Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
tackers to reset plugin settings and remove reviews via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/70968476-b064-477f-999f-4aa2c51d89cc?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2980022%40wp-reviews-plugin-for-google%2Ftrunk&old=2977531%40wp-reviews-plugin-for-google%2Ftrunk&sfp_email=&sfph_mail=#file8
CVE ID: CVE-2023-3255 State: PUBLISHED Published: 2023-09-13T16:12:52.294Z Last Updated: 2025-11-08T06:30:19.755Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Advanced Virtualization Problem Types: CWE-835 Description: A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the `inflate_buffer` function. This could allow a remote authenticated client who is able to
r controlled zlib buffer in the `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard to the VNC server to trigger a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:2135 - https://access.redhat.com/errata/RHSA-2024:2962 - https://access.redhat.com/security/cve/CVE-2023-3255 - https://bugzilla.redhat.com/show_bug.cgi?id=2218486
CVE ID: CVE-2023-3256 State: PUBLISHED Published: 2023-06-22T16:21:25.727Z Last Updated: 2025-01-16T21:32:01.699Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: R-SeeNet Problem Types: CWE-73 Description: Advantech R-SeeNet versions 2.4.22 allows low-level users to access and load the content of local files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-173-02
CVE ID: CVE-2023-3259 State: PUBLISHED Published: 2023-08-14T03:49:59.889Z Last Updated: 2024-10-09T13:30:19.348Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dataprobe Products: iBoot PDU Problem Types: CWE-502 Description: The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass. By manipulating the IP address field in the "iBootPduSiteAuth" cookie, a malicious agent can direct the device to connect to a rouge database.Successful exploitation allows the malicious agent to take actions with administrator privileges including, but not limited to, manipulating power levels, modifying user accounts,
ctions with administrator privileges including, but not limited to, manipulating power levels, modifying user accounts, and exporting confidential user information Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html
CVE ID: CVE-2023-3260 State: PUBLISHED Published: 2023-08-14T03:51:52.015Z Last Updated: 2024-10-09T13:23:37.663Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dataprobe Products: iBoot PDU Problem Types: CWE-78 Description: The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to command injection via the `user-name` URL parameter. An authenticated malicious agent can exploit this vulnerability to execute arbitrary command on the underlying Linux operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat
ntainer: - CISA ADP Vulnrichment: References: - https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html
CVE ID: CVE-2023-3261 State: PUBLISHED Published: 2023-08-14T03:53:59.429Z Last Updated: 2024-10-09T14:46:12.138Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Dataprobe Products: iBoot PDU Problem Types: CWE-119 Description: The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier contains a buffer overflow vulnerability in the librta.so.0.0.0 library.Successful exploitation could cause denial of service or unexpected behavior with respect to all interactions relying on the targeted vulnerable binary, including the ability to log in via the web server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
to log in via the web server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html
CVE ID: CVE-2023-3262 State: PUBLISHED Published: 2023-08-14T03:59:51.212Z Last Updated: 2024-10-09T14:45:31.470Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dataprobe Products: iBoot PDU Problem Types: CWE-798 Description: The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database.A malicious agent with the ability to execute operating system commands on the device can leverage this vulnerability to read, modify, or delete arbitrary database records. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.trel
base records. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html
CVE ID: CVE-2023-3263 State: PUBLISHED Published: 2023-08-14T04:02:55.740Z Last Updated: 2024-10-09T14:44:21.435Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dataprobe Products: iBoot PDU Problem Types: CWE-289 Description: The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass in the REST API due to the mishandling of special characters when parsing credentials.Successful exploitation allows the malicious agent to obtain a valid authorization token and read information relating to the state of the relays and power distribution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichm
the state of the relays and power distribution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html
CVE ID: CVE-2023-3264 State: PUBLISHED Published: 2023-08-14T04:05:58.124Z Last Updated: 2024-10-09T14:40:56.865Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dataprobe Products: iBoot PDU Problem Types: CWE-798 Description: The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database. A malicious agent with the ability to execute operating system commands on the device can leverage this vulnerability to read, modify, or delete arbitrary database records. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tre
abase records. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html
CVE ID: CVE-2023-3265 State: PUBLISHED Published: 2023-08-14T04:08:06.402Z Last Updated: 2024-10-09T14:40:02.267Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CyberPower Products: PowerPanel Enterprise Problem Types: CWE-150 Description: An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an attacker to login into the application with the default user "cyberpower" by appending a non-printable character.An unauthenticated attacker can leverage this vulnerability to log in to the CypberPower PowerPanel Enterprise as an administrator with hardcoded default credentials. Addit
ability to log in to the CypberPower PowerPanel Enterprise as an administrator with hardcoded default credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html
CVE ID: CVE-2023-3266 State: PUBLISHED Published: 2023-08-14T04:09:45.187Z Last Updated: 2024-10-09T14:38:50.239Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CyberPower Products: PowerPanel Enterprise Problem Types: CWE-358 Description: A non-feature complete authentication mechanism exists in the production application allowing an attacker to bypass all authentication checks if LDAP authentication is selected.An unauthenticated attacker can leverage this vulnerability to log in to the CypberPower PowerPanel Enterprise as an administrator by selecting LDAP authentication from a hidden HTML combo box. Successful exploitation of this vulnerability also r
ator by selecting LDAP authentication from a hidden HTML combo box. Successful exploitation of this vulnerability also requires the attacker to know at least one username on the device, but any password will authenticate successfully. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html
CVE ID: CVE-2023-3267 State: PUBLISHED Published: 2023-08-14T04:11:06.644Z Last Updated: 2024-10-09T15:45:50.252Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: CyberPower Products: PowerPanel Enterprise Problem Types: CWE-78 Description: When adding a remote backup location, an authenticated user can pass arbitrary OS commands through the username field. The username is passed without sanitization into CMD running as NT/Authority System. An authenticated attacker can leverage this vulnerability to execute arbitrary code with system-level access to the CyberPower PowerPanel Enterprise server. Additional Analyst Notes: - CVE Program Container: - CISA ADP V
l access to the CyberPower PowerPanel Enterprise server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html
CVE ID: CVE-2023-3268 State: PUBLISHED Published: 2023-06-16T00:00:00.000Z Last Updated: 2025-03-11T14:53:35.403Z Vendors: n/a Products: Kernel Problem Types: CWE-125 Description: An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel internal information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lore.kernel.org/lkml/1682238502-1892-1-git-send-email-yangpc%40wangsu.com/T/ - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.2 - https://www.debian.org/security/2023/dsa-5448 - h
om/T/ - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.2 - https://www.debian.org/security/2023/dsa-5448 - https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=43ec16f1450f4936025a9bdf1a273affdb9732c1 - https://www.debian.org/security/2023/dsa-5480 - https://security.netapp.com/advisory/ntap-20230824-0006/ - https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
CVE ID: CVE-2023-3269 State: PUBLISHED Published: 2023-07-11T11:45:36.711Z Last Updated: 2025-03-05T18:54:16.670Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a, Red Hat, Fedora Products: kernel, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Fedora Problem Types: CWE-416 Description: A vulnerability exists in the memory management subsystem of the Linux kernel. The lock handling for accessing and updating virtual memory areas (VMAs) is incorrect, leading to use-after-free problems. This issue can be successfully exploited to execute arbitrary kernel code, escalate containers, and gain root
problems. This issue can be successfully exploited to execute arbitrary kernel code, escalate containers, and gain root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-3269 - https://bugzilla.redhat.com/show_bug.cgi?id=2215268 - https://www.openwall.com/lists/oss-security/2023/07/05/1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6AAA64CUPSMBW6XDTXPQJ3KQWYQ4K7L/ - http://seclists.org/fulldisclosure/2023/Jul/43 - http://www.openwall.com/lists/oss-security/2023/07/28/1 - http://www.openwall.com/lists/oss-security/2023/08/25/1 - http://www.ope
.openwall.com/lists/oss-security/2023/07/28/1 - http://www.openwall.com/lists/oss-security/2023/08/25/1 - http://www.openwall.com/lists/oss-security/2023/08/25/4 - https://security.netapp.com/advisory/ntap-20230908-0001/
CVE ID: CVE-2023-3270 State: PUBLISHED Published: 2023-07-10T09:18:28.375Z Last Updated: 2024-11-12T14:20:22.953Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: SICK AG Products: ICR890-4 Problem Types: Exposure of Sensitive Information to an Unauthorized Actor Description: Exposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf - https://sick.com/.well-known/csaf
ps://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json
CVE ID: CVE-2023-3271 State: PUBLISHED Published: 2023-07-10T09:26:21.041Z Last Updated: 2024-11-12T14:19:30.590Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: SICK AG Products: ICR890-4 Problem Types: CWE-284 Description: Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the REST API by accessing unauthenticated endpoints. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-000
tps://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json
