Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-23590 State: PUBLISHED Published: 2023-01-15T00:00:00.000Z Last Updated: 2025-04-07T15:13:00.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mercedes-Benz XENTRY Retail Data Storage 7.8.1 allows remote attackers to cause a denial of service (device restart) via an unauthenticated API request. The attacker must be on the same network as the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40windsormoreira/xentry-retail-data-storage-v7-8-1-denial-of-service-cve-2023-23590-60b65f5fa358 - https://b2bconnect.mercedes-benz.com/gb/workshop-solutions/diagnosis/retail-data-storage
CVE ID: CVE-2023-23591 State: PUBLISHED Published: 2023-04-12T00:00:00.000Z Last Updated: 2025-02-10T16:07:57.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from application server logs when debug logging is enabled. The fixed versions are 8.2.18.7, 8.2.18.2.2, 8.3.11.1, and 8.3.14.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.terminalfour.com/articles/release-notes-highlights/ - https://docs.terminalfour.com/release-notes/83/15.html
CVE ID: CVE-2023-23592 State: PUBLISHED Published: 2023-02-09T00:00:00.000Z Last Updated: 2025-03-24T19:03:51.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: WALLIX Access Manager 3.x through 4.0.x allows a remote attacker to access sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wallix.com - https://www.wallix.com/support/alerts/
CVE ID: CVE-2023-23594 State: PUBLISHED Published: 2023-03-31T00:00:00.000Z Last Updated: 2025-02-18T17:21:17.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authentication bypass vulnerability in the web client interface for the CL4NX printer before firmware version 1.13.3-u724_r2 provides remote unauthenticated attackers with access to execute commands intended only for valid/authenticated users, such as file uploads and configuration changes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.satoamerica.com/products/printers/industrial-thermal-printers/cl4nx-plus - https://hackandpwn.com/disclosures/CVE-2023-23594.pdf
ca.com/products/printers/industrial-thermal-printers/cl4nx-plus - https://hackandpwn.com/disclosures/CVE-2023-23594.pdf - https://d2n1rly8br52rx.cloudfront.net/content-blocks/files/pages/Vulnerability-Disclosure.pdf
CVE ID: CVE-2023-23595 State: PUBLISHED Published: 2023-01-15T00:00:00.000Z Last Updated: 2025-04-08T20:24:03.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, such as "machine example.com login daniel password qwerty" in the documentation example for the .netrc file format. NOTE: 2.x versions are no longer supported. There is no available information about whether any later version is affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/colemanjp/XXE-Vulnerability-in-Bluecat-
CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/colemanjp/XXE-Vulnerability-in-Bluecat-Device-Registration-Portal-DRP - https://bluecatnetworks.com/integrations/adaptive-application/device-registration-portal-drp/ - https://everything.curl.dev/usingcurl/netrc
CVE ID: CVE-2023-23596 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-03T14:42:26.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with crafted username and/or password input that is concatenated without any validation, and is directly passed to the exec command, potentially allowing an authenticated attacker to execute arbitrary commands on the system. NOTE: this is not part of any NGINX software shipped by F5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisory
hipped by F5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisory.dw1.io/57 - https://github.com/NginxProxyManager/nginx-proxy-manager/blob/4f10d129c20cc82494b95cc94b97f859dbd4b54d/backend/internal/access-list.js#L510
CVE ID: CVE-2023-23597 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-09T16:23:53.186Z Vendors: Mozilla Products: Firefox Problem Types: Logic bug in process allocation allowed to read arbitrary files Description: A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the <code>file://</code> context. Given a reliable exploit primitive, this new process could be exploited again leading to arbitrary file read. This vulnerability affects Firefox < 109. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-0
: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-01/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1538028
CVE ID: CVE-2023-23598 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-09T16:22:35.356Z Vendors: Mozilla Products: Firefox, Thunderbird, Firefox ESR Problem Types: Arbitrary file read from GTK drag and drop on Linux Description: Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to <code>DataTransfer.setData</code>. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/adv
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-02/ - https://www.mozilla.org/security/advisories/mfsa2023-01/ - https://www.mozilla.org/security/advisories/mfsa2023-03/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1800425
CVE ID: CVE-2023-23599 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-09T16:21:14.775Z Vendors: Mozilla Products: Firefox, Thunderbird, Firefox ESR Problem Types: Malicious command could be hidden in devtools output on Windows Description: When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-02/ - https://www.mozilla.
