Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-28679 State: PUBLISHED Published: 2023-03-23T11:26:07.445Z Last Updated: 2025-02-24T14:52:33.565Z Vendors: Jenkins Project Products: Jenkins Mashup Portlets Plugin Description: Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a portlet using a custom JavaScript expression, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2813
CVE ID: CVE-2023-28680 State: PUBLISHED Published: 2023-03-23T11:26:08.166Z Last Updated: 2025-02-25T19:13:04.395Z Vendors: Jenkins Project Products: Jenkins Crap4J Plugin Description: Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2925
CVE ID: CVE-2023-28681 State: PUBLISHED Published: 2023-03-23T11:26:08.881Z Last Updated: 2025-02-25T19:08:45.289Z Vendors: Jenkins Project Products: Jenkins Visual Studio Code Metrics Plugin Description: Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2926
CVE ID: CVE-2023-28682 State: PUBLISHED Published: 2023-03-23T11:26:09.595Z Last Updated: 2025-02-25T18:58:07.351Z Vendors: Jenkins Project Products: Jenkins Performance Publisher Plugin Description: Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2928
CVE ID: CVE-2023-28683 State: PUBLISHED Published: 2023-03-23T11:26:10.324Z Last Updated: 2025-02-21T15:51:18.858Z Vendors: Jenkins Project Products: Jenkins Phabricator Differential Plugin Description: Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2942
CVE ID: CVE-2023-28684 State: PUBLISHED Published: 2023-03-23T11:26:11.035Z Last Updated: 2025-02-20T21:23:35.424Z Vendors: Jenkins Project Products: Jenkins remote-jobs-view-plugin Plugin Description: Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2956
CVE ID: CVE-2023-28685 State: PUBLISHED Published: 2023-03-21T15:53:30.952Z Last Updated: 2025-02-26T16:45:18.676Z Vendors: Jenkins Project Products: Jenkins AbsInt a³ Plugin Description: Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2930
CVE ID: CVE-2023-28686 State: PUBLISHED Published: 2023-03-24T00:00:00.000Z Last Updated: 2025-02-19T21:41:47.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://dino.im/security/cve-2023-28686/ - https://www.debian.org/security/2023/dsa-5379 - https://lists.fedoraproject.org/archives/lis
/security/cve-2023-28686/ - https://www.debian.org/security/2023/dsa-5379 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IIWXAK656EHSRIRUHLPBE3AX2I4TMH7M/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQLCEUZS5GPHUQMS7C6W2NS3PHYUFHYF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GOH6NYTLPM52MDIR2IRVUR3REDVWZV6N/
CVE ID: CVE-2023-28687 State: PUBLISHED Published: 2024-03-26T20:20:59.986Z Last Updated: 2024-08-05T16:36:22.352Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: perfectwpthemes, themebeez Products: Glaze Blog Lite, Fascinate, Cream Blog, Cream Magazine Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in perfectwpthemes Glaze Blog Lite, themebeez Fascinate, themebeez Cream Blog, themebeez Cream Magazine allows Reflected XSS.This issue affects Glaze Blog Lite: from n/a through <= 1.1.4; Fascinate: from n/a through 1.0.8; Cream Blog: from n/a through 2.1.3; Cream Magazine: from
: from n/a through <= 1.1.4; Fascinate: from n/a through 1.0.8; Cream Blog: from n/a through 2.1.3; Cream Magazine: from n/a through 2.1.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/glaze-blog-lite/wordpress-glaze-blog-lite-theme-1-1-4-cross-site-scripting-xss-vulnerability - https://patchstack.com/database/vulnerability/fascinate/wordpress-fascinate-theme-1-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve - https://patchstack.com/database/vulnerability/cream-blog/wordpress-cream-blog-theme-2-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve - https://patchstack.com/database/vulnerability/cre
am-blog-theme-2-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve - https://patchstack.com/database/vulnerability/cream-magazine/wordpress-cream-magazine-theme-2-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28688 State: PUBLISHED Published: 2024-12-09T11:31:15.325Z Last Updated: 2024-12-09T18:44:59.520Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: ThemeHunk Products: TH Variation Swatches Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in ThemeHunk TH Variation Swatches allows Cross Site Request Forgery.This issue affects TH Variation Swatches: from n/a through 1.2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/th-variation-swatches/vulnerability/wordpress-th-variation-swatches-plugin-1-2-7-multiple-vulnerabilities?_s_id=cve
CVE ID: CVE-2023-28689 State: PUBLISHED Published: 2024-12-09T11:31:14.476Z Last Updated: 2024-12-09T18:45:11.269Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: JoomSky Products: JS Job Manager Problem Types: CWE-862 Description: Missing Authorization vulnerability in JoomSky JS Job Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through 2.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/js-jobs/vulnerability/wordpress-js-job-manager-plugin-2-0-0-broken-access-control?_s_id=cve