CVE ID: CVE-2023-3272 State: PUBLISHED Published: 2023-07-10T09:27:46.002Z Last Updated: 2024-11-12T14:18:45.915Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: SICK AG Products: ICR890-4 Problem Types: CWE-319 Description: Cleartext Transmission of Sensitive Information in the SICK ICR890-4 could allow a remote attacker to gather sensitive information by intercepting network traffic that is not encrypted. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json
CVE ID: CVE-2023-3273 State: PUBLISHED Published: 2023-07-10T09:31:17.829Z Last Updated: 2024-11-12T14:17:56.263Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SICK AG Products: ICR890-4 Problem Types: CWE-284 Description: Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings of the device such as the IP address based on missing access control. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf - https://sick.com/.well-known/csaf/white
ick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json
CVE ID: CVE-2023-3274 State: PUBLISHED Published: 2023-06-15T12:31:02.902Z Last Updated: 2024-08-02T06:48:08.385Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Supplier Management System Problem Types: CWE-434 Description: A vulnerability classified as critical has been found in code-projects Supplier Management System 1.0. Affected is an unknown function of the file btn_functions.php of the component Picture Handler. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231624. Additional Analyst Notes: - CVE
osed to the public and may be used. The identifier of this vulnerability is VDB-231624. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231624 - https://vuldb.com/?ctiid.231624 - https://github.com/wuyangzihan/SUPPLIER-MANAGEMENT-SYSTEM/blob/main/SUPPLIER%20MANAGEMENT%20SYSTEM%20has%20a%20file%20upload%20(RCE)%20vulnerability.pdf
CVE ID: CVE-2023-3275 State: PUBLISHED Published: 2023-06-15T12:31:03.861Z Last Updated: 2024-12-12T16:31:33.707Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Rail Pass Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in PHPGurukul Rail Pass Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /view-pass-detail.php of the component POST Request Handler. The manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The identifier VDB-231625 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Contai
d remotely. The identifier VDB-231625 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.231625 - https://vuldb.com/?ctiid.231625
CVE ID: CVE-2023-3276 State: PUBLISHED Published: 2023-06-15T13:00:03.622Z Last Updated: 2024-11-21T16:06:12.623Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Dromara Products: HuTool Problem Types: CWE-611 Description: A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference. The exploit has been disclosed to the public and may be used. VDB-231626 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this dis
e used. VDB-231626 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.231626 - https://vuldb.com/?ctiid.231626 - https://fbdhhhh47.github.io/2023/06/06/hutool-XXE/
CVE ID: CVE-2023-3277 State: PUBLISHED Published: 2023-11-03T11:29:49.440Z Last Updated: 2025-02-05T18:51:59.822Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: inspireui Products: MStore API Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any user as long as they know the user's email address. We are disclosing this issue as the developer has not yet release
ny user as long as they know the user's email address. We are disclosing this issue as the developer has not yet released a patch, but continues to release updates and we escalated this issue to the plugin's team 30 days ago. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1c7c0c35-5f44-488f-9fe1-269ea4a73854?source=cve - https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L821
CVE ID: CVE-2023-3279 State: PUBLISHED Published: 2023-10-16T19:39:18.389Z Last Updated: 2025-04-23T16:11:34.166Z Vendors: Unknown Products: WordPress Gallery Plugin Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3b7a7070-8d61-4ff8-b003-b4ff06221635
CVE ID: CVE-2023-3280 State: PUBLISHED Published: 2023-09-13T16:13:29.266Z Last Updated: 2024-09-25T17:48:34.264Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Palo Alto Networks Products: Cortex XDR Agent Problem Types: CWE-755 Description: A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to disable the agent. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2023-3280
CVE ID: CVE-2023-3282 State: PUBLISHED Published: 2023-11-08T17:22:58.976Z Last Updated: 2024-08-02T06:48:08.442Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: Cortex XSOAR Problem Types: CWE-732 Description: A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system enables a local attacker to execute programs with elevated privileges if the attacker has shell access to the engine. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2023-3282
CVE ID: CVE-2023-3285 State: PUBLISHED Published: 2024-07-09T09:37:24.189Z Last Updated: 2024-08-02T06:48:08.473Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Products: easyappointments Problem Types: CWE-639 Description: A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system (including admin). This results in unauthorized data manipulation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/alextselegidis/easyappointments
CVE ID: CVE-2023-3286 State: PUBLISHED Published: 2024-07-09T10:20:20.060Z Last Updated: 2024-08-02T06:48:08.580Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Products: easyappointments Problem Types: CWE-639 Description: A BOLA vulnerability in POST /secretaries allows a low privileged user to create a low privileged user (secretary) in the system. This results in unauthorized data manipulation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/alextselegidis/easyappointments