Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-36201 State: PUBLISHED Published: 2023-07-07T00:00:00 Last Updated: 2024-11-13T21:00:19.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in JerryscriptProject jerryscript v.3.0.0 allows an attacker to obtain sensitive information via a crafted script to the arrays. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jerryscript-project/jerryscript/issues/5026
CVE ID: CVE-2023-36210 State: PUBLISHED Published: 2023-08-01T00:00:00.000Z Last Updated: 2025-02-13T16:56:16.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: MotoCMS Version 3.4.3 Store Category Template was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the keyword parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/51499 - https://vulners.com/zdt/1337DAY-ID-38750
CVE ID: CVE-2023-36211 State: PUBLISHED Published: 2023-08-01T00:00:00 Last Updated: 2024-10-17T20:33:14.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Barebones CMS v2.0.2 is vulnerable to Stored Cross-Site Scripting (XSS) when an authenticated user interacts with certain features on the admin panel. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/51502
CVE ID: CVE-2023-36212 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T16:15:24.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in Total CMS v.1.7.4 allows a remote attacker to execute arbitrary code via a crafted PHP file to the edit page function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/51500 - https://packetstormsecurity.com/files/172687/Total-CMS-1.7.4-Shell-Upload.html - https://github.com/capture0x/Total-CMS-EXPLOIT/
CVE ID: CVE-2023-36213 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T16:14:17.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in MotoCMS v.3.4.3 allows a remote attacker to gain privileges via the keyword parameter of the search function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/51504 - https://packetstormsecurity.com/files/172698/MotoCMS-3.4.3-SQL-Injection.html
CVE ID: CVE-2023-36217 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T16:13:23.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Xoops CMS v.2.5.10 allows a remote attacker to execute arbitrary code via the category name field of the image manager function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/XOOPS/XoopsCore25/releases/tag/v2.5.10 - https://www.exploit-db.com/exploits/51520
CVE ID: CVE-2023-36220 State: PUBLISHED Published: 2023-08-07T00:00:00 Last Updated: 2024-10-11T13:56:08.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive information via the plugin Upload function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://textpattern.com/ - https://textpattern.com/file_download/118/textpattern-4.8.8.zip - https://release-demo.textpattern.co/ - https://packetstormsecurity.com/files/172967/Textpattern-CMS-4.8.8-Command-Injection.html
CVE ID: CVE-2023-36222 State: PUBLISHED Published: 2023-07-03T00:00:00 Last Updated: 2024-11-22T18:20:00.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the comment parameter in the article function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://bbs-go.com - https://github.com/mlogclub/bbs-go - https://github.com/mlogclub/bbs-go/issues/206
CVE ID: CVE-2023-36223 State: PUBLISHED Published: 2023-07-03T00:00:00 Last Updated: 2024-11-22T16:49:30.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the announcements parameter in the settings function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://bbs-go.com - https://github.com/mlogclub/bbs-go - https://github.com/mlogclub/bbs-go/issues/208
CVE ID: CVE-2023-36234 State: PUBLISHED Published: 2023-09-20T00:00:00 Last Updated: 2024-08-02T16:45:56.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Netbox 3.5.1, allows attackers to execute arbitrary code via Name field in device-roles/add function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gozan10/cve/issues/6
CVE ID: CVE-2023-36235 State: PUBLISHED Published: 2024-01-17T00:00:00.000Z Last Updated: 2025-06-10T16:19:20.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the id_order parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://qloapps.com/ - https://github.com/webkul/hotelcommerce/pull/537 - https://github.com/Ek-Saini/security/blob/main/IDOR-Qloapps
CVE ID: CVE-2023-36236 State: PUBLISHED Published: 2024-01-16T00:00:00.000Z Last Updated: 2025-06-17T14:31:13.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in webkil Bagisto v.1.5.0 and before allows an attacker to execute arbitrary code via a crafted SVG file uplad. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bagisto.com/en/ - https://github.com/bagisto/bagisto/pull/4764/commits/7bbf0c4bb565fc2601f031f9bbcdfa06e24dbd45 - https://github.com/Ek-Saini/security/blob/main/XSS_via_fileupload-bagisto
CVE ID: CVE-2023-36237 State: PUBLISHED Published: 2024-02-26T00:00:00 Last Updated: 2024-08-02T16:45:56.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery vulnerability in Bagisto before v.1.5.1 allows an attacker to execute arbitrary code via a crafted HTML script. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Ek-Saini/security/blob/main/CSRF-Bagisto
CVE ID: CVE-2023-36238 State: PUBLISHED Published: 2024-03-13T00:00:00 Last Updated: 2024-12-04T21:05:46.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Direct Object Reference (IDOR) in Bagisto v.1.5.1 allows an attacker to obtain sensitive information via the invoice ID parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Ek-Saini/security/blob/main/IDOR-Bagisto
CVE ID: CVE-2023-36239 State: PUBLISHED Published: 2023-06-22T00:00:00 Last Updated: 2024-12-02T21:12:39.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: libming listswf 0.4.7 was discovered to contain a buffer overflow in the parseSWF_DEFINEFONTINFO() function at parser.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libming/libming/issues/273
CVE ID: CVE-2023-36243 State: PUBLISHED Published: 2023-06-22T00:00:00 Last Updated: 2024-12-02T21:11:49.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: FLVMeta v1.2.1 was discovered to contain a buffer overflow via the xml_on_metadata_tag_only function at dump_xml.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/noirotm/flvmeta/issues/19
CVE ID: CVE-2023-36250 State: PUBLISHED Published: 2023-09-14T00:00:00 Last Updated: 2024-09-25T19:45:26.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new record. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/BrunoTeixeira1996/CVE-2023-36250/blob/main/README.md
CVE ID: CVE-2023-36252 State: PUBLISHED Published: 2023-06-26T00:00:00 Last Updated: 2024-12-03T18:55:40.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Ateme Flamingo XL v.3.6.20 and XS v.3.6.5 allows a remote authenticated attacker to execute arbitrary code and cause a denial of service via a the session expiration function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zeroscience.mk/en/vulnerabilities/
CVE ID: CVE-2023-36255 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T16:12:38.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://eramba.com - https://trovent.io/security-advisory-2303-01/ - https://trovent.github.io/security-advisories/TRSA-2303-01/TRSA-2303-01.txt - https://www.eramba.org
CVE ID: CVE-2023-36256 State: PUBLISHED Published: 2023-07-07T00:00:00 Last Updated: 2024-11-13T20:58:24.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Online Examination System Project 1.0 version is vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can craft a malicious link that, when clicked by an admin user, will delete a user account from the database without the admin's consent. The email of the user to be deleted is passed as a parameter in the URL, which can be manipulated by the attacker. This could result in a loss of data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/ex
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/51511 - https://www.hackersnotes.com/blog/pentest/online-examination-system-project-1-0-cross-site-request-forgery-csrf/
CVE ID: CVE-2023-36258 State: PUBLISHED Published: 2023-07-03T00:00:00 Last Updated: 2024-11-22T16:46:55.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hwchase17/langchain/issues/5872
CVE ID: CVE-2023-36259 State: PUBLISHED Published: 2024-01-30T00:00:00.000Z Last Updated: 2025-05-29T15:06:45.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sjelfull/craft-audit/pull/73 - https://www.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D
CVE ID: CVE-2023-36260 State: PUBLISHED Published: 2024-01-30T00:00:00 Last Updated: 2024-10-18T14:09:00.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selected. NOTE: this is not a report about code provided by the Craft CMS product; it is only a report about the Feed Me plugin. NOTE: a third-party report states that commit b5d6ede51848349bd91bc95fec288b6793f15e28 has "nothing to do with security." Additional Analyst Notes: -
ates that commit b5d6ede51848349bd91bc95fec288b6793f15e28 has "nothing to do with security." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28%29 - https://www.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D - https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28
CVE ID: CVE-2023-36262 State: REJECTED Published: N/A Last Updated: 2023-07-05T00:00:00 Description: No description available.
