Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
it.savannah.gnu.org/cgit/cpio.git/commit/?id=376d663340a9dc91c91a5849e5713f07571c1628 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1059163 - https://www.openwall.com/lists/oss-security/2023/12/21/8 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-7207 - http://www.openwall.com/lists/oss-security/2024/01/05/1
CVE ID: CVE-2023-7208 State: PUBLISHED Published: 2024-01-07T07:00:05.477Z Last Updated: 2024-08-02T08:57:34.118Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Totolink Products: X2000R_V2 Problem Types: CWE-120 Description: A vulnerability classified as critical was found in Totolink X2000R_V2 2.0.0-B20230727.10434. This vulnerability affects the function formTmultiAP of the file /bin/boa. The manipulation leads to buffer overflow. VDB-249742 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Ref
sclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.249742 - https://vuldb.com/?ctiid.249742 - https://github.com/unpWn4bL3/iot-security/blob/main/13.md
CVE ID: CVE-2023-7209 State: PUBLISHED Published: 2024-01-07T09:00:06.386Z Last Updated: 2025-06-03T14:40:14.572Z Severity: N/A (CVSS 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C) Vendors: Uniway Products: Router Problem Types: CWE-404 Description: A vulnerability was found in Uniway Router up to 2.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boaform/device_reset.cgi of the component Device Reset Handler. The manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249758 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about th
may be used. VDB-249758 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249758 - https://vuldb.com/?ctiid.249758 - https://drive.google.com/file/d/1XDZA4ibiYNcxTwq60vYCr03_6M_cvJ_2/view?usp=sharing
CVE ID: CVE-2023-7210 State: PUBLISHED Published: 2024-01-07T09:31:03.947Z Last Updated: 2024-11-14T18:09:27.389Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: OneNav Problem Types: CWE-287 Description: A vulnerability was found in OneNav up to 0.9.33. It has been classified as critical. This affects an unknown part of the file /index.php?c=api of the component API. The manipulation of the argument X-Token leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249765 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CI
d. The identifier VDB-249765 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249765 - https://vuldb.com/?ctiid.249765 - https://note.zhaoj.in/share/eRbUygGMiJcp
CVE ID: CVE-2023-7211 State: PUBLISHED Published: 2024-01-07T10:00:05.512Z Last Updated: 2025-06-03T14:40:06.703Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Uniway Products: Router Problem Types: CWE-291 Description: A vulnerability was found in Uniway Router 2.0. It has been declared as critical. This vulnerability affects unknown code of the component Administrative Web Interface. The manipulation leads to reliance on ip address for authentication. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-249766 is the id
exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-249766 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249766 - https://vuldb.com/?ctiid.249766 - https://drive.google.com/file/d/11thSuALGcn0C_9tbmYu8_QzTXtBnCoNS/view?usp=sharing
CVE ID: CVE-2023-7212 State: PUBLISHED Published: 2024-01-07T16:31:03.923Z Last Updated: 2025-06-03T14:39:35.133Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: DeDeCMS Problem Types: CWE-434 Description: A vulnerability classified as critical has been found in DeDeCMS up to 5.7.112. Affected is an unknown function of the file file_class.php of the component Backend. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249768. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Addi
erability is VDB-249768. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249768 - https://vuldb.com/?ctiid.249768 - https://hmxwjm7x03.feishu.cn/docx/FPjhdYcQvocR4gxy34Rc0pmon5e?from=from_copylink
CVE ID: CVE-2023-7213 State: PUBLISHED Published: 2024-01-07T19:00:05.222Z Last Updated: 2025-06-17T20:29:14.441Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Totolink Products: N350RT Problem Types: CWE-121 Description: A vulnerability classified as critical was found in Totolink N350RT 9.3.5u.6139_B20201216. Affected by this vulnerability is the function main of the file /cgi-bin/cstecgi.cgi?action=login&flag=1 of the component HTTP POST Request Handler. The manipulation of the argument v33 leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249769 was assigned to this vu
emotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249769 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249769 - https://vuldb.com/?ctiid.249769 - https://github.com/jylsec/vuldb/blob/main/TOTOLINK/N350RT/2/README.md
CVE ID: CVE-2023-7214 State: PUBLISHED Published: 2024-01-07T20:00:05.250Z Last Updated: 2024-11-14T18:08:23.578Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Totolink Products: N350RT Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, has been found in Totolink N350RT 9.3.5u.6139_B20201216. Affected by this issue is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument v8 leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249770 is the identifier assigned to this vu
remotely. The exploit has been disclosed to the public and may be used. VDB-249770 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249770 - https://vuldb.com/?ctiid.249770 - https://github.com/jylsec/vuldb/blob/main/TOTOLINK/N350RT/3/README.md
