Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-3147 State: PUBLISHED Published: 2023-06-07T16:00:03.375Z Last Updated: 2025-01-06T21:02:55.371Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Discussion Forum Site Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Online Discussion Forum Site 1.0 and classified as critical. This vulnerability affects unknown code of the file admin\categories\view_category.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231016. Additional Analyst Notes:
disclosed to the public and may be used. The identifier of this vulnerability is VDB-231016. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.231016 - https://vuldb.com/?ctiid.231016 - https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md#7sql-injection-vulnerability-in-admincategoriesview_categoryphp
CVE ID: CVE-2023-3148 State: PUBLISHED Published: 2023-06-07T16:31:03.185Z Last Updated: 2024-08-02T06:48:07.311Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Discussion Forum Site Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0 and classified as critical. This issue affects some unknown processing of the file admin\posts\manage_post.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231017 was assigned to this vulnerability. Additional Analyst Notes:
d to the public and may be used. The identifier VDB-231017 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231017 - https://vuldb.com/?ctiid.231017 - https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md#6sql-injection-vulnerability-in-adminpostsmanage_postphp
CVE ID: CVE-2023-3149 State: PUBLISHED Published: 2023-06-07T17:00:03.574Z Last Updated: 2024-08-02T06:48:07.960Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Discussion Forum Site Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been classified as critical. Affected is an unknown function of the file admin\user\manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-231018 is the identifier assigned to this vulnerability. Additional Analyst No
closed to the public and may be used. VDB-231018 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231018 - https://vuldb.com/?ctiid.231018 - https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md#4sql-injection-vulnerability-in-adminusermanage_userphp
CVE ID: CVE-2023-3150 State: PUBLISHED Published: 2023-06-07T17:31:03.214Z Last Updated: 2024-08-02T06:48:07.653Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Discussion Forum Site Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file posts\manage_post.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231019. Addition
as been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231019. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231019 - https://vuldb.com/?ctiid.231019 - https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md
CVE ID: CVE-2023-3151 State: PUBLISHED Published: 2023-06-07T17:31:04.160Z Last Updated: 2024-08-02T06:48:07.357Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Discussion Forum Site Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file user\manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231020. Additional Analyst Notes: - C
sclosed to the public and may be used. The identifier of this vulnerability is VDB-231020. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231020 - https://vuldb.com/?ctiid.231020 - https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md
CVE ID: CVE-2023-3152 State: PUBLISHED Published: 2023-06-07T18:00:04.528Z Last Updated: 2025-01-06T20:09:47.217Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Discussion Forum Site Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Online Discussion Forum Site 1.0. This affects an unknown part of the file admin\posts\view_post.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231021 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container
be used. The identifier VDB-231021 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.231021 - https://vuldb.com/?ctiid.231021 - https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md#5sql-injection-vulnerability-in-adminpostsview_postphp
CVE ID: CVE-2023-3153 State: PUBLISHED Published: 2023-10-04T11:13:40.083Z Last Updated: 2024-09-19T14:25:08.613Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a, Red Hat, Fedora Products: ovn, Fast Datapath for RHEL 7, Fast Datapath for RHEL 8, Fast Datapath for RHEL 9, Red Hat OpenShift Container Platform 4, Red Hat OpenStack Platform 13 (Queens), Fedora Problem Types: CWE-400 Description: A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of service, including on deployments with CoPP enabled and properly configured. Additional Analyst Notes: - CVE P
denial of service, including on deployments with CoPP enabled and properly configured. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-3153 - https://bugzilla.redhat.com/show_bug.cgi?id=2213279 - https://github.com/ovn-org/ovn/commit/9a3f7ed905e525ebdcb14541e775211cbb0203bd - https://github.com/ovn-org/ovn/issues/198 - https://mail.openvswitch.org/pipermail/ovs-announce/2023-August/000327.html - https://mail.openvswitch.org/pipermail/ovs-dev/2023-August/407553.html
