.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.couchbase.com/server/current/release-notes/relnotes.html - https://www.couchbase.com/alerts/
CVE ID: CVE-2023-36669 State: PUBLISHED Published: 2023-07-18T00:00:00 Last Updated: 2024-10-28T18:19:59.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: Missing Authentication for a Critical Function within the Kratos NGC Indoor Unit (IDU) before 11.4 allows remote attackers to obtain arbitrary control of the IDU/ODU system. Any attacker with layer-3 network access to the IDU can impersonate the Touch Panel Unit (TPU) within the IDU by sending crafted TCP requests to the IDU. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kratosdefense.com - https://www.kratosdefense.com/vulnerability-advisories/cve-2023-36669
CVE ID: CVE-2023-36670 State: PUBLISHED Published: 2023-07-18T00:00:00 Last Updated: 2024-10-28T16:48:47.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remotely exploitable command injection vulnerability was found on the Kratos NGC-IDU 9.1.0.4. An attacker can execute arbitrary Linux commands as root by sending crafted TCP requests to the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kratosdefense.com - https://www.kratosdefense.com/vulnerability-advisories/cve-2023-36670
CVE ID: CVE-2023-36671 State: PUBLISHED Published: 2023-08-09T00:00:00 Last Updated: 2024-10-17T14:19:08.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS. The VPN client insecurely configures the operating system such that all IP traffic to the VPN server's IP address is sent in plaintext outside the VPN tunnel even if this traffic is not generated by the VPN client. This allows an adversary to trick the victim into sending plaintext traffic to the VPN server's IP address and thereby deanonymize the victim. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "Se
y deanonymize the victim. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "ServerIP attack for only traffic to the real IP address of the VPN server" rather than to only Clario. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://clario.co/vpn-for-mac/ - https://tunnelcrack.mathyvanhoef.com/details.html - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0015
CVE ID: CVE-2023-36672 State: PUBLISHED Published: 2023-08-09T00:00:00 Last Updated: 2024-10-17T14:17:02.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS. The VPN client insecurely configures the operating system such that traffic to the local network is sent in plaintext outside the VPN tunnel even if the local network is using a non-RFC1918 IP subnet. This allows an adversary to trick the victim into sending arbitrary IP traffic in plaintext outside the VPN tunnel. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "LocalNet attack resulting in leakage of tra
lcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "LocalNet attack resulting in leakage of traffic in plaintext" rather than to only Clario. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://clario.co/vpn-for-mac/ - https://tunnelcrack.mathyvanhoef.com/details.html - https://mullvad.net/de/blog/2023/8/9/response-to-tunnelcrack-vulnerability-disclosure/ - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0015
CVE ID: CVE-2023-36673 State: PUBLISHED Published: 2023-08-09T00:00:00 Last Updated: 2024-10-10T18:37:35.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS. The VPN client insecurely configures the operating system such that all IP traffic to the VPN server's IP address is sent in plaintext outside the VPN tunnel, even if this traffic is not generated by the VPN client, while simultaneously using plaintext DNS to look up the VPN server's IP address. This allows an adversary to trick the victim into sending traffic to arbitrary IP addresses in plaintext outside the VPN tunnel. NOTE: the tunnelcrack.mathyvanhoef
m into sending traffic to arbitrary IP addresses in plaintext outside the VPN tunnel. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "ServerIP attack, combined with DNS spoofing, that can leak traffic to an arbitrary IP address" rather than to only Avira Phantom VPN. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.avira.com/en/free-vpn - https://tunnelcrack.mathyvanhoef.com/details.html - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0015
CVE ID: CVE-2023-36674 State: PUBLISHED Published: 2023-08-20T00:00:00 Last Updated: 2024-10-08T14:27:38.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T335612 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOAXEGYBOEM4JWB4J3BDH73NK2LCYC3O/ - h
fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOAXEGYBOEM4JWB4J3BDH73NK2LCYC3O/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UIVGYECQGTUC2LLPVCZBPDLCTOHL2F6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CHRX6DSLAMVXCV2YMJEWOLTBEYSESE5/
CVE ID: CVE-2023-36675 State: PUBLISHED Published: 2023-06-26T00:00:00 Last Updated: 2024-12-05T15:25:03.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T332889 - https://www.mediawiki.org/wiki/Release_notes/1.40#Other_changes_in_1.40 - https://www.debian.org/security/2023/dsa-5447 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fed
tps://www.debian.org/security/2023/dsa-5447 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOAXEGYBOEM4JWB4J3BDH73NK2LCYC3O/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UIVGYECQGTUC2LLPVCZBPDLCTOHL2F6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CHRX6DSLAMVXCV2YMJEWOLTBEYSESE5/
CVE ID: CVE-2023-36676 State: PUBLISHED Published: 2024-06-19T13:52:41.584Z Last Updated: 2024-08-02T16:52:54.300Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Brainstorm Force Products: Spectra Problem Types: CWE-862 Description: Missing Authorization vulnerability in Brainstorm Force Spectra.This issue affects Spectra: from n/a through 2.6.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ultimate-addons-for-gutenberg/wordpress-spectra-plugin-2-6-6-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-36677 State: PUBLISHED Published: 2023-11-03T22:59:09.373Z Last Updated: 2024-09-05T19:43:11.522Z Vendors: Smartypants Products: SP Project & Document Manager Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager allows SQL Injection.This issue affects SP Project & Document Manager: from n/a through 4.67. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/sp-client-document-manager/wordpress-sp-project-document-manager-plugin-4-67-sql-injection?_s_id=cve