CVE ID: CVE-2023-7215 State: PUBLISHED Published: 2024-01-08T01:31:03.607Z Last Updated: 2025-06-03T14:38:51.053Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Chanzhaoyu Products: chatgpt-web Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in Chanzhaoyu chatgpt-web 2.11.1. This issue affects some unknown processing. The manipulation of the argument Description with the input <image src onerror=prompt(document.domain)> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249779. Additional Ana
n disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249779. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249779 - https://vuldb.com/?ctiid.249779 - https://github.com/Chanzhaoyu/chatgpt-web/issues/2001
CVE ID: CVE-2023-7216 State: PUBLISHED Published: 2024-02-05T15:12:17.193Z Last Updated: 2025-11-21T06:23:51.510Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-22 Description: A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially crafted archive. During the extraction process, the archiver could follow symlinks outside of the intended directory, which allows files to be written in arbitrary directories thro
could follow symlinks outside of the intended directory, which allows files to be written in arbitrary directories through symlinks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-7216 - https://bugzilla.redhat.com/show_bug.cgi?id=2249901
CVE ID: CVE-2023-7218 State: PUBLISHED Published: 2024-01-08T21:00:05.100Z Last Updated: 2025-06-17T20:39:14.838Z Severity: N/A (CVSS 8.3 AV:N/AC:L/Au:M/C:C/I:C/A:C) Vendors: Totolink Products: N350RT Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, was found in Totolink N350RT 9.3.5u.6139_B202012. Affected is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to stack-based buffer overflow. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-249852. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes
852. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249852 - https://vuldb.com/?ctiid.249852 - https://github.com/jylsec/vuldb/blob/main/TOTOLINK/N350RT/4/README.md
CVE ID: CVE-2023-7219 State: PUBLISHED Published: 2024-01-09T06:00:06.219Z Last Updated: 2025-06-03T14:33:14.990Z Severity: N/A (CVSS 8.3 AV:N/AC:L/Au:M/C:C/I:C/A:C) Vendors: Totolink Products: N350RT Problem Types: CWE-121 Description: A vulnerability has been found in Totolink N350RT 9.3.5u.6139_B202012 and classified as critical. Affected by this vulnerability is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249853 was assigned to this vulnerability. NOTE: The vendor was contacted e
e public and may be used. The identifier VDB-249853 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249853 - https://vuldb.com/?ctiid.249853 - https://github.com/jylsec/vuldb/blob/main/TOTOLINK/N350RT/5/README.md
CVE ID: CVE-2023-7220 State: PUBLISHED Published: 2024-01-09T07:31:03.195Z Last Updated: 2025-06-17T20:39:18.356Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C) Vendors: Totolink Products: NR1800X Problem Types: CWE-121 Description: A vulnerability was found in Totolink NR1800X 9.1.0u.6279_B20210910 and classified as critical. Affected by this issue is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249854 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about t
d may be used. VDB-249854 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249854 - https://vuldb.com/?ctiid.249854 - https://github.com/jylsec/vuldb/blob/main/TOTOLINK/NR1800X/1/README.md
CVE ID: CVE-2023-7221 State: PUBLISHED Published: 2024-01-09T14:00:05.614Z Last Updated: 2025-05-14T19:09:36.052Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C) Vendors: Totolink Products: T6 Problem Types: CWE-120 Description: A vulnerability was found in Totolink T6 4.1.9cu.5241_B20210923. It has been classified as critical. This affects the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument v41 leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249855. NOTE: The
been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249855. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249855 - https://vuldb.com/?ctiid.249855 - https://github.com/jylsec/vuldb/blob/main/TOTOLINK/T6/1/README.md
CVE ID: CVE-2023-7222 State: PUBLISHED Published: 2024-01-09T15:31:03.585Z Last Updated: 2024-11-14T15:10:44.658Z Severity: N/A (CVSS 8.3 AV:N/AC:L/Au:M/C:C/I:C/A:C) Vendors: Totolink Products: X2000R Problem Types: CWE-120 Description: A vulnerability was found in Totolink X2000R 1.0.0-B20221212.1452. It has been declared as critical. This vulnerability affects the function formTmultiAP of the file /bin/boa of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249856. NOTE: The vendor was c
been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249856. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249856 - https://vuldb.com/?ctiid.249856 - https://github.com/jylsec/vuldb/blob/main/TOTOLINK/X2000R/formTmultiAP/README.md
CVE ID: CVE-2023-7223 State: PUBLISHED Published: 2024-01-09T15:31:04.597Z Last Updated: 2025-06-17T20:39:18.514Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Totolink Products: T6 Problem Types: CWE-284 Description: A vulnerability classified as problematic has been found in Totolink T6 4.1.9cu.5241_B20210923. This affects an unknown part of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input showSyslog leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249867. NOTE: The v
been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249867. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249867 - https://vuldb.com/?ctiid.249867 - https://drive.google.com/file/d/1puSOo5XrzMrctw7EtrE7DnfssOOuhRTS/view?usp=sharing
