Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-43844 State: PUBLISHED Published: 2024-05-28T18:17:28.492Z Last Updated: 2025-02-13T15:46:50.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aten PE6208 2.3.228 and 2.4.232 have default credentials for the privileged web interface account. The user is not asked to change the credentials after first login. If not changed, attackers can log in to the web interface and gain administrator privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/setersora/pe6208
CVE ID: CVE-2023-43845 State: PUBLISHED Published: 2024-05-28T18:17:55.220Z Last Updated: 2025-02-13T15:46:51.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aten PE6208 2.3.228 and 2.4.232 have default credentials for the privileged telnet account. The user is not asked to change the credentials after first login. If not changed, attackers can log in to the telnet console and gain administrator privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/setersora/pe6208
CVE ID: CVE-2023-43846 State: PUBLISHED Published: 2024-05-28T18:18:24.339Z Last Updated: 2025-02-13T15:46:52.030Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in logs management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote attackers to get the device logs via HTTP GET request. The logs contain such information as user names and IP addresses used in the infrastructure. This information may help the attackers to conduct further attacks in the infrastructure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/setersora/pe6208
CVE ID: CVE-2023-43847 State: PUBLISHED Published: 2024-05-28T18:18:47.887Z Last Updated: 2025-02-13T15:46:52.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the outlet control function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to control all the outlets as if they were the administrator via HTTP POST requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/setersora/pe6208
CVE ID: CVE-2023-43848 State: PUBLISHED Published: 2024-05-28T18:19:09.807Z Last Updated: 2025-02-13T15:46:53.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the firewall management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to alter local firewall settings of the device as if they were the administrator via HTTP POST request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/setersora/pe6208
CVE ID: CVE-2023-43849 State: PUBLISHED Published: 2024-05-28T18:19:40.793Z Last Updated: 2025-02-13T15:46:53.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in firmware upgrade function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to submit a firmware image via HTTP POST requests. This may result in DoS or remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/setersora/pe6208
CVE ID: CVE-2023-43850 State: PUBLISHED Published: 2024-05-28T18:20:09.943Z Last Updated: 2025-03-18T18:34:46.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper input validation in the user management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to cause a partial DoS of web interface via HTTP POST request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/setersora/pe6208
CVE ID: CVE-2023-43851 State: REJECTED Published: N/A Last Updated: 2023-12-26T17:28:40.173364 Description: No description available.
CVE ID: CVE-2023-43856 State: PUBLISHED Published: 2023-09-26T00:00:00 Last Updated: 2024-09-24T14:08:41.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dreamer CMS v4.1.3 was discovered to contain an arbitrary file read vulnerability via the component /admin/TemplateController.java. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://cms.iteachyou.cc/ - http://dreamer.com - https://github.com/yux1azhengye - https://github.com/yux1azhengye/mycve/blob/main/DreamerCMS%20arbitrary%20file%20reading.pdf
CVE ID: CVE-2023-43857 State: PUBLISHED Published: 2023-09-26T00:00:00 Last Updated: 2024-09-24T14:57:51.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dreamer CMS v4.1.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component /admin/u/toIndex. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/iteachyou/dreamer_cms/issues/I834WV
CVE ID: CVE-2023-43860 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-24T13:53:46.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanNonLogin function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md
CVE ID: CVE-2023-43861 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-24T14:08:10.724Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanPPPoE function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md
CVE ID: CVE-2023-43862 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-23T20:08:25.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formLanguageChange function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md
CVE ID: CVE-2023-43863 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-23T19:23:38.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanDhcpplus function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md
CVE ID: CVE-2023-43864 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-23T19:21:40.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWAN_Wizard55 function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md
CVE ID: CVE-2023-43865 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-24T13:05:57.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanPPTP function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md
CVE ID: CVE-2023-43866 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-23T20:30:50.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWAN_Wizard7 function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md
CVE ID: CVE-2023-43867 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-23T20:16:52.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanL2TP function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md
CVE ID: CVE-2023-43868 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-23T20:03:56.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via websGetVar function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md
CVE ID: CVE-2023-43869 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-23T19:57:05.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWAN_Wizard56 function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md
CVE ID: CVE-2023-43870 State: PUBLISHED Published: 2023-12-19T15:09:13.276Z Last Updated: 2024-11-27T20:03:30.624Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Paxton Products: Net2 Problem Types: CWE-798 Description: When installing the Net2 software a root certificate is installed into the trusted store. A potential hacker could access the installer batch file or reverse engineer the source code to gain access to the root certificate password. Using the root certificate and password they could then create their own certificates to emulate another site. Then by establishing a proxy service to emulate the site they could monitor traffic passed between the e
e another site. Then by establishing a proxy service to emulate the site they could monitor traffic passed between the end user and the site allowing access to the data content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.paxton-access.com/systems/net2/
CVE ID: CVE-2023-43871 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-23T19:19:40.845Z Vendors: n/a Products: n/a Problem Types: n/a Description: A File upload vulnerability in WBCE v.1.6.1 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/WBCE-File-Upload--XSS---Media/blob/main/README.md - https://github.com/sromanhu/CVE-2023-43871-WBCE-Arbitrary-File-Upload--XSS---Media/blob/main/README.md
CVE ID: CVE-2023-43872 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-23T19:18:39.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: A File upload vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/CMSmadesimple-File-Upload--XSS---File-Manager
CVE ID: CVE-2023-43873 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-23T19:17:58.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Name filed in the Manage Menu. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/e107-CMS-Stored-XSS---Manage/blob/main/README.md
CVE ID: CVE-2023-43874 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-23T19:24:40.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Copyright and Author fields in the Meta & Custom Tags Menu. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/e107-CMS-Stored-XSS---MetaCustomTags/blob/main/README.md
CVE ID: CVE-2023-43875 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-09-12T19:49:57.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost, dbname, dbuser, adminusername and adminemail. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/Subrion-CMS-Reflected-XSS---Installation/blob/main/README.md - https://github.com/sromanhu/CVE-2023-43875-Subrion-CMS-Reflected-XSS---Installation/blob/main/README.md
CVE ID: CVE-2023-43876 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-23T19:17:11.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/October-CMS-Reflected-XSS---Installation/blob/main/README.md
CVE ID: CVE-2023-43877 State: PUBLISHED Published: 2023-10-04T00:00:00 Last Updated: 2024-09-19T19:19:37.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via a payload crafted in the Home Page fields in the Administration menu. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/RiteCMS-Stored-XSS---Home - https://github.com/sromanhu/CVE-2023-43878-RiteCMS-Stored-XSS---MainMenu/blob/main/README.md
CVE ID: CVE-2023-43878 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-23T19:16:36.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via a crafted payload into the Main Menu Items in the Administration Menu. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/RiteCMS-Stored-XSS---MainMenu/blob/main/README.md
CVE ID: CVE-2023-43879 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-23T18:14:28.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rite CMS 3.0 has a Cross-Site scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload into the Global Content Blocks in the Administration Menu. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/RiteCMS-Stored-XSS---GlobalContent/tree/main
CVE ID: CVE-2023-43884 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-23T19:15:42.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Reference ID' parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dpuenteramirez/XSS-ReferenceID-Subrion_4.2.1
CVE ID: CVE-2023-43885 State: PUBLISHED Published: 2023-11-07T00:00:00 Last Updated: 2024-09-05T13:17:13.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: Missing error handling in the HTTP server component of Tenda RX9 Pro Firmware V22.03.02.20 allows authenticated attackers to arbitrarily lock the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.rtlcopymemory.com/tenda-rx9-pro/
CVE ID: CVE-2023-43886 State: PUBLISHED Published: 2023-11-07T00:00:00 Last Updated: 2024-09-05T13:15:21.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in the HTTP server component of Tenda RX9 Pro v22.03.02.20 might allow an authenticated attacker to overwrite memory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.rtlcopymemory.com/tenda-rx9-pro/