CVE ID: CVE-2023-36678 State: PUBLISHED Published: 2023-08-05T22:46:27.881Z Last Updated: 2025-02-19T21:27:33.584Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: WP-buy Products: WP Content Copy Protection & No Right Click Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP-buy WP Content Copy Protection & No Right Click plugin <= 3.5.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-content-copy-protector/wordpress-wp-content-copy-protection-no-right-click-plugin-3-5-5-cross-site-scripting-xss-vulnerabilit
nt-copy-protector/wordpress-wp-content-copy-protection-no-right-click-plugin-3-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-36679 State: PUBLISHED Published: 2024-03-28T05:58:25.636Z Last Updated: 2024-08-02T16:52:54.310Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: Brainstorm Force Products: Spectra Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Spectra.This issue affects Spectra: from n/a through 2.6.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ultimate-addons-for-gutenberg/wordpress-spectra-plugin-2-6-6-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-36680 State: PUBLISHED Published: 2024-12-13T14:23:47.368Z Last Updated: 2024-12-13T18:36:17.074Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Iulia Cazan Products: Image Regenerate & Select Crop Problem Types: CWE-862 Description: Missing Authorization vulnerability in Iulia Cazan Image Regenerate & Select Crop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Regenerate & Select Crop: from n/a through 7.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/image-regenerate-select-crop/vulnerability/wordpress-image-regenerate-s
https://patchstack.com/database/wordpress/plugin/image-regenerate-select-crop/vulnerability/wordpress-image-regenerate-select-crop-plugin-7-1-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-36681 State: PUBLISHED Published: 2024-12-13T14:23:48.283Z Last Updated: 2024-12-13T18:34:32.340Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Cool Plugins Products: Cryptocurrency Widgets – Price Ticker & Coins List Problem Types: CWE-862 Description: Missing Authorization vulnerability in Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins List allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Widgets – Price Ticker & Coins List: from n/a through 2.6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cryptocur
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cryptocurrency-price-ticker-widget/vulnerability/wordpress-cryptocurrency-widgets-price-ticker-coins-list-plugin-2-6-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-36682 State: PUBLISHED Published: 2023-11-30T13:47:22.775Z Last Updated: 2024-08-02T16:52:54.125Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) Vendors: Brainstorm Force US LLC Products: Schema Pro Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force US LLC Schema Pro allows Cross Site Request Forgery.This issue affects Schema Pro: from n/a through 2.7.7. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-schema-pro/wordpress-schema-pro-plugin-2-7-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-36683 State: PUBLISHED Published: 2024-06-19T13:51:27.383Z Last Updated: 2024-08-02T16:52:54.157Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: WP SCHEMA PRO Products: Schema Pro Problem Types: CWE-862 Description: Missing Authorization vulnerability in WP SCHEMA PRO Schema Pro.This issue affects Schema Pro: from n/a through 2.7.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-schema-pro/wordpress-schema-pro-plugin-2-7-8-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-36684 State: PUBLISHED Published: 2024-06-19T13:50:18.627Z Last Updated: 2024-08-02T16:52:54.045Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N) Vendors: Brainstorm Force Products: Convert Pro Problem Types: CWE-862 Description: Missing Authorization vulnerability in Brainstorm Force Convert Pro.This issue affects Convert Pro: from n/a through 1.7.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/convertpro/wordpress-convert-pro-plugin-1-7-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-36685 State: PUBLISHED Published: 2023-11-30T13:41:04.665Z Last Updated: 2024-08-02T16:52:54.153Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Brainstorm Force US LLC Products: CartFlows Pro Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force US LLC CartFlows Pro allows Cross Site Request Forgery.This issue affects CartFlows Pro: from n/a through 1.11.12. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/cartflows-pro/wordpress-cartflows-pro-plugin-1-11-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-36686 State: PUBLISHED Published: 2023-08-05T22:28:54.793Z Last Updated: 2024-09-25T16:56:42.821Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: CartFlows Products: CartFlows Pro Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CartFlows Pro plugin <= 1.11.11 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/cartflows-pro/wordpress-cartflows-pro-plugin-1-11-11-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-36687 State: PUBLISHED Published: 2023-07-11T10:01:33.074Z Last Updated: 2024-10-11T15:05:02.435Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Andrea Tarantini Products: Menubar Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Andrea Tarantini Menubar plugin <= 5.8.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/menubar/wordpress-menubar-plugin-5-8-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-36688 State: PUBLISHED Published: 2023-11-09T15:58:52.421Z Last Updated: 2024-08-02T16:52:54.206Z Vendors: Michael Mann Products: Simple Site Verify Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Mann Simple Site Verify plugin <= 1.0.7 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/simple-site-verify/wordpress-simple-site-verify-plugin-1-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve