Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6551 State: PUBLISHED Published: 2024-01-04T16:04:34.995Z Last Updated: 2025-06-03T14:42:21.494Z Vendors: class.upload.php Products: class.upload.php Problem Types: CWE-434 Description: As a simple library, class.upload.php does not perform an in-depth check on uploaded files, allowing a stored XSS vulnerability when the default configuration is used. Developers must be aware of that fact and use extension whitelisting accompanied by forcing the server to always provide content-type based on the file extension. The README has been updated to include these guidelines. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.pl/pos
uidelines. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2024/01/CVE-2023-6551 - https://cert.pl/en/posts/2024/01/CVE-2023-6551
CVE ID: CVE-2023-6552 State: PUBLISHED Published: 2024-01-08T12:19:58.358Z Last Updated: 2025-04-17T17:58:04.602Z Vendors: TasmoAdmin Products: TasmoAdmin Problem Types: CWE-601 Description: Lack of "current" GET parameter validation during the action of changing a language leads to an open redirect vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TasmoAdmin/TasmoAdmin/pull/1039 - https://cert.pl/en/posts/2024/01/CVE-2023-6552/ - https://cert.pl/posts/2024/01/CVE-2023-6552/
CVE ID: CVE-2023-6553 State: PUBLISHED Published: 2023-12-15T10:59:46.387Z Last Updated: 2025-05-07T20:43:52.691Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: migrate Products: Backup Migration Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easil
bsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3511ba64-56a3-43d7-8ab8-c6e40e3b686e?source=cve - https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L38 - https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L62 - https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L64 - https://plugins.trac.wordpress.org/browser/backup-ba
rg/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L64 - https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L118 - https://www.synacktiv.com/en/publications/php-filters-chain-what-is-it-and-how-to-use-it - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3006541%40backup-backup&new=3006541%40backup-backup&sfp_email=&sfph_mail= - http://packetstormsecurity.com/files/176638/WordPress-Backup-Migration-1.3.7-Remote-Command-Execution.html
CVE ID: CVE-2023-6554 State: PUBLISHED Published: 2024-01-11T15:17:23.523Z Last Updated: 2025-06-20T16:34:34.387Z Vendors: Tecnick.com Products: TCExam Problem Types: CWE-862 Description: When access to the "admin" folder is not protected by some external authorization mechanisms e.g. Apache Basic Auth, it is possible for any user to download protected information like exam answers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/01/CVE-2023-6554/ - https://cert.pl/posts/2024/01/CVE-2023-6554/ - https://tcexam.org/
CVE ID: CVE-2023-6555 State: PUBLISHED Published: 2024-01-08T19:00:27.436Z Last Updated: 2025-06-18T16:52:14.909Z Vendors: Unknown Products: Email Subscription Popup Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Email Subscription Popup WordPress plugin before 1.2.20 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/58803934-dbd3-422d-88e7-ebbc5e8c0886
CVE ID: CVE-2023-6556 State: PUBLISHED Published: 2024-01-11T08:32:45.695Z Last Updated: 2025-06-17T21:09:13.286Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: realmag777 Products: FOX – Currency Switcher Professional for WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via currency options in all versions up to, and including, 1.4.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with sub
due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8cb37019-33f6-4f72-adfc-befbfbf69e47?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-currency-switcher/trunk/classes/smart-designer.php#L21 - https://plugins.trac.wordpress.org/browser/woocommerce-currency-switcher/trunk/classes/smart-designer.php#L120 - https://plugins.trac.wo
trac.wordpress.org/browser/woocommerce-currency-switcher/trunk/classes/smart-designer.php#L120 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3012135%40woocommerce-currency-switcher&new=3012135%40woocommerce-currency-switcher&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6557 State: PUBLISHED Published: 2024-02-05T21:22:06.072Z Last Updated: 2024-08-02T08:35:14.035Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: theeventscalendar Products: The Events Calendar Problem Types: CWE-862 Missing Authorization Description: The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.8.2 via the route function hooked into wp_ajax_nopriv_tribe_dropdown. This makes it possible for unauthenticated attackers to extract potentially sensitive data including post titles and IDs of pending, private and draft posts. Additional Analyst Notes: - CISA AD
ly sensitive data including post titles and IDs of pending, private and draft posts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fc40196e-c0f3-4bc6-ac4b-b866902def61?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3010104%40the-events-calendar%2Ftags%2F6.2.9&old=3010096%40the-events-calendar%2Ftags%2F6.2.9
CVE ID: CVE-2023-6558 State: PUBLISHED Published: 2024-01-11T08:32:35.227Z Last Updated: 2025-06-03T14:09:31.604Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: webtoffee Products: Export and Import Users and Customers Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'upload_import_file' function in versions up to, and including, 2.4.8. This makes it possible for authenticated attackers with shop manager-level capabilities or above, to upload arbitrary files on the affected si
for authenticated attackers with shop manager-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/55b3e2dc-dc4f-408b-bbc6-da72ed5ad245?source=cve - https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/tags/2.4.7/admin/modules/import/classes/class-import-ajax.php#L124 - https://plugins.trac.wordpress.org/changeset/3008454/users-customers-import-export-for-wp-woocommerce#file197
CVE ID: CVE-2023-6559 State: PUBLISHED Published: 2023-12-16T12:29:16.960Z Last Updated: 2024-11-20T18:57:10.175Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: inc2734 Products: MW WP Form Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeov
le for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/412d555c-9bbd-42f5-8020-ccfc18755a79?source=cve - https://plugins.trac.wordpress.org/changeset/3007879/mw-wp-form
CVE ID: CVE-2023-6560 State: PUBLISHED Published: 2023-12-08T23:56:55.211Z Last Updated: 2024-08-02T08:35:14.422Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a, Red Hat, Fedora Products: kernel, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Fedora Problem Types: CWE-823 Description: An out-of-bounds memory access flaw was found in the io_uring SQ/CQ rings functionality in the Linux kernel. This issue could allow a local user to crash the system. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/176405/io_uring-__io_uaddr_map-Dangerous-M
: - CVE Program Container: References: - http://packetstormsecurity.com/files/176405/io_uring-__io_uaddr_map-Dangerous-Multi-Page-Handling.html - https://access.redhat.com/security/cve/CVE-2023-6560 - https://bugzilla.redhat.com/show_bug.cgi?id=2253249 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AU4NHBDEDLRW33O76Y6LFECEYNQET5GZ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UCQIPFUQXKXRCH5Y4RP3C5NK4IHNBNVK/ - https://patchwork.kernel.org/project/io-uring/patch/20231130194633.649319-2-axboe@kernel.dk/
CVE ID: CVE-2023-6561 State: PUBLISHED Published: 2024-01-11T08:33:01.156Z Last Updated: 2025-06-11T18:19:26.754Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: marceljm Products: Featured Image from URL (FIFU) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the featured image alt text in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to i
n and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d4d5ae93-000e-4001-adfa-c11058032469?source=cve - https://plugins.trac.wordpress.org/browser/featured-image-from-url/trunk/admin/meta-box.php#L213 - https://plugins.trac.wordpress.org/browser/featured-image-from-url/trunk/admin/category.php#L62 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=300969
l/trunk/admin/category.php#L62 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3009699%40featured-image-from-url%2Ftrunk&old=3003342%40featured-image-from-url%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6562 State: PUBLISHED Published: 2023-12-20T13:11:39.208Z Last Updated: 2024-08-02T08:35:14.693Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Kakadu Software Pty Ltd Products: Kakadu SDK Problem Types: CWE-22 Description: JPX Fragment List (flst) box vulnerability in Kakadu 7.9 allows an attacker to exfiltrate local and remote files reachable by a server if the server allows the attacker to upload a specially-crafted the image that is displayed back to the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/security-research/security/advisories/GHSA-g6qc-fhcq-vhf9
CVE ID: CVE-2023-6563 State: PUBLISHED Published: 2023-12-14T18:01:26.005Z Last Updated: 2025-11-11T15:10:51.908Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, RHEL-8 based Middleware Containers, Single Sign-On 7.6.6, Red Hat Build of Keycloak Problem Types: CWE-770 Description: An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more us
ns of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:7854 - https://access.redhat.com/errata/RHSA-2023:7855 - https://access.redhat.com/errata/RHSA-2023:7856 - https://access.redhat.com/errata/RHSA-2023:7857 - https://access.redhat.com/errata/RHSA-2023:7858 - https://access.redhat.com/sec
ccess.redhat.com/errata/RHSA-2023:7857 - https://access.redhat.com/errata/RHSA-2023:7858 - https://access.redhat.com/security/cve/CVE-2023-6563 - https://bugzilla.redhat.com/show_bug.cgi?id=2253308 - https://github.com/keycloak/keycloak/issues/13340
CVE ID: CVE-2023-6564 State: PUBLISHED Published: 2024-02-08T11:30:52.438Z Last Updated: 2024-10-03T06:23:16.888Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in GitLab EE Premium and Ultimate affecting versions 16.4.3, 16.5.3, and 16.6.1. In projects using subgroups to define who can push and/or merge to protected branches, there may have been instances in which subgroup members with the Developer role were able to push or merge to protected branches. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-c
s. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-com/gl-infra/production/-/issues/17213
CVE ID: CVE-2023-6565 State: PUBLISHED Published: 2024-02-20T18:56:24.911Z Last Updated: 2025-04-22T16:24:54.684Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: infinitewp Products: InfiniteWP Client Problem Types: CWE-922 Insecure Storage of Sensitive Information Description: The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via the multi-call backup option. This makes it possible for unauthenticated attackers to extract sensitive data from a temporary SQL file via repeated GET requests during the limited time window of the backup process. Additional Analyst Notes: - CISA
QL file via repeated GET requests during the limited time window of the backup process. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2fdc32a4-adf8-4174-924b-5d0b763d010c?source=cve - https://plugins.trac.wordpress.org/changeset/3007309/iwp-client
CVE ID: CVE-2023-6566 State: PUBLISHED Published: 2023-12-07T00:00:32.767Z Last Updated: 2024-08-02T08:35:14.827Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L) Vendors: microweber Products: microweber/microweber Problem Types: CWE-840 Description: Business Logic Errors in GitHub repository microweber/microweber prior to 2.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/cf4b68b5-8d97-4d05-9cde-e76b1a414fd6 - https://github.com/microweber/microweber/commit/eee0c6771e152022a91089a547272c8a542bb74e
CVE ID: CVE-2023-6567 State: PUBLISHED Published: 2024-01-11T08:32:37.107Z Last Updated: 2024-11-06T18:55:13.392Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: thimpress Products: LearnPress – WordPress LMS Plugin Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers
eter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6ab578cd-3a0b-43d3-aaa7-0a01f431a4e2?source=cve - https://plugins.trac.wordpress.org/changeset/3013957/learnpress
CVE ID: CVE-2023-6568 State: PUBLISHED Published: 2023-12-07T04:54:10.377Z Last Updated: 2024-08-02T08:35:14.502Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: mlflow Products: mlflow/mlflow Problem Types: CWE-79 Description: A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the user without adequate sanitization or escaping, leading to arbitrary JavaScript execution in the context of the victim's browser. The vulnera
sanitization or escaping, leading to arbitrary JavaScript execution in the context of the victim's browser. The vulnerability is present in the mlflow/server/auth/__init__.py file, where the user-supplied Content-Type header is directly injected into a Python formatted string and returned to the user, facilitating the XSS attack. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/816bdaaa-8153-4732-951e-b0d92fddf709 - https://github.com/mlflow/mlflow/commit/28ff3f94994941e038f2172c6484b65dc4db6ca1
CVE ID: CVE-2023-6569 State: PUBLISHED Published: 2023-12-14T12:59:46.487Z Last Updated: 2025-05-22T17:44:11.600Z Severity: CRITICAL (CVSS 9.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H) Vendors: h2oai Products: h2oai/h2o-3 Problem Types: CWE-73 Description: External Control of File Name or Path in h2oai/h2o-3 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/a5d003dc-c23e-4c98-8dcf-35ba9252fa3c
CVE ID: CVE-2023-6570 State: PUBLISHED Published: 2023-12-14T12:59:57.426Z Last Updated: 2024-08-02T08:35:14.402Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: kubeflow Products: kubeflow/kubeflow Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in kubeflow/kubeflow Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/82d6e853-013b-4029-a23f-8b50ec56602a
CVE ID: CVE-2023-6571 State: PUBLISHED Published: 2023-12-14T13:00:06.671Z Last Updated: 2024-08-02T08:35:14.472Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: kubeflow Products: kubeflow/kubeflow Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/f02781e7-2a53-4c66-aa32-babb16434632
CVE ID: CVE-2023-6572 State: PUBLISHED Published: 2023-12-14T13:14:16.804Z Last Updated: 2025-05-22T17:43:11.119Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: gradio-app Products: gradio-app/gradio Problem Types: CWE-77 Description: Command Injection in GitHub repository gradio-app/gradio prior to main. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/21d2ff0c-d43a-4afd-bb4d-049ee8da5b5c - https://github.com/gradio-app/gradio/commit/5b5af1899dd98d63e1f9b48a93601c2db1f56520
CVE ID: CVE-2023-6573 State: PUBLISHED Published: 2024-01-23T17:13:31.781Z Last Updated: 2024-10-28T18:44:09.140Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Hewlett Packard Enterprise Products: HPE OneView Description: HPE OneView may have a missing passphrase during restore. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04586en_us
CVE ID: CVE-2023-6574 State: PUBLISHED Published: 2023-12-07T19:31:04.428Z Last Updated: 2024-08-02T08:35:14.458Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Byzoro Products: Smart S20 Problem Types: CWE-434 Description: A vulnerability was found in Byzoro Smart S20 up to 20231120 and classified as critical. Affected by this issue is some unknown functionality of the file /sysmanage/updateos.php of the component HTTP POST Request Handler. The manipulation of the argument 1_file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247154 is the identifier assigned to this vulnerability. NOT
ploit has been disclosed to the public and may be used. VDB-247154 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247154 - https://vuldb.com/?ctiid.247154 - https://vuldb.com/?submit.241172 - https://github.com/flyyue2001/cve/blob/main/smart_sql_updateos.md
CVE ID: CVE-2023-6575 State: PUBLISHED Published: 2023-12-07T20:00:05.594Z Last Updated: 2024-08-02T08:35:14.569Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Byzoro Products: S210 Problem Types: CWE-89 Description: A vulnerability was found in Byzoro S210 up to 20231121. It has been classified as critical. This affects an unknown part of the file /Tool/repair.php of the component HTTP POST Request Handler. The manipulation of the argument txt leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247155. NOTE: The vendor was contacted early ab