CVE ID: CVE-2023-3154 State: PUBLISHED Published: 2023-10-16T19:39:06.028Z Last Updated: 2024-09-16T17:44:01.684Z Vendors: Unknown Products: WordPress Gallery Plugin Problem Types: CWE-502 Deserialization of Untrusted Data Description: The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to PHAR Deserialization due to a lack of input parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary resources on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ed099489-1db4-4b42-9f72-77de39c9e01e
CVE ID: CVE-2023-3155 State: PUBLISHED Published: 2023-10-16T19:39:07.736Z Last Updated: 2025-04-23T16:12:44.435Z Vendors: Unknown Products: WordPress Gallery Plugin Problem Types: CWE-552 Files or Directories Accessible to External Parties Description: The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary resources on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5c8473f4-4b52-430b-9140-b81b0a0901da
CVE ID: CVE-2023-3158 State: PUBLISHED Published: 2023-07-12T04:38:46.096Z Last Updated: 2024-10-15T01:36:44.218Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: rahalaboulfeth Products: Mail Control – Email Customizer, SMTP Deliverability, logging, open and click Tracking Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Mail Control plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 0.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra
ufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/77537eb8-1c84-4702-aba1-727b0de1c3e1?source=cve - https://plugins.trac.wordpress.org/browser/mail-control/trunk/includes/admin.php#L42
CVE ID: CVE-2023-3159 State: PUBLISHED Published: 2023-06-12T00:00:00.000Z Last Updated: 2025-04-23T16:21:13.455Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel. In this flaw a local attacker with special privilege may cause a use after free problem when queue_event() fails. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/torvalds/linux/commit/b7c81f80246fac44077166f3e07103affe6db8ff
CVE ID: CVE-2023-3160 State: PUBLISHED Published: 2023-08-14T09:27:02.427Z Last Updated: 2024-10-09T20:04:15.607Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ESET, spol. s r.o. Products: ESET NOD32 Antivirus, ESET Internet Security, ESET Smart Security Premium, ESET Endpoint Antivirus, ESET Endpoint Security, ESET Server Security for Windows Server (File Security), ESET Mail Security for Microsoft Exchange Server, ESET Mail Security for IBM Domino, ESET Security for Microsoft SharePoint Server Problem Types: CWE-269 Description: The vulnerability potentially allows an attacker to misuse ESET’s file operations during the module update to delete or move file
rability potentially allows an attacker to misuse ESET’s file operations during the module update to delete or move files without having proper permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.eset.com/en/ca8466
CVE ID: CVE-2023-3161 State: PUBLISHED Published: 2023-06-12T00:00:00.000Z Last Updated: 2025-03-11T14:54:29.577Z Vendors: n/a Products: Linux Kernel (fbcon) Problem Types: CWE-1335 Description: A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2213485 - https://github.com/torvalds/linux/commit/2b09d5d364986f724f17001ccfe4126b9b43a0be
CVE ID: CVE-2023-3162 State: PUBLISHED Published: 2023-08-31T05:33:07.144Z Last Updated: 2024-10-01T18:01:13.516Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: webtoffee Products: Stripe Payment Plugin for WooCommerce Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.7.7. This is due to insufficient verification on the user being supplied during a Stripe checkout through the plugin. This allows unauthenticated attackers to log in as users who have orders, who are typically cus
kout through the plugin. This allows unauthenticated attackers to log in as users who have orders, who are typically customers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4d052f3e-8554-43f0-a5ae-1de09c198d7b?source=cve - https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/3.7.7/includes/class-stripe-checkout.php#L640 - https://plugins.trac.wordpress.org/changeset/2925361/payment-gateway-stripe-and-woocommerce-integration
CVE ID: CVE-2023-3163 State: PUBLISHED Published: 2023-06-08T13:31:02.992Z Last Updated: 2024-08-02T06:48:07.891Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: y_project Products: RuoYi Problem Types: CWE-400 Description: A vulnerability was found in y_project RuoYi up to 4.7.7. It has been classified as problematic. Affected is the function filterKeyword. The manipulation of the argument value leads to resource consumption. VDB-231090 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231090 - https://vuldb.com/?ctiid.231090 - https://gitee.com/y_project/RuoYi/issues/I78DOR