CVE ID: CVE-2023-36263 State: PUBLISHED Published: 2023-10-31T00:00:00 Last Updated: 2024-09-06T18:06:27.697Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Prestashop opartlimitquantity 1.4.5 and before is vulnerable to SQL Injection. OpartlimitquantityAlertlimitModuleFrontController::displayAjaxPushAlertMessage()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2023/10/25/opartlimitquantity.html
CVE ID: CVE-2023-36266 State: PUBLISHED Published: 2023-07-12T00:00:00.000Z Last Updated: 2025-06-09T14:44:19.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Keeper Password Manager for Desktop version 16.10.2 (fixed in 17.2), and the KeeperFill Browser Extensions version 16.5.4 (fixed in 17.2), allows local attackers to gain sensitive information via plaintext password storage in memory after the user is already logged in, and may persist after logout. NOTE: the vendor disputes this for two reasons: the information is inherently available during a logged-in session when the attacker can read from arbitrary memory locations, and information only rem
vailable during a logged-in session when the attacker can read from arbitrary memory locations, and information only remains available after logout because of memory-management limitations of web browsers (not because the Keeper technology itself is retaining the information). Additional Analyst Notes: - CVE Program Container: References: - https://harkenzo.tlstickle.com/2023-06-12-Keeper-Password-Dumping/ - http://packetstormsecurity.com/files/173809/Keeper-Security-Desktop-16.10.2-Browser-Extension-16.5.4-Password-Dumper.html - https://docs.keeper.io/en/release-notes/desktop/web-vault-+-desktop-app/vault-release-17.2 - https://docs.keeper.io/en/enterprise-guide/keeper-forcefield
CVE ID: CVE-2023-36268 State: REJECTED Published: 2024-04-30T00:00:00 Last Updated: 2024-09-20T08:51:59.529Z Description: No description available.
CVE ID: CVE-2023-36271 State: PUBLISHED Published: 2023-06-23T00:00:00.000Z Last Updated: 2025-03-06T20:34:45.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibreDWG v0.10 to v0.12.5 was discovered to contain a heap buffer overflow via the function bit_wcs2nlen at bits.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LibreDWG/libredwg/issues/681#BUG2 - https://github.com/LibreDWG/libredwg/commit/c1ed1d91e28a6ddc7a9b5479d4795d58fb6be0ca - https://github.com/LibreDWG/libredwg/blob/0.10/src/bits.c#L1677C11-L1683C17
CVE ID: CVE-2023-36272 State: PUBLISHED Published: 2023-06-23T00:00:00.000Z Last Updated: 2025-04-08T18:17:43.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibreDWG v0.10 to v0.12.5 was discovered to contain a heap buffer overflow via the function bit_utf8_to_TU at bits.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LibreDWG/libredwg/issues/681#BUG1 - https://github.com/LibreDWG/libredwg/commit/c1ed1d91e28a6ddc7a9b5479d4795d58fb6be0ca - https://github.com/LibreDWG/libredwg/blob/0.10/src/bits.c#L1677C11-L1683C17
CVE ID: CVE-2023-36273 State: PUBLISHED Published: 2023-06-23T00:00:00 Last Updated: 2024-12-02T14:40:14.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibreDWG v0.12.5 was discovered to contain a heap buffer overflow via the function bit_calc_CRC at bits.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LibreDWG/libredwg/issues/677#BUG1
CVE ID: CVE-2023-36274 State: PUBLISHED Published: 2023-06-23T00:00:00.000Z Last Updated: 2025-03-06T20:29:35.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibreDWG v0.11 to v0.12.5 was discovered to contain a heap buffer overflow via the function bit_write_TF at bits.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LibreDWG/libredwg/issues/677#BUG2 - https://github.com/LibreDWG/libredwg/commit/8651fa27dd2de731e706e2ba09f0d28e4e0dce33 - https://github.com/LibreDWG/libredwg/blob/0.11/src/out_dxf.c#L1792
CVE ID: CVE-2023-36281 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-15T16:39:03.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt. This is related to __subclasses__ or a template. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hwchase17/langchain/issues/4394 - https://aisec.today/LangChain-2e6244a313dd46139c5ef28cbcab9e55 - https://github.com/langchain-ai/langchain/releases/tag/v0.0.312