CVE ID: CVE-2023-28690 State: PUBLISHED Published: 2023-08-17T21:19:53.025Z Last Updated: 2025-02-19T21:26:28.832Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Marco Steinbrecher Products: WP BrowserUpdate Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Steinbrecher WP BrowserUpdate plugin <= 4.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-browser-update/wordpress-wp-browserupdate-plugin-4-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28692 State: PUBLISHED Published: 2023-08-30T15:27:09.400Z Last Updated: 2025-02-19T21:25:15.151Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Kevon Adonis Products: WP Abstracts Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kevon Adonis WP Abstracts plugin <= 2.6.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-abstracts-manuscripts-manager/wordpress-wp-abstracts-plugin-2-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28693 State: PUBLISHED Published: 2023-08-17T14:44:56.405Z Last Updated: 2024-09-25T14:49:10.047Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Balasaheb Bhise Products: Advanced Youtube Channel Pagination Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Balasaheb Bhise Advanced Youtube Channel Pagination plugin <= 1.0 version. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/advanced-youtube-channel-pagination/wordpress-advanced-youtube-channel-pagination-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_
e-channel-pagination/wordpress-advanced-youtube-channel-pagination-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28694 State: PUBLISHED Published: 2023-11-12T21:47:32.264Z Last Updated: 2024-09-03T13:32:23.687Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Wbcom Designs Products: Wbcom Designs – BuddyPress Activity Social Share Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Wbcom Designs Wbcom Designs – BuddyPress Activity Social Share plugin <= 3.5.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/bp-activity-social-share/wordpress-wbcom-designs-buddypress-activity-social-share-plugin-3-4-0-cross-site-request-forg
y/bp-activity-social-share/wordpress-wbcom-designs-buddypress-activity-social-share-plugin-3-4-0-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2023-28695 State: PUBLISHED Published: 2023-06-22T08:37:34.423Z Last Updated: 2024-10-10T17:25:16.924Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Drew Phillips Products: VigilanTor Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Drew Phillips VigilanTor plugin <= 1.3.10 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/vigilantor/wordpress-vigilantor-plugin-1-3-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28696 State: PUBLISHED Published: 2023-11-12T21:40:12.162Z Last Updated: 2024-08-02T13:43:23.750Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Harish Chouhan, Themeist Products: I Recommend This Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Harish Chouhan, Themeist I Recommend This allows Cross Site Request Forgery.This issue affects I Recommend This: from n/a through 3.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/i-recommend-this/wordpress-i-recommend-this-plugin-3-8-3-cross-site-request-forgery-csrf?_s
k.com/database/vulnerability/i-recommend-this/wordpress-i-recommend-this-plugin-3-8-3-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2023-28697 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-31T18:53:10.545Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Moxa Products: MiiNePort E1 Problem Types: CWE-306 Description: Moxa MiiNePort E1 has a vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to perform arbitrary system operation or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7021-eb43a-1.html - https://cdn-cms.azureedge.net/Moxa/media/PDIM/S100000223/MiiNePort%20E1%20Series_moxa-miineport-e1-se
021-eb43a-1.html - https://cdn-cms.azureedge.net/Moxa/media/PDIM/S100000223/MiiNePort%20E1%20Series_moxa-miineport-e1-series-firmware-v1.9.rom_Software%20Release%20History.pdf
CVE ID: CVE-2023-28698 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-08T18:01:40.370Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WADE DIGITAL DESIGN CO, LTD. Products: FANTSY Problem Types: CWE-863 Description: Wade Graphic Design FANTSY has a vulnerability of insufficient authorization check. An unauthenticated remote user can exploit this vulnerability by modifying URL parameters to gain administrator privileges to perform arbitrary system operation or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7101-f88db-1.html
CVE ID: CVE-2023-28699 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-08T18:01:15.762Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: WADE DIGITAL DESIGN CO, LTD. Products: FANTSY Problem Types: CWE-434 Description: Wade Graphic Design FANTSY has a vulnerability of insufficient filtering for file type in its file update function. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload a PHP file containing a webshell to perform arbitrary system operation or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7102-41ab8-1.html
CVE ID: CVE-2023-28700 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-08T18:00:10.567Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ITPison Products: OMICARD EDM Problem Types: CWE-434 Description: OMICARD EDM backend system’s file uploading function does not restrict upload of file with dangerous type. A local area network attacker with administrator privileges can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7144-b7536-1.htm
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7144-b7536-1.html
CVE ID: CVE-2023-28701 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-08T18:13:14.824Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ELITE Products: Web Fax Problem Types: CWE-89 Description: ELITE TECHNOLOGY CORP. Web Fax has a vulnerability of SQL Injection. An unauthenticated remote attacker can inject SQL commands into the input field of the login page to perform arbitrary system commands, disrupt service or terminate service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7145-1a0d4-1.html