CVE ID: CVE-2023-7224 State: PUBLISHED Published: 2024-01-08T13:55:20.160Z Last Updated: 2024-09-04T19:13:07.440Z Vendors: OpenVPN Products: OpenVPN Connect Problem Types: CWE-95 Description: OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSERT_LIBRARIES environment variable Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log/
CVE ID: CVE-2023-7225 State: PUBLISHED Published: 2024-01-30T07:34:38.783Z Last Updated: 2025-06-17T21:29:18.118Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: chrisvrichardson Products: MapPress Maps for WordPress Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the width and height parameters in all versions up to, and including, 2.88.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject
on and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fce76126-0cfd-464f-b644-45d4301e958d?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3023266%40mappress-google-maps-for-wordpress%2Ftrunk&old=3022439%40mappress-google-maps-for-wordpress%2Ftrunk&sfp_email=&sfph_mail= - https://advisory.abay.sh/cve-2023-7225/
CVE ID: CVE-2023-7226 State: PUBLISHED Published: 2024-01-11T20:31:05.095Z Last Updated: 2024-11-14T14:45:09.007Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: meetyoucrop Products: big-whale Problem Types: CWE-282 Description: A vulnerability was found in meetyoucrop big-whale 1.1 and classified as critical. Affected by this issue is some unknown functionality of the file /auth/user/all.api of the component Admin Module. The manipulation of the argument id leads to improper ownership management. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250232. Additional Analyst Notes: - CVE
osed to the public and may be used. The identifier of this vulnerability is VDB-250232. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250232 - https://vuldb.com/?ctiid.250232 - https://gitee.com/meetyoucrop/big-whale/issues/I6N31K
CVE ID: CVE-2023-7227 State: PUBLISHED Published: 2024-01-25T18:21:39.427Z Last Updated: 2025-05-29T15:19:17.820Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SystemK Products: NVR 504, NVR 508, NVR 516 Problem Types: CWE-77 Description: SystemK NVR 504/508/516 versions 2.3.5SK.30084998 and prior are vulnerable to a command injection vulnerability in the dynamic domain name system (DDNS) settings that could allow an attacker to execute arbitrary commands with root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-02
CVE ID: CVE-2023-7228 State: PUBLISHED Published: 2025-05-15T20:09:26.103Z Last Updated: 2025-05-16T16:52:31.946Z Vendors: Unknown Products: illi Link Party! Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The illi Link Party! WordPress plugin through 1.0 does not sanitise and escape some parameters, which could allow unauthenticated vistors to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1ddf1271-3826-44e2-8408-cfbe9c3cc547/
CVE ID: CVE-2023-7229 State: PUBLISHED Published: 2025-05-15T20:09:26.333Z Last Updated: 2025-05-16T16:51:49.332Z Vendors: Unknown Products: illi Link Party! Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The illi Link Party! WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d16f6ba0-a47d-413f-a6d4-058910441009/
CVE ID: CVE-2023-7230 State: PUBLISHED Published: 2025-05-15T20:09:26.532Z Last Updated: 2025-05-16T16:50:56.394Z Vendors: Unknown Products: illi Link Party! Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The illi Link Party! WordPress plugin through 1.0 does not sanitize and escape some parameters, which could allow users with a role as low as admin to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/402e428b-f966-4a36-ace0-d0ded9410b1d/
CVE ID: CVE-2023-7231 State: PUBLISHED Published: 2025-05-15T20:09:26.721Z Last Updated: 2025-05-16T16:49:55.319Z Vendors: Unknown Products: illi Link Party! Problem Types: CWE-284 Improper Access Control Description: The illi Link Party! WordPress plugin through 1.0 lacks proper access controls, allowing unauthenticated visitors to delete links. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/797692ce-f355-4d4a-af01-4bd9abc60a34/
CVE ID: CVE-2023-7232 State: PUBLISHED Published: 2024-03-26T05:00:02.063Z Last Updated: 2024-08-02T17:32:05.721Z Vendors: Unknown Products: Backup and Restore WordPress Problem Types: CWE-200 Information Exposure Description: The Backup and Restore WordPress WordPress plugin through 1.45 does not protect some log files containing sensitive information such as site configuration etc, allowing unauthenticated users to access such data Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/323fef8a-aa17-4698-9a02-c12d1d390763/
CVE ID: CVE-2023-7233 State: PUBLISHED Published: 2024-02-12T16:05:58.430Z Last Updated: 2025-03-14T18:14:13.804Z Vendors: Unknown Products: GigPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The GigPress WordPress plugin through 2.3.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/585cb2f2-7adc-431f-89d4-4e947f16af18/
CVE ID: CVE-2023-7234 State: PUBLISHED Published: 2024-01-16T18:11:50.146Z Last Updated: 2025-06-02T15:08:34.790Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Integration Objects Products: OPC UA Server Toolkit Problem Types: CWE-117 Description: OPCUAServerToolkit will write a log message once an OPC UA client has successfully connected containing the client's self-defined description field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-016-02 - https://integrationobjects.com//ask-a-question/