Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-40186 State: PUBLISHED Published: 2023-08-31T21:13:57.792Z Last Updated: 2025-11-03T20:35:51.128Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-787, CWE-190 Description: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function. This issue affects FreeRDP based clients only. FreeRDP proxies are not affected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users
fected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hcj4-3c3r-5j3v - https://github.com/FreeRDP/FreeRDP/blob/fee2b10ba1154f952769a53eb608f044782e22f8/libfreerdp/gdi/gfx.c#L1156-L1165 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/ - https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html - https://security.gentoo.org/glsa/202401-16
CVE ID: CVE-2023-40187 State: PUBLISHED Published: 2023-08-31T21:21:12.787Z Last Updated: 2025-02-13T17:07:43.347Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-416 Description: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of the 3.x beta branch are subject to a Use-After-Free issue in the `avc420_ensure_buffer` and `avc444_ensure_buffer` functions. If the value of `piDstSize[x]` is 0, `ppYUVDstData[x]` will be freed. However, in this case `ppYUVDstData[x]` will not have been updated which leads to a Use-After-Free vulnerability. This i
However, in this case `ppYUVDstData[x]` will not have been updated which leads to a Use-After-Free vulnerability. This issue has been addressed in version 3.0.0-beta3. Users of the 3.x beta releases are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pwf9-v5p9-ch4f - https://github.com/FreeRDP/FreeRDP/blob/5be5553e0da72178a4b94cc1ffbdace9ceb153e5/libfreerdp/codec/h264.c#L413-L427 - https://security.gentoo.org/glsa/202401-16
CVE ID: CVE-2023-40188 State: PUBLISHED Published: 2023-08-31T21:32:55.557Z Last Updated: 2025-11-03T20:35:52.575Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-125 Description: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `general_LumaToYUV444` function. This Out-Of-Bounds Read occurs because processing is done on the `in` variable without checking if it contains data of sufficient length. Insufficient data for the `in` variable may cause errors or crashes. This issue has been addressed in
ufficient length. Insufficient data for the `in` variable may cause errors or crashes. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9w28-wwj5-p4xq - https://github.com/FreeRDP/FreeRDP/blob/5be5553e0da72178a4b94cc1ffbdace9ceb153e5/libfreerdp/codec/nsc.c#L115-L175 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraprojec
ge/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/ - https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html - https://security.gentoo.org/glsa/202401-16
CVE ID: CVE-2023-40191 State: PUBLISHED Published: 2024-02-21T03:06:30.224Z Last Updated: 2024-08-02T18:24:55.603Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 44 through 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the “Blocked Email Domains” text field Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https:/
il Domains” text field Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-40191
CVE ID: CVE-2023-40193 State: PUBLISHED Published: 2023-09-06T09:22:00.909Z Last Updated: 2024-09-26T20:15:47.601Z Vendors: TP-LINK Products: Deco M4 Problem Types: OS command injection Description: Deco M4 firmware versions prior to 'Deco M4(JP)_V2_1.5.8 Build 20230619' allows a network-adjacent authenticated attacker to execute arbitrary OS commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tp-link.com/jp/support/download/deco-m4/v2/#Firmware - https://jvn.jp/en/vu/JVNVU99392903/
CVE ID: CVE-2023-40194 State: PUBLISHED Published: 2023-11-27T15:25:11.538Z Last Updated: 2025-11-04T19:17:47.562Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: Foxit Reader Problem Types: CWE-73 Description: An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to mistreatment of whitespace characters. A specially crafted malicious file can create files at arbitrary locations, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially c
o opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1833
CVE ID: CVE-2023-40195 State: PUBLISHED Published: 2023-08-28T07:50:01.211Z Last Updated: 2025-04-23T16:19:19.884Z Vendors: Apache Software Foundation Products: Apache Airflow Spark Provider Problem Types: CWE-502, CWE-829 Description: Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Provider. When the Apache Spark provider is installed on an Airflow deployment, an Airflow user that is authorized to configure Spark hooks can effectively run arbitrary code on the Airflow node by pointing it at a malicious Spark server. Prior to version 4.1.3, this was not called out in the documentation
ow node by pointing it at a malicious Spark server. Prior to version 4.1.3, this was not called out in the documentation explicitly, so it is possible that administrators provided authorizations to configure Spark hooks without taking this into account. We recommend administrators to review their configurations to make sure the authorization to configure Spark hooks is only provided to fully trusted users. To view the warning in the docs please visit https://airflow.apache.org/docs/apache-airflow-providers-apache-spark/4.1.3/connections/spark.html Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/33233 - https://l
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/33233 - https://lists.apache.org/thread/fzy95b1d6zv31j5wrx3znhzcscck2o24
CVE ID: CVE-2023-40196 State: PUBLISHED Published: 2023-09-04T11:15:46.316Z Last Updated: 2024-09-24T18:50:57.414Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: ImageRecycle Products: ImageRecycle pdf & image compression Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ImageRecycle ImageRecycle pdf & image compression plugin <= 3.1.11 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/imagerecycle-pdf-image-compression/wordpress-imagerecycle-pdf-image-compression-plugin-3-1-11-reflected-cross-site-scripting-xss-vulner
f-image-compression/wordpress-imagerecycle-pdf-image-compression-plugin-3-1-11-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-40197 State: PUBLISHED Published: 2023-09-04T11:27:12.862Z Last Updated: 2024-09-24T18:50:36.416Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Devaldi Ltd Products: flowpaper Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Devaldi Ltd flowpaper plugin <= 1.9.9 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/flowpaper-lite-pdf-flipbook/wordpress-flowpaper-plugin-1-9-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-40198 State: PUBLISHED Published: 2023-10-03T12:29:57.127Z Last Updated: 2024-09-20T13:15:21.052Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Antsanchez Products: Easy Cookie Law Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Antsanchez Easy Cookie Law plugin <= 3.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/easy-cookie-law/wordpress-easy-cookie-law-plugin-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-40199 State: PUBLISHED Published: 2023-10-03T12:33:09.545Z Last Updated: 2024-09-20T13:15:00.936Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: CRUDLab Products: WP Like Button Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in CRUDLab WP Like Button plugin <= 1.7.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-like-button/wordpress-wp-like-button-plugin-1-6-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-40201 State: PUBLISHED Published: 2023-10-03T12:20:23.660Z Last Updated: 2024-09-20T13:15:36.669Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: FuturioWP Products: Futurio Extra Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in FuturioWP Futurio Extra plugin <= 1.8.4 versions leads to activation of arbitrary plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/futurio-extra/wordpress-futurio-extra-plugin-1-8-2-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2023-40202 State: PUBLISHED Published: 2023-10-03T12:14:15.225Z Last Updated: 2024-09-20T13:15:54.024Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Hannes Etzelstorfer // codemiq Products: WP HTML Mail Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Hannes Etzelstorfer // codemiq WP HTML Mail plugin <= 3.4.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-html-mail/wordpress-email-template-designer-wp-html-mail-plugin-3-4-0-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2023-40203 State: PUBLISHED Published: 2024-12-13T14:24:05.949Z Last Updated: 2024-12-13T19:02:21.230Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: MailMunch Products: MailChimp Forms by MailMunch Problem Types: CWE-862 Description: Missing Authorization vulnerability in MailMunch MailChimp Forms by MailMunch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailChimp Forms by MailMunch: from n/a through 3.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/mailchimp-forms-by-mailmunch/vulnerability/wordpress-mailchimp-forms-by-mailmunch
tchstack.com/database/wordpress/plugin/mailchimp-forms-by-mailmunch/vulnerability/wordpress-mailchimp-forms-by-mailmunch-plugin-3-1-4-broken-access-control?_s_id=cve
CVE ID: CVE-2023-40204 State: PUBLISHED Published: 2023-12-20T18:41:38.061Z Last Updated: 2025-04-29T03:47:56.226Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Premio Products: Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Premio Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager.This issue affects Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: from n/a through 2.9.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
r, Pages, Posts, File Manager: from n/a through 2.9.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/folders/wordpress-folders-plugin-2-9-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2023-40205 State: PUBLISHED Published: 2023-09-04T11:03:33.194Z Last Updated: 2024-09-24T18:51:14.032Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Pixelgrade Products: PixTypes Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Pixelgrade PixTypes plugin <= 1.4.15 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/pixtypes/wordpress-pixtypes-plugin-1-4-15-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-40206 State: PUBLISHED Published: 2023-09-04T10:43:04.660Z Last Updated: 2025-02-19T21:24:03.918Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: hwk-fr Products: WP 404 Auto Redirect to Similar Post Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in hwk-fr WP 404 Auto Redirect to Similar Post plugin <= 1.0.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-404-auto-redirect-to-similar-post/wordpress-wp-404-auto-redirect-to-similar-post-plugin-1-0-3-cross-site-scripting-xss-vulnerability?_s_id=
o-similar-post/wordpress-wp-404-auto-redirect-to-similar-post-plugin-1-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-40207 State: PUBLISHED Published: 2023-11-06T08:00:09.182Z Last Updated: 2024-09-05T14:08:55.907Z Vendors: RedNao Products: Donations Made Easy – Smart Donations Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RedNao Donations Made Easy – Smart Donations allows SQL Injection.This issue affects Donations Made Easy – Smart Donations: from n/a through 4.0.12. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/smart-donations/wordpress-donations-made-easy-smart-donations-plugin-4-0-12-sql-injection?_s_id=cve
CVE ID: CVE-2023-40208 State: PUBLISHED Published: 2023-09-04T10:40:09.268Z Last Updated: 2024-09-24T18:51:23.602Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Aleksandar Urošević Products: Stock Ticker Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Aleksandar Urošević Stock Ticker plugin <= 3.23.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/stock-ticker/wordpress-stock-ticker-plugin-3-23-3-unauth-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-40209 State: PUBLISHED Published: 2024-06-12T09:53:47.723Z Last Updated: 2024-08-02T18:24:55.656Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Himalaya Saxena Products: Highcompress Image Compressor Problem Types: CWE-862 Description: Missing Authorization vulnerability in Himalaya Saxena Highcompress Image Compressor.This issue affects Highcompress Image Compressor: from n/a through 6.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/high-compress/wordpress-highcompress-image-compressor-plugin-4-0-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-40210 State: PUBLISHED Published: 2023-10-03T11:27:30.952Z Last Updated: 2024-09-20T13:16:09.582Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Sean Barton (Tortoise IT) Products: SB Child List Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Sean Barton (Tortoise IT) SB Child List plugin <= 4.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/sb-child-list/wordpress-sb-child-list-plugin-4-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-40211 State: PUBLISHED Published: 2023-11-30T15:03:24.108Z Last Updated: 2024-08-02T18:24:55.798Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: PickPlugins Products: Post Grid Combo – 36+ Gutenberg Blocks Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid Combo – 36+ Gutenberg Blocks.This issue affects Post Grid Combo – 36+ Gutenberg Blocks: from n/a through 2.2.50. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/post-grid/wordpress-post-grid-combo-plugin-2-2-50-sensitive-data-exposure-vulnerabilit
hstack.com/database/vulnerability/post-grid/wordpress-post-grid-combo-plugin-2-2-50-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2023-40212 State: PUBLISHED Published: 2023-10-03T12:36:44.732Z Last Updated: 2024-09-20T13:14:44.229Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: theDotstore Products: Product Attachment for WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Product Attachment for WooCommerce plugin <= 2.1.8 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woo-product-attachment/wordpress-product-attachment-for-woocommerce-plugin-2-1-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-40213 State: PUBLISHED Published: 2024-12-13T14:24:06.519Z Last Updated: 2024-12-13T18:19:56.296Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Mateusz Czardybon Products: Justified Gallery Problem Types: CWE-862 Description: Missing Authorization vulnerability in Mateusz Czardybon Justified Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Justified Gallery: from n/a through 1.7.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/justified-gallery/vulnerability/wordpress-justified-gallery-plugin-1-7-3-broken-access-control-vul
base/wordpress/plugin/justified-gallery/vulnerability/wordpress-justified-gallery-plugin-1-7-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-40214 State: PUBLISHED Published: 2023-09-04T11:22:17.419Z Last Updated: 2024-09-24T18:50:48.390Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Vathemes Products: Business Pro Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Vathemes Business Pro theme <= 1.10.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/business-pro/wordpress-business-pro-theme-1-10-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-40215 State: PUBLISHED Published: 2023-11-03T23:15:12.400Z Last Updated: 2024-09-05T18:41:52.163Z Vendors: Demonisblack Products: demon image annotation Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Demonisblack demon image annotation allows SQL Injection.This issue affects demon image annotation: from n/a through 5.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/demon-image-annotation/wordpress-demon-image-annotation-plugin-5-1-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-40216 State: PUBLISHED Published: 2023-08-10T00:00:00 Last Updated: 2024-10-09T20:23:52.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/014_wscons.patch.sig - https://github.com/openbsd/src/commit/9d3f688f46eba347e96ff0ae9506ef2061622e0c
CVE ID: CVE-2023-40217 State: PUBLISHED Published: 2023-08-25T00:00:00.000Z Last Updated: 2025-11-03T21:49:23.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be