CVE ID: CVE-2023-28702 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-08T20:08:43.251Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ASUS Products: RT-AC86U Problem Types: CWE-78 Description: ASUS RT-AC86U does not filter special characters for parameters in specific web URLs. A remote attacker with normal user privileges can exploit this vulnerability to perform command injection attack to execute arbitrary system commands, disrupt system or terminate service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7146-ef92a-1.html
CVE ID: CVE-2023-28703 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-08T20:07:01.013Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ASUS Products: RT-AC86U Problem Types: CWE-121 Description: ASUS RT-AC86U’s specific cgi function has a stack-based buffer overflow vulnerability due to insufficient validation for network packet header length. A remote attacker with administrator privileges can exploit this vulnerability to execute arbitrary system commands, disrupt system or terminate service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7147-afcf9-1.html
CVE ID: CVE-2023-28704 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-08T20:06:26.172Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Furbo Products: dog camera fireware Problem Types: CWE-78 Description: Furbo dog camera has insufficient filtering for special parameter of device log management function. An unauthenticated remote attacker in the Bluetooth network with normal user privileges can exploit this vulnerability to perform command injection attack to execute arbitrary system commands or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7153-68f52-1.html
CVE ID: CVE-2023-28705 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-08T20:02:33.928Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Openfind Products: Mail2000 Problem Types: CWE-79 Description: Openfind Mail2000 has insufficient filtering special characters of email content of its content filtering function. A remote attacker can exploit this vulnerability using phishing emails that contain malicious web pages injected with JavaScript. When users access the system and open the email, it triggers an XSS (Reflected Cross-site scripting) attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
Cross-site scripting) attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7158-751a6-1.html
CVE ID: CVE-2023-28706 State: PUBLISHED Published: 2023-04-07T14:54:37.177Z Last Updated: 2024-10-22T15:31:35.270Z Vendors: Apache Software Foundation Products: Apache Airflow Hive Provider Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 6.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/30212 - https://lists.apache.org/thread/dl20xxd51xvlx0zzc0wzgxfjwgtbbxo3 - http://www.openwall.com/lists/oss-security/2023/04/07/2
CVE ID: CVE-2023-28707 State: PUBLISHED Published: 2023-04-07T14:53:24.274Z Last Updated: 2025-02-13T16:48:49.151Z Vendors: Apache Software Foundation Products: Apache Airflow Drill Provider Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.This issue affects Apache Airflow Drill Provider: before 2.3.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/30215 - https://lists.apache.org/thread/dfoj7q1nd0vhhsl8fjg63z4j6mfmdxtk - http://www.openwall.com/lists/oss-security/2023/04/07/1
CVE ID: CVE-2023-28708 State: PUBLISHED Published: 2023-03-22T10:10:58.956Z Last Updated: 2025-11-04T19:15:54.760Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-523 Description: When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected. Additional Analyst Notes: - CVE Program Container:
e over an insecure channel. Older, EOL versions may also be affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67
CVE ID: CVE-2023-28709 State: PUBLISHED Published: 2023-05-22T10:08:49.541Z Last Updated: 2025-02-13T16:48:49.704Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-193 Description: The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur. Additional A
the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/7wvxonzwb7k9hx9jt3q33cmy7j97jo3j - http://www.openwall.com/lists/oss-security/2023/05/22/1 - https://security.gentoo.org/glsa/202305-37 - https://security.netapp.com/advisory/ntap-20230616-0004/ - https://www.debian.org/security/2023/dsa-5521
CVE ID: CVE-2023-28710 State: PUBLISHED Published: 2023-04-07T14:55:44.450Z Last Updated: 2024-10-22T15:30:02.808Z Vendors: Apache Software Foundation Products: Apache Airflow Spark Provider Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Spark Provider.This issue affects Apache Airflow Spark Provider: before 4.0.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/30223 - https://lists.apache.org/thread/lb9w9114ow00h2nkn8bjm106v5x1p1d2 - http://www.openwall.com/lists/oss-security/2023/04/07/3
CVE ID: CVE-2023-28711 State: PUBLISHED Published: 2023-08-11T02:37:16.933Z Last Updated: 2024-10-02T13:24:53.495Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: Hyperscan Library maintained by Intel(R) Problem Types: denial of service, CWE-691 Description: Insufficient control flow management in the Hyperscan Library maintained by Intel(R) before version 5.4.1 may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00879.html