CVE ID: CVE-2023-3164 State: PUBLISHED Published: 2023-11-02T11:26:28.533Z Last Updated: 2024-10-11T17:04:00.410Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: n/a, Red Hat, Fedora Products: libtiff, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Fedora Problem Types: CWE-120 Description: A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
ce via a crafted tiff file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-3164 - https://bugzilla.redhat.com/show_bug.cgi?id=2213531 - https://gitlab.com/libtiff/libtiff/-/issues/542
CVE ID: CVE-2023-3165 State: PUBLISHED Published: 2023-06-08T17:00:04.954Z Last Updated: 2024-08-02T06:48:08.001Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Life Insurance Management System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Life Insurance Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file insertNominee.php of the component POST Parameter Handler. The manipulation of the argument nominee_id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identif
cripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231109 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.231109 - https://vuldb.com/?ctiid.231109 - https://github.com/Hanwengao/CVERequests/blob/main/XSS.md
CVE ID: CVE-2023-3166 State: PUBLISHED Published: 2023-07-12T04:38:51.244Z Last Updated: 2025-02-05T19:39:56.889Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: lanacodes Products: Lana Email Logger Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Lana Email Logger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, Lana Email Logger due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user
kes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d5f372bf-6b13-4ba7-8b8b-9d3b500e4420?source=cve - https://plugins.trac.wordpress.org/changeset/2923581/lana-email-logger#file1
CVE ID: CVE-2023-3167 State: PUBLISHED Published: 2023-07-12T04:38:50.820Z Last Updated: 2025-02-05T19:40:05.177Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: wdm-team Products: Mail Queue Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A
icated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d4aaca22-76b9-42ec-a960-65d44d696324?source=cve - https://plugins.trac.wordpress.org/changeset/2924661/mail-queue
CVE ID: CVE-2023-3168 State: PUBLISHED Published: 2023-07-12T04:38:44.748Z Last Updated: 2025-02-05T19:41:14.926Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: msh134 Products: WP Reroute Email Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Reroute Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an inje
or unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4a0e962b-b6a0-4179-91d0-5ede508a9895?source=cve - https://plugins.trac.wordpress.org/changeset/2933637/wp-reroute-email
CVE ID: CVE-2023-3169 State: PUBLISHED Published: 2023-09-11T19:46:07.392Z Last Updated: 2024-09-26T15:51:45.513Z Vendors: Unknown Products: tagDiv Composer Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST route and does not validate as well as escape some parameters when outputting them back, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e6d8216d-ace4-48ba-afca-7
CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e6d8216d-ace4-48ba-afca-74da0dc5abb5
CVE ID: CVE-2023-3170 State: PUBLISHED Published: 2023-09-11T19:46:09.078Z Last Updated: 2024-09-26T15:58:35.533Z Vendors: Unknown Products: tagDiv Composer Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settings, which could allow users with Admin privileges to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e95ff3c6-283b-4
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e95ff3c6-283b-4e5e-bea0-1f1375da08da
CVE ID: CVE-2023-3171 State: PUBLISHED Published: 2023-12-27T15:45:33.293Z Last Updated: 2024-08-02T06:48:08.117Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: EAP 7.4.13, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9, Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Problem Types: CWE-789 Description: A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could
on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:5484 - https://access.redhat.com/errata/RHSA-2023:5485 - https://access.redhat.com/errata/RHSA-2023:5486 - https://access.redhat.com/errata/RHSA-2023:5488 - https://access.redhat.com/security/cve/CVE-2023-3171 - https://bugzilla.redhat.com/show_bug.cgi?id=2213639
CVE ID: CVE-2023-3172 State: PUBLISHED Published: 2023-06-09T00:00:00 Last Updated: 2025-01-06T17:12:23.267Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H) Vendors: froxlor Products: froxlor/froxlor Problem Types: CWE-22 Description: Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/e50966cd-9222-46b9-aedc-1feb3f2a0b0e - https://github.com/froxlor/froxlor/commit/da810ea95393dfaec68a70e30b7c887c50563a7e
CVE ID: CVE-2023-3173 State: PUBLISHED Published: 2023-06-09T00:00:00 Last Updated: 2025-01-06T17:11:57.332Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: froxlor Products: froxlor/froxlor Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/4d715f76-950d-4251-8139-3dffea798f14 - https://github.com/froxlor/froxlor/commit/464216072456efb35b4541c58e7016463dfbd9a6