Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6897 State: PUBLISHED Published: 2024-04-18T11:05:28.666Z Last Updated: 2024-08-02T08:42:08.500Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: algoritmika Products: EAN for WooCommerce Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The EAN for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.9.2 via the the 'alg_wc_ean_product_meta' shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to expose potentially sensitive post metadata
ible for authenticated attackers, with contributor-level access and above, to expose potentially sensitive post metadata. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/17b20df5-4adf-47ce-bddf-2ec0b9499de8?source=cve - https://plugins.trac.wordpress.org/changeset/3070991/ean-for-woocommerce
CVE ID: CVE-2023-6898 State: PUBLISHED Published: 2023-12-17T10:31:04.117Z Last Updated: 2025-05-07T20:40:47.778Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Best Courier Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Best Courier Management System 1.0. Affected is an unknown function of the file manage_user.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248256. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
e identifier of this vulnerability is VDB-248256. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.248256 - https://vuldb.com/?ctiid.248256 - https://github.com/Glunko/gaatitrack-courier-management-system_vulnerability/blob/main/sql_injection.md
CVE ID: CVE-2023-6899 State: PUBLISHED Published: 2023-12-17T12:31:04.408Z Last Updated: 2024-11-21T14:26:00.377Z Severity: N/A (CVSS 4.7 AV:A/AC:L/Au:M/C:P/I:P/A:P) Vendors: rmountjoy92 Products: DashMachine Problem Types: CWE-94 Description: A vulnerability classified as problematic was found in rmountjoy92 DashMachine 0.5-4. Affected by this vulnerability is an unknown functionality of the file /settings/save_config of the component Config Handler. The manipulation of the argument value_template leads to code injection. The exploit has been disclosed to the public and may be used. The identifier VDB-248257 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Contain
y be used. The identifier VDB-248257 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.248257 - https://vuldb.com/?ctiid.248257 - https://treasure-blarney-085.notion.site/DashMachine-Unauthorized-RCE-931a35a81af9448ebe9fb4cd904d4a0c
CVE ID: CVE-2023-6900 State: PUBLISHED Published: 2023-12-17T13:31:04.489Z Last Updated: 2024-08-02T08:42:08.511Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: rmountjoy92 Products: DashMachine Problem Types: CWE-24 Description: A vulnerability, which was classified as critical, has been found in rmountjoy92 DashMachine 0.5-4. Affected by this issue is some unknown functionality of the file /settings/delete_file. The manipulation of the argument file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. VDB-248258 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Contain
ay be used. VDB-248258 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.248258 - https://vuldb.com/?ctiid.248258 - https://treasure-blarney-085.notion.site/DashMachine-Arbitrary-File-Deletion-ab44f2fe68e843c393ae9e0c1d487676
CVE ID: CVE-2023-6901 State: PUBLISHED Published: 2023-12-17T14:00:04.686Z Last Updated: 2024-08-02T08:42:08.675Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: codelyfe Products: Stupid Simple CMS Problem Types: CWE-78 Description: A vulnerability, which was classified as critical, was found in codelyfe Stupid Simple CMS up to 1.2.3. This affects an unknown part of the file /terminal/handle-command.php of the component HTTP POST Request Handler. The manipulation of the argument command with the input whoami leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of th
tiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248259. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.248259 - https://vuldb.com/?ctiid.248259 - https://github.com/g1an123/POC/blob/main/README.md
CVE ID: CVE-2023-6902 State: PUBLISHED Published: 2023-12-17T15:31:03.724Z Last Updated: 2024-08-02T08:42:08.549Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: codelyfe Products: Stupid Simple CMS Problem Types: CWE-434 Description: A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as critical. This vulnerability affects unknown code of the file /file-manager/upload.php. The manipulation of the argument file leads to unrestricted upload. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248260. Additional Analyst Notes: - CVE Program Container: References: - https