CVE ID: CVE-2023-36284 State: PUBLISHED Published: 2023-06-23T00:00:00 Last Updated: 2024-11-29T19:31:53.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypass a web application's authentication and authorization mechanisms and retrieve the contents of an entire database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://flashy-lemonade-192.notion.site/Time-Based-SQL-injection-in-QloApps-1-6-0-0-be3ed1bdaf784a77b45dc6898a2de17e?pvs=4
CVE ID: CVE-2023-36287 State: PUBLISHED Published: 2023-06-23T00:00:00 Last Updated: 2024-11-29T19:31:21.744Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://flashy-lemonade-192.notion.site/Cross-site-scripting-via-controller-parameter-in-QloApps-1-6-0-97e409ce164f40d195b625b9bf719900?pvs=4
CVE ID: CVE-2023-36288 State: PUBLISHED Published: 2023-06-23T00:00:00 Last Updated: 2024-11-29T19:30:45.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via GET configure parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://flashy-lemonade-192.notion.site/Cross-site-scripting-in-admin-dashboard-via-configure-parameter-in-QloApps-1-6-0-b6303661ac6a47e4b7a6f23cf2818a52?pvs=4
CVE ID: CVE-2023-36289 State: PUBLISHED Published: 2023-06-23T00:00:00 Last Updated: 2024-11-29T19:30:18.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST email_create and back parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://flashy-lemonade-192.notion.site/Cross-site-scripting-in-POST-Request-via-email_create-and-back-parameter-in-QloApps-1-6-0-e05548203d744daf9047d82fc94b19b7?pvs=4
CVE ID: CVE-2023-36291 State: PUBLISHED Published: 2023-07-03T00:00:00 Last Updated: 2024-11-27T17:21:09.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Maxsite CMS v.108.7 allows a remote attacker to execute arbitrary code via the f_content parameter in the admin/page_new file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/maxsite/cms/issues/500
CVE ID: CVE-2023-36293 State: PUBLISHED Published: 2023-07-11T00:00:00 Last Updated: 2024-11-08T15:30:21.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in wmanager v.1.0.7 and before allows a remote attacker to obtain sensitive information via a crafted script to the company.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wmanager/base - http://wmanager.org/
CVE ID: CVE-2023-36298 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T16:11:45.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v5.7.109 has a File Upload vulnerability, leading to remote code execution (RCE). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MentalityXt/Dedecms-v5.7.109-RCE
CVE ID: CVE-2023-36299 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T16:11:00.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: A File Upload vulnerability in typecho v.1.2.1 allows a remote attacker to execute arbitrary code via the upload and options-general parameters in index.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/typecho/typecho/releases/tag/v1.2.1 - https://github.com/MentalityXt/typecho-v1.2.1-RCE
CVE ID: CVE-2023-36301 State: PUBLISHED Published: 2023-06-26T00:00:00 Last Updated: 2024-12-03T15:37:46.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: Talend Data Catalog before 8.0-20230221 contain a directory traversal vulnerability in HeaderImageServlet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.talend.com/r/en-US/Talend-Products-CVEs/Talend-Products-CVEs
CVE ID: CVE-2023-36306 State: PUBLISHED Published: 2023-08-08T00:00:00 Last Updated: 2024-10-10T18:29:39.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the asktheoracle.php, details.php, index.php, search.php, export.php, reports.php, and statistics.php components. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/51643
CVE ID: CVE-2023-36307 State: PUBLISHED Published: 2023-09-05T00:00:00 Last Updated: 2024-08-02T16:45:56.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZPLGFA 1.1.1 allows attackers to cause a panic (because of an integer index out of range during a ConvertToGraphicField call) via an image of zero width. NOTE: it is unclear whether there are common use cases in which this panic could have any security consequence Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/SimonWaldherr/zplgfa/pull/6