: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-02/ - https://www.mozilla.org/security/advisories/mfsa2023-01/ - https://www.mozilla.org/security/advisories/mfsa2023-03/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1777800
CVE ID: CVE-2023-23600 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-09T16:20:10.721Z Vendors: Mozilla Products: Firefox Problem Types: Notification permissions persisted between Normal and Private Browsing on Android Description: Per origin notification permissions were being stored in a way that didn't take into account what browsing context the permission was granted in. This lead to the possibility of notifications to be displayed during different browsing sessions.<br>*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 109. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
cted.*. This vulnerability affects Firefox < 109. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-01/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1787034
CVE ID: CVE-2023-23601 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-09T16:18:26.500Z Vendors: Mozilla Products: Firefox, Thunderbird, Firefox ESR Problem Types: URL being dragged from cross-origin iframe into same tab triggers navigation Description: Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-02/ - https://www.mozilla.org/security/advisories/m
: References: - https://www.mozilla.org/security/advisories/mfsa2023-02/ - https://www.mozilla.org/security/advisories/mfsa2023-01/ - https://www.mozilla.org/security/advisories/mfsa2023-03/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1794268
CVE ID: CVE-2023-23602 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-10T18:16:39.131Z Vendors: Mozilla Products: Firefox, Thunderbird, Firefox ESR Problem Types: Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers Description: A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/s
2.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-02/ - https://www.mozilla.org/security/advisories/mfsa2023-01/ - https://www.mozilla.org/security/advisories/mfsa2023-03/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1800890
CVE ID: CVE-2023-23603 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-10T18:09:25.352Z Vendors: Mozilla Products: Firefox, Thunderbird, Firefox ESR Problem Types: Calls to console.log allowed bypasing Content Security Policy via format directive Description: Regular expressions used to filter out forbidden properties and values from style directives in calls to <code>console.log</code> weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www
refox ESR < 102.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-02/ - https://www.mozilla.org/security/advisories/mfsa2023-01/ - https://www.mozilla.org/security/advisories/mfsa2023-03/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1800832
CVE ID: CVE-2023-23604 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-10T18:06:52.164Z Vendors: Mozilla Products: Firefox Problem Types: Creation of duplicate SystemPrincipal from less secure contexts Description: A duplicate <code>SystemPrincipal</code> object could be created when parsing a non-system html document via <code>DOMParser::ParseFromSafeString</code>. This could have lead to bypassing web security checks. This vulnerability affects Firefox < 109. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-01/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1802346
CVE ID: CVE-2023-23605 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-10T18:00:46.236Z Vendors: Mozilla Products: Firefox, Thunderbird, Firefox ESR Problem Types: Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7 Description: Memory safety bugs present in Firefox 108 and Firefox ESR 102.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advis
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-02/ - https://www.mozilla.org/security/advisories/mfsa2023-01/ - https://www.mozilla.org/security/advisories/mfsa2023-03/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1764921%2C1802690%2C1806974
CVE ID: CVE-2023-23606 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-10T17:51:16.619Z Vendors: Mozilla Products: Firefox Problem Types: Memory safety bugs fixed in Firefox 109 Description: Memory safety bugs present in Firefox 108. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 109. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-01/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1764974%2C1798591%2C1799201%2C1800446%2C1801248
dvisories/mfsa2023-01/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1764974%2C1798591%2C1799201%2C1800446%2C1801248%2C1802100%2C1803393%2C1804626%2C1804971%2C1807004
CVE ID: CVE-2023-23607 State: PUBLISHED Published: 2023-01-20T20:03:45.071Z Last Updated: 2025-03-10T21:21:19.983Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: erohtar Products: Dasherr Problem Types: CWE-434 Description: erohtar/Dasherr is a dashboard for self-hosted services. In affected versions unrestricted file upload allows any unauthenticated user to execute arbitrary code on the server. The file /www/include/filesave.php allows for any file to uploaded to anywhere. If an attacker uploads a php file they can execute code on the server. This issue has been addressed in version 1.05.00. Users are advised to upgrade. There are no known workarounds f
server. This issue has been addressed in version 1.05.00. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/erohtar/Dasherr/security/advisories/GHSA-6rgc-2x44-7phq - https://github.com/erohtar/Dasherr/commit/445325c7cf1148a8cd38af3a90789c6cbf6c5112
CVE ID: CVE-2023-23608 State: PUBLISHED Published: 2023-01-24T02:39:32.471Z Last Updated: 2025-03-10T21:20:38.544Z Severity: NONE (CVSS N/A CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N) Vendors: spotipy-dev Products: spotipy Problem Types: CWE-22 Description: Spotipy is a light weight Python library for the Spotify Web API. In versions prior to 2.22.1, if a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended. The code Spotipy uses to parse URIs and URLs allows an attacker to insert arbitrary characters into the path that is used for API requests. Because it is possible to include "..", an attacker can redir
ry characters into the path that is used for API requests. Because it is possible to include "..", an attacker can redirect for example a track lookup via spotifyApi.track() to an arbitrary API endpoint like playlists, but this is possible for other endpoints as well. The impact of this vulnerability depends heavily on what operations a client application performs when it handles a URI from a user and how it uses the responses it receives from the API. This issue is patched in version 2.22.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v
CVE ID: CVE-2023-23609 State: PUBLISHED Published: 2023-01-25T06:15:34.128Z Last Updated: 2025-03-11T13:32:09.104Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L) Vendors: contiki-ng Products: contiki-ng Problem Types: CWE-787 Description: Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to and including 4.8 are vulnerable to an out-of-bounds write that can occur in the BLE-L2CAP module. The Bluetooth Low Energy - Logical Link Control and Adaptation Layer Protocol (BLE-L2CAP) module handles fragmentation of packets up the configured MTU size. When fragments are reassembled, they are stored in a packet buffer
fragmentation of packets up the configured MTU size. When fragments are reassembled, they are stored in a packet buffer of a configurable size, but there is no check to verify that the packet buffer is large enough to hold the reassembled packet. In Contiki-NG's default configuration, it is possible that an out-of-bounds write of up to 1152 bytes occurs. The vulnerability has been patched in the "develop" branch of Contiki-NG, and will be included in release 4.9. The problem can be fixed by applying the patch in Contiki-NG pull request #2254 prior to the release of version 4.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/contik
4.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-qr4q-6h3m-h3g7 - https://github.com/contiki-ng/contiki-ng/pull/2254
CVE ID: CVE-2023-23610 State: PUBLISHED Published: 2023-01-25T05:46:35.549Z Last Updated: 2025-03-10T21:20:13.945Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-269 Description: GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the standard interface can export data of almost any GLPI item type, even those on which user is not allowed to access (including assets, tickets, users, ...). This issue is patched in 10.0.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
s, ...). This issue is patched in 10.0.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-6565-hm87-24hf
CVE ID: CVE-2023-23611 State: PUBLISHED Published: 2023-01-25T05:39:32.446Z Last Updated: 2025-03-10T21:20:19.828Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: openedx Products: xblock-lti-consumer Problem Types: CWE-862 Description: LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Open edX platform can post a grade back for any LTI XBlock so long as it knows or can guess the block location for that XBlock. An LTI tool submits scores to the edX platfo
XBlock so long as it knows or can guess the block location for that XBlock. An LTI tool submits scores to the edX platform for line items. The code that uploads that score to the LMS grade tables determines which XBlock to upload the grades for by reading the resource_link_id field of the associated line item. The LTI tool may submit any value for the resource_link_id field, allowing a malicious LTI tool to submit scores for any LTI XBlock on the platform. The impact is a loss of integrity for LTI XBlock grades. This issue is patched in 7.2.2. No workarounds exist. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openedx/xblock-lti-
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openedx/xblock-lti-consumer/security/advisories/GHSA-7j9p-67mm-5g87
CVE ID: CVE-2023-23612 State: PUBLISHED Published: 2023-01-24T20:36:41.876Z Last Updated: 2025-03-10T21:20:26.061Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: opensearch-project Products: security Problem Types: CWE-287 Description: OpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider (IdP) when the authentication backend is SAML or OpenID Connect. There is an issue in how those claims are processed from the JWTs where the leading and trailing whitespace is trimmed, allowing users to potentially claim roles they are not assigned to if any role matches the whitesp
hitespace is trimmed, allowing users to potentially claim roles they are not assigned to if any role matches the whitespace-stripped version of the roles they are a member of. This issue is only present for authenticated users, and it requires either the existence of roles that match, not considering leading/trailing whitespace, or the ability for users to create said matching roles. In addition, the Identity Provider must allow leading and trailing spaces in role names. OpenSearch 1.0.0-1.3.7 and 2.0.0-2.4.1 are affected. Users are advised to upgrade to OpenSearch 1.3.8 or 2.5.0. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
2.5.0. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/opensearch-project/security/security/advisories/GHSA-864v-6qj7-62qj - https://github.com/opensearch-project/OpenSearch/releases/tag/2.5.0
CVE ID: CVE-2023-23613 State: PUBLISHED Published: 2023-01-24T20:33:55.673Z Last Updated: 2025-03-10T21:20:32.391Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: opensearch-project Products: security Problem Types: CWE-200 Description: OpenSearch is an open source distributed and RESTful search engine. In affected versions there is an issue in the implementation of field-level security (FLS) and field masking where rules written to explicitly exclude fields are not correctly applied for certain queries that rely on their auto-generated .keyword fields. This issue is only present for authenticated users with read access to the indexes containing the restrict
yword fields. This issue is only present for authenticated users with read access to the indexes containing the restricted fields. This may expose data which may otherwise not be accessible to the user. OpenSearch 1.0.0-1.3.7 and 2.0.0-2.4.1 are affected. Users are advised to upgrade to OpenSearch 1.3.8 or 2.5.0. Users unable to upgrade may write explicit exclusion rules as a workaround. Policies authored in this way are not subject to this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/opensearch-project/security/security/advisories/GHSA-v3cg-7r9h-r2g6 - https://github.com/opensearch-project/OpenSearch/releases/tag/2.5.0
CVE ID: CVE-2023-23614 State: PUBLISHED Published: 2023-01-26T10:15:21.120Z Last Updated: 2025-03-10T21:19:20.064Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: pi-hole Products: AdminLTE Problem Types: CWE-613, CWE-836 Description: Pi-hole®'s Web interface (based off of AdminLTE) provides a central location to manage your Pi-hole. Versions 4.0 and above, prior to 5.18.3 are vulnerable to Insufficient Session Expiration. Improper use of admin WEBPASSWORD hash as "Remember me for 7 days" cookie value makes it possible for an attacker to "pass the hash" to login or reuse a theoretically expired "remember me" cookie. It also exposes the hash over the network an