e identifier of this vulnerability is VDB-248260. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.248260 - https://vuldb.com/?ctiid.248260 - https://github.com/g1an123/POC/blob/main/Unauthorized%20file%20upload%20getshell.md
CVE ID: CVE-2023-6903 State: PUBLISHED Published: 2023-12-17T23:00:04.804Z Last Updated: 2024-09-30T19:02:07.649Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Netentsec Products: NS-ASG Application Security Gateway Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.1. This affects an unknown part of the file /admin/singlelogin.php?submit=1. The manipulation of the argument loginId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248265 was assigned to this vulnerability. Additional An
een disclosed to the public and may be used. The identifier VDB-248265 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.248265 - https://vuldb.com/?ctiid.248265 - https://github.com/willchen0011/cve/blob/main/NS-ASG-sql.md
CVE ID: CVE-2023-6904 State: PUBLISHED Published: 2023-12-17T23:00:05.941Z Last Updated: 2024-08-02T08:42:08.475Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Jahastech Products: NxFilter Problem Types: CWE-352 Description: A vulnerability classified as problematic was found in Jahastech NxFilter 4.3.2.5. This vulnerability affects unknown code of the file /config,admin.jsp. The manipulation of the argument admin_name leads to cross-site request forgery. The attack can be initiated remotely. VDB-248266 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Progr
e vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.248266 - https://vuldb.com/?ctiid.248266
CVE ID: CVE-2023-6905 State: PUBLISHED Published: 2023-12-17T23:31:04.083Z Last Updated: 2024-08-02T08:42:08.644Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Jahastech Products: NxFilter Problem Types: CWE-90 Description: A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5. This issue affects some unknown processing of the file user,adap.jsp?actionFlag=test&id=1 of the component Bind Request Handler. The manipulation leads to ldap injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-248267. NOTE: The vendor was contacted early about this disclosure but did n
ted identifier of this vulnerability is VDB-248267. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.248267 - https://vuldb.com/?ctiid.248267
CVE ID: CVE-2023-6906 State: PUBLISHED Published: 2023-12-18T00:00:07.209Z Last Updated: 2025-05-07T20:38:58.753Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C) Vendors: Totolink Products: A7100RU Problem Types: CWE-120 Description: A vulnerability, which was classified as critical, was found in Totolink A7100RU 7.4cu.2313_B20191024. Affected is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument flag with the input ie8 leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-24826
emotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248268. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.248268 - https://vuldb.com/?ctiid.248268 - https://github.com/unpWn4bL3/iot-security/blob/main/1.md
CVE ID: CVE-2023-6907 State: PUBLISHED Published: 2023-12-18T00:31:03.959Z Last Updated: 2024-08-02T08:42:08.380Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: codelyfe Products: Stupid Simple CMS Problem Types: CWE-287 Description: A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /file-manager/delete.php of the component Deletion Interface. The manipulation of the argument file leads to improper authentication. The exploit has been disclosed to the public and may be used. The identifier VDB-248269 was assigned to this vulnerability. A
xploit has been disclosed to the public and may be used. The identifier VDB-248269 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.248269 - https://vuldb.com/?ctiid.248269 - https://github.com/g1an123/POC/blob/main/Unauthorized%20file%20deletion.md
CVE ID: CVE-2023-6908 State: PUBLISHED Published: 2023-12-18T01:00:06.254Z Last Updated: 2024-08-02T08:42:08.527Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: DFIRKuiper Products: Kuiper Problem Types: CWE-22 Description: A vulnerability, which was classified as problematic, was found in DFIRKuiper Kuiper 2.3.4. This affects the function unzip_file of the file kuiper/app/controllers/case_management.py of the component TAR Archive Handler. The manipulation of the argument dst_path leads to path traversal. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version
k remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 2.3.5 is able to address this issue. The identifier of the patch is 94fa135153002f651f5526c55a7240e083db8d73. It is recommended to upgrade the affected component. The identifier VDB-248277 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.248277 - https://vuldb.com/?ctiid.248277 - https://github.com/DFIRKuiper/Kuiper/pull/106 - https://github.com/DFIRKuiper/Kuiper/commit/94fa135153002f651f5526c55a7240e083db8d73 - https://github.com/DFIRKuiper/Kuiper/releases/tag/v2.3.5
CVE ID: CVE-2023-6909 State: PUBLISHED Published: 2023-12-18T00:00:31.984Z Last Updated: 2024-08-02T08:42:08.521Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: mlflow Products: mlflow/mlflow Problem Types: CWE-29 Description: Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/11209efb-0f84-482f-add0-587ea6b7e850 - https://github.com/mlflow/mlflow/commit/1da75dfcecd4d169e34809ade55748384e8af6c1
CVE ID: CVE-2023-6910 State: PUBLISHED Published: 2023-12-20T09:36:39.118Z Last Updated: 2024-08-28T08:13:59.192Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: M-Files Corporation Products: M-Files Server Problem Types: CWE-770 Description: A vulnerable API method in M-Files Server before 23.12.13195.0 allows for uncontrolled resource consumption. Authenticated attacker can exhaust server storage space to a point where the server can no longer serve requests. Additional Analyst Notes: - CVE Program Container: References: - https://product.m-files.com/security-advisories/cve-2023-6910/
CVE ID: CVE-2023-6911 State: PUBLISHED Published: 2023-12-18T08:32:58.961Z Last Updated: 2024-08-02T08:42:08.416Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: WSO2 Products: WSO2 API Manager, WSO2 API Manager Analytics, WSO2 API Microgateway, WSO2 Data Analytics Server, WSO2 Enterprise Integrator, WSO2 IS as Key Manager, WSO2 Identity Server, WSO2 Identity Server Analytics, WSO2 Message Broker Problem Types: CWE-79 Description: Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the
Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console. Additional Analyst Notes: - CVE Program Container: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1225/
CVE ID: CVE-2023-6912 State: PUBLISHED Published: 2023-12-20T09:35:46.232Z Last Updated: 2024-08-28T08:06:13.495Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: M-Files Corporation Products: M-Files Server Problem Types: CWE-307 Description: Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromising targeted M-Files user accounts by guessing passwords. Additional Analyst Notes: - CVE Program Container: References: - https://product.m-files.com/security-advisories/cve-2023-6912/
CVE ID: CVE-2023-6913 State: PUBLISHED Published: 2023-12-19T14:49:48.766Z Last Updated: 2024-08-02T08:42:08.526Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Imou Products: Imou Life app Problem Types: CWE-384 Description: A session hijacking vulnerability has been detected in the Imou Life application affecting version 6.7.0. This vulnerability could allow an attacker to hijack user accounts due to the QR code functionality not properly filtering codes when scanning a new device and directly running WebView without prompting or displaying it to the user. This vulnerability could trigger phishing attacks. Additional Analyst Notes: - CVE Program Container:
g it to the user. This vulnerability could trigger phishing attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/session-hijacking-imou-life-app
CVE ID: CVE-2023-6915 State: PUBLISHED Published: 2024-01-15T09:32:32.741Z Last Updated: 2025-11-06T19:47:03.149Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-476 Description: A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.co
turn. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:2394 - https://access.redhat.com/errata/RHSA-2024:2950 - https://access.redhat.com/errata/RHSA-2024:3138 - https://access.redhat.com/security/cve/CVE-2023-6915 - https://bugzilla.redhat.com/show_bug.cgi?id=2254982 - https://github.com/torvalds/linux/commit/af73483f4e8b6f5c68c9aa63257bdd929a9c194a
CVE ID: CVE-2023-6916 State: PUBLISHED Published: 2024-04-10T15:50:57.919Z Last Updated: 2024-09-20T11:47:45.639Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Nozomi Networks Products: Guardian, CMC Problem Types: CWE-201 Description: Audit records for OpenAPI requests may include sensitive information. This could lead to unauthorized accesses and privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.nozominetworks.com/NN-2023:17-01