CVE ID: CVE-2023-43887 State: PUBLISHED Published: 2023-11-22T00:00:00 Last Updated: 2024-11-26T19:41:57.123Z Vendors: n/a Products: n/a Problem Types: n/a Description: Libde265 v1.0.12 was discovered to contain multiple buffer overflows via the num_tile_columns and num_tile_row parameters in the function pic_parameter_set::dump. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/strukturag/libde265/issues/418 - https://github.com/strukturag/libde265/commit/63b596c915977f038eafd7647d1db25488a8c133 - https://lists.debian.org/debian-lts-announce/2023/11/msg00032.html
CVE ID: CVE-2023-43890 State: PUBLISHED Published: 2023-10-02T00:00:00 Last Updated: 2024-09-20T19:59:39.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the diagnostic tools page. This vulnerability is exploited via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/adhikara13/CVE/blob/main/netis_N3/command%20injection%20bypass%20filter.md
CVE ID: CVE-2023-43891 State: PUBLISHED Published: 2023-10-02T00:00:00 Last Updated: 2024-09-20T20:00:13.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the Changing Username and Password function. This vulnerability is exploited via a crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/adhikara13/CVE/blob/main/netis_N3/command%20injection%20in%20changing%20password%20feature.md
CVE ID: CVE-2023-43892 State: PUBLISHED Published: 2023-10-02T00:00:00.000Z Last Updated: 2025-04-04T20:43:42.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the Hostname parameter within the WAN settings. This vulnerability is exploited via a crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/adhikara13/CVE/blob/main/netis_N3/blind%20command%20injection%20in%20hostname%20parameter%20in%20wan%20settings.md
CVE ID: CVE-2023-43893 State: PUBLISHED Published: 2023-10-02T00:00:00 Last Updated: 2024-09-20T18:23:33.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the wakeup_mac parameter in the Wake-On-LAN (WoL) function. This vulnerability is exploited via a crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/adhikara13/CVE/blob/main/netis_N3/blind%20command%20injection%20in%20wake%20on%20lan%20functionality%20in%20wakeup_mac%20parameter.md
CVE ID: CVE-2023-43896 State: PUBLISHED Published: 2023-10-10T00:00:00 Last Updated: 2024-09-19T14:59:08.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in Macrium Reflect 8.1.7544 and below allows attackers to escalate privileges or execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://macrium.com - https://northwave-cybersecurity.com/vulnerability-notice/macrium-reflect-driver-out-of-bounds-write - https://knowledgebase.macrium.com/display/KNOW80/CVE-2023-43896+Advisory
CVE ID: CVE-2023-43898 State: PUBLISHED Published: 2023-10-03T00:00:00.000Z Last Updated: 2025-06-17T15:07:46.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nothings stb 2.28 was discovered to contain a Null Pointer Dereference via the function stbi__convert_format. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted pic file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nothings/stb/issues/1452 - https://github.com/peccc/null-stb - https://github.com/nothings/stb/pull/1454
CVE ID: CVE-2023-43899 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-09-19T15:53:55.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: hansun CMS v1.0 was discovered to contain a SQL injection vulnerability via the component /ajax/ajax_login.ashx. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/len0m0/hansuncmssqli/blob/main/README.md - https://gist.github.com/len0m0/9cb2e87cb517db297be1b2f110248295
CVE ID: CVE-2023-43900 State: PUBLISHED Published: 2023-11-14T00:00:00 Last Updated: 2024-09-03T16:00:20.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Direct Object References (IDOR) in EMSigner v2.8.7 allow attackers to gain unauthorized access to application content and view sensitive data of other users via manipulation of the documentID and EncryptedDocumentId parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://secpro.llc/emsigner-cve-3/
CVE ID: CVE-2023-43901 State: PUBLISHED Published: 2023-11-14T00:00:00 Last Updated: 2024-09-03T15:24:50.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the AdHoc User creation form of EMSigner v2.8.7 allows unauthenticated attackers to arbitrarily modify usernames and privileges by using the email address of a registered user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://secpro.llc/EMSigner-CVE-1/
CVE ID: CVE-2023-43902 State: PUBLISHED Published: 2023-11-14T00:00:00 Last Updated: 2025-01-08T16:47:43.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the Forgot Your Password function of EMSigner v2.8.7 allows unauthenticated attackers to access accounts of all registered users, including those with administrator privileges via a crafted password reset token. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://secpro.llc/emsigner-cve-2/
CVE ID: CVE-2023-43905 State: PUBLISHED Published: 2023-10-25T00:00:00 Last Updated: 2024-09-11T19:13:42.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecified vectors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Playful-CR/CVE-paddle-/blob/main/CVE-2023-43905..md
CVE ID: CVE-2023-43906 State: PUBLISHED Published: 2023-10-25T00:00:00 Last Updated: 2024-09-11T19:29:07.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xolo CMS v0.11 was discovered to contain a reflected cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Playful-CR/CVE-paddle-/blob/main/CVE-2023-43906