CVE ID: CVE-2023-6917 State: PUBLISHED Published: 2024-02-28T14:38:19.258Z Last Updated: 2025-11-20T18:07:05.664Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Problem Types: CWE-378 Description: A vulnerability has been identified in the Performance Co-Pilot (PCP) package, stemming from the mixed privilege levels utilized by systemd services associated with PCP. While certain services operate within the confines of limited PCP user/group privileges, others are granted full root privileges. This disparity in privilege levels poses
of limited PCP user/group privileges, others are granted full root privileges. This disparity in privilege levels poses a risk when privileged root processes interact with directories or directory trees owned by unprivileged PCP users. Specifically, this vulnerability may lead to the compromise of PCP user isolation and facilitate local PCP-to-root exploits, particularly through symlink attacks. These vulnerabilities underscore the importance of maintaining robust privilege separation mechanisms within PCP to mitigate the potential for unauthorized privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:2213 - https://access.redhat.com/security/cve/CVE-2023-6917 - https://bugzilla.redhat.com/show_bug.cgi?id=2254983
CVE ID: CVE-2023-6918 State: PUBLISHED Published: 2023-12-18T23:27:48.540Z Last Updated: 2025-11-21T06:23:44.733Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-252 Description: A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In
memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:2504 - https://access.redhat.com/errata/RHSA-2024:3233 - https://access.redhat.com/security/cve/CVE-2023-6918 - https://bugzilla.redhat.com/show_bug.cgi?id=2254997 - https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/ - https://www.libssh.org/security/advisories/CVE-2023-6918.txt
CVE ID: CVE-2023-6919 State: PUBLISHED Published: 2024-01-26T07:52:59.322Z Last Updated: 2025-06-17T21:19:31.350Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Biges Safe Life Technologies Electronics Inc. Products: VGuard Problem Types: CWE-25 Description: Path Traversal: '/../filedir' vulnerability in Biges Safe Life Technologies Electronics Inc. VGuard allows Absolute Path Traversal.This issue affects VGuard: before V500.0003.R008.4011.C0012.B351.C. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-0054
CVE ID: CVE-2023-6920 State: REJECTED Published: N/A Last Updated: 2023-12-18T16:23:43.555Z Description: No description available.
CVE ID: CVE-2023-6921 State: PUBLISHED Published: 2024-01-08T11:34:19.799Z Last Updated: 2025-06-16T19:50:57.105Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PrestaShow Products: PrestaShop Google Integrator Problem Types: CWE-89 Description: Blind SQL Injection vulnerability in PrestaShow Google Integrator (PrestaShop addon) allows for data extraction and modification. This attack is possible via command insertion in one of the cookies. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://prestashow.pl/pl/moduly-prestashop/28-prestashop-google-integrator-ga4-gtm-ads-remarketing.html - https://cert.pl/en/pos
prestashow.pl/pl/moduly-prestashop/28-prestashop-google-integrator-ga4-gtm-ads-remarketing.html - https://cert.pl/en/posts/2024/01/CVE-2023-6921/ - https://cert.pl/posts/2024/01/CVE-2023-6921/
CVE ID: CVE-2023-6922 State: PUBLISHED Published: 2024-02-28T08:33:05.608Z Last Updated: 2024-08-07T18:24:53.966Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: acurax Products: Under Construction / Maintenance Mode from Acurax Problem Types: CWE-200 Information Exposure Description: The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.6 via the 'acx_csma_subscribe_ajax' function. This can allow authenticated attackers to extract sensitive data such as names and email addresses of subscribed visitors. Additional Analyst Notes: - CVE Program Container: -
tive data such as names and email addresses of subscribed visitors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2a75f4eb-698b-4c92-9829-de6c55e21ecb?source=cve - https://plugins.trac.wordpress.org/browser/coming-soon-maintenance-mode-from-acurax/trunk/function.php?rev=2539156#L612
CVE ID: CVE-2023-6923 State: PUBLISHED Published: 2024-02-20T18:56:24.446Z Last Updated: 2024-08-02T08:42:08.402Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: matomoteam Products: Matomo Analytics – Ethical Stats. Powerful Insights. Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite parameter in all versions up to, and including, 4.15.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec