Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-35896 State: PUBLISHED Published: 2023-11-03T02:14:31.552Z Last Updated: 2024-09-04T20:33:54.893Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Content Navigator Problem Types: CWE-918 Description: IBM Content Navigator 3.0.13 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 259247. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7065203 - https://exchange.xforce.ibmc
er: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7065203 - https://exchange.xforce.ibmcloud.com/vulnerabilities/259247
CVE ID: CVE-2023-35897 State: PUBLISHED Published: 2023-10-06T13:06:34.570Z Last Updated: 2024-09-19T16:04:33.532Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Storage Protect Client, Storage Protect for Virtual Environments Problem Types: CWE-94 Description: IBM Spectrum Protect Client and IBM Storage Protect for Virtual Environments 8.1.0.0 through 8.1.19.0 could allow a local user to execute arbitrary code on the system using a specially crafted file, caused by a DLL hijacking flaw. IBM X-Force ID: 259246. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7037299
st Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7037299 - https://exchange.xforce.ibmcloud.com/vulnerabilities/259246
CVE ID: CVE-2023-35898 State: PUBLISHED Published: 2023-07-19T00:46:41.821Z Last Updated: 2024-10-21T14:08:39.521Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-200 Description: IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information due to an insecure security configuration in InfoSphere Data Flow Designer. IBM X-Force ID: 259352. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7009205 - https://exchange.xforce.ibmcloud.com/vulnerabilities/259352
CVE ID: CVE-2023-35899 State: PUBLISHED Published: 2024-03-05T18:55:44.903Z Last Updated: 2024-08-02T18:59:01.678Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: IBM Products: Cloud Pak for Automation Problem Types: CWE-1236 Description: IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 259354. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www
-Force ID: 259354. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7030357 - https://exchange.xforce.ibmcloud.com/vulnerabilities/259354
CVE ID: CVE-2023-35900 State: PUBLISHED Published: 2023-07-19T00:58:53.912Z Last Updated: 2024-10-21T14:09:24.300Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Robotic Process Automation Problem Types: CWE-200 Description: IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.4 and 23.0.0 through 23.0.5 is vulnerable to disclosing server version information which may be used to determine software vulnerabilities at the operating system level. IBM X-Force ID: 259368. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7010895 - https://exchange.xforce.ib
iner: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7010895 - https://exchange.xforce.ibmcloud.com/vulnerabilities/259368
CVE ID: CVE-2023-35901 State: PUBLISHED Published: 2023-07-16T23:31:39.325Z Last Updated: 2024-10-22T13:58:28.204Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: Robotic Process Automation Problem Types: CWE-287 Description: IBM Robotic Process Automation 21.0.0 through 21.0.7.6 and 23.0.0 through 23.0.6 is vulnerable to client side validation bypass which could allow invalid changes or values in some fields. IBM X-Force ID: 259380. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7012317 - https://exchange.xforce.ibmcloud.com/vulnerabilities/259380
CVE ID: CVE-2023-35905 State: PUBLISHED Published: 2023-10-04T00:38:39.565Z Last Updated: 2024-09-19T19:27:34.999Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: IBM Products: FileNet Content Manager Problem Types: CWE-79 Description: IBM FileNet Content Manager 5.5.8, 5.5.10, and 5.5.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 259384. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/p
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7014389 - https://exchange.xforce.ibmcloud.com/vulnerabilities/259384
CVE ID: CVE-2023-35906 State: PUBLISHED Published: 2023-09-05T00:52:09.861Z Last Updated: 2024-09-27T13:53:24.680Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: Aspera Faspex Problem Types: CWE-291 Description: IBM Aspera Faspex 5.0.5 could allow a remote attacked to bypass IP restrictions due to improper access controls. IBM X-Force ID: 259649. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7029681 - https://exchange.xforce.ibmcloud.com/vulnerabilities/259649
CVE ID: CVE-2023-35907 State: PUBLISHED Published: 2025-01-29T16:37:06.966Z Last Updated: 2025-02-12T16:47:02.895Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Aspera Faspex Problem Types: CWE-521 Description: IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7181814
CVE ID: CVE-2023-35908 State: PUBLISHED Published: 2023-07-12T09:14:10.491Z Last Updated: 2024-10-04T13:43:55.033Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-863 Description: Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. It is recommended to upgrade to a version that is not affected Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/32014 - https://lists.apache.org/thread/vsflptk5dt30vrfggn96nx87d7zr6yvw
CVE ID: CVE-2023-35909 State: PUBLISHED Published: 2023-12-07T11:15:26.945Z Last Updated: 2024-08-02T16:37:40.041Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Saturday Drive Products: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress Problem Types: CWE-400 Description: Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress leading to DoS.This issue affects Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress: from n/a through 3.6.25. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vul
n/a through 3.6.25. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ninja-forms/wordpress-ninja-forms-plugin-3-6-25-denial-of-service-attack-vulnerability?_s_id=cve
CVE ID: CVE-2023-35910 State: PUBLISHED Published: 2023-11-03T23:11:32.732Z Last Updated: 2025-02-19T21:22:22.188Z Vendors: Nucleus_genius Products: Quasar form free – Contact Form Builder for WordPress Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nucleus_genius Quasar form free – Contact Form Builder for WordPress allows SQL Injection.This issue affects Quasar form free – Contact Form Builder for WordPress: from n/a through 6.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/quasar-form/wordpress-quasar-form-plug
ISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/quasar-form/wordpress-quasar-form-plugin-6-0-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-35911 State: PUBLISHED Published: 2023-11-06T08:44:50.849Z Last Updated: 2025-02-26T21:11:10.345Z Vendors: Creative Solutions Products: Contact Form Generator : Creative form builder for WordPress Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Creative Solutions Contact Form Generator : Creative form builder for WordPress allows SQL Injection.This issue affects Contact Form Generator : Creative form builder for WordPress: from n/a through 2.6.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/contact
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/contact-form-generator/wordpress-contact-form-generator-plugin-2-6-0-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-35912 State: PUBLISHED Published: 2023-07-10T15:47:34.388Z Last Updated: 2024-10-07T19:13:47.635Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WP Zone Products: Potent Donations for WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Zone Potent Donations for WooCommerce plugin <= 1.1.9 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/donations-for-woocommerce/wordpress-potent-donations-for-woocommerce-plugin-1-1-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-35913 State: PUBLISHED Published: 2023-07-11T08:21:34.594Z Last Updated: 2024-10-11T15:06:08.378Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: OOPSpam Products: OOPSpam Anti-Spam Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in OOPSpam OOPSpam Anti-Spam plugin <= 1.1.44 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/oopspam-anti-spam/wordpress-oopspam-anti-spam-plugin-1-1-44-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-35914 State: PUBLISHED Published: 2023-12-20T15:18:16.247Z Last Updated: 2024-08-02T16:37:40.041Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: WooCommerce Products: Woo Subscriptions Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo Subscriptions: from n/a through 5.1.2. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woocommerce-subscriptions/wordpress-woocommerce-subscriptions-plugin-5-1-2-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE ID: CVE-2023-35915 State: PUBLISHED Published: 2023-12-20T15:15:38.226Z Last Updated: 2024-08-02T16:37:40.578Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Automattic Products: WooPayments – Fully Integrated Solution Built and Supported by Woo Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 5.9.0. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/dat
Woo: from n/a through 5.9.0. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woocommerce-payments/wordpress-woocommerce-payments-plugin-5-9-0-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-35916 State: PUBLISHED Published: 2023-12-20T15:12:38.385Z Last Updated: 2024-08-02T16:37:40.517Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Automattic Products: WooPayments – Fully Integrated Solution Built and Supported by Woo Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 5.9.0. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woocommerce-pay
onal Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woocommerce-payments/wordpress-woocommerce-payments-plugin-5-9-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE ID: CVE-2023-35917 State: PUBLISHED Published: 2023-06-22T11:47:52.610Z Last Updated: 2024-10-17T20:53:43.053Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WooCommerce Products: WooCommerce PayPal Payments Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce PayPal Payments plugin <= 2.0.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woocommerce-paypal-payments/wordpress-woocommerce-paypal-payments-plugin-2-0-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-35918 State: PUBLISHED Published: 2023-06-22T11:47:22.258Z Last Updated: 2024-10-10T17:23:09.026Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: WooCommerce Products: Bulk Stock Management Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Bulk Stock Management plugin <= 2.2.33 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woocommerce-bulk-stock-management/wordpress-woocommerce-bulk-stock-management-plugin-2-2-33-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-35920 State: PUBLISHED Published: 2023-07-11T09:07:08.275Z Last Updated: 2024-11-12T16:53:53.862Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC MV540 H, SIMATIC MV540 S, SIMATIC MV550 H, SIMATIC MV550 S, SIMATIC MV560 U, SIMATIC MV560 X Problem Types: CWE-400 Description: A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4), SIMATIC MV550 S (All versions < V3.3.4), SIMATIC MV560 U (All versions < V3.3.4), SIMATIC MV560 X (All versions < V3.3.4). Affected devices cannot properly process specially
U (All versions < V3.3.4), SIMATIC MV560 X (All versions < V3.3.4). Affected devices cannot properly process specially crafted IP packets sent to the devices. This could allow an unauthenticated remote attacker to cause a denial of service condition. The affected devices must be restarted manually. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-561322.pdf
CVE ID: CVE-2023-35921 State: PUBLISHED Published: 2023-07-11T09:07:09.314Z Last Updated: 2024-11-13T14:28:33.242Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC MV540 H, SIMATIC MV540 S, SIMATIC MV550 H, SIMATIC MV550 S, SIMATIC MV560 U, SIMATIC MV560 X Problem Types: CWE-400 Description: A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4), SIMATIC MV550 S (All versions < V3.3.4), SIMATIC MV560 U (All versions < V3.3.4), SIMATIC MV560 X (All versions < V3.3.4). Affected devices cannot properly process specially
U (All versions < V3.3.4), SIMATIC MV560 X (All versions < V3.3.4). Affected devices cannot properly process specially crafted Ethernet frames sent to the devices. This could allow an unauthenticated remote attacker to cause a denial of service condition. The affected devices must be restarted manually. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-561322.pdf
CVE ID: CVE-2023-35924 State: PUBLISHED Published: 2023-07-05T19:35:33.232Z Last Updated: 2024-10-18T19:58:12.082Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-89 Description: GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.8, GLPI inventory endpoint can be used to drive a SQL injection attack. By default, GLPI inventory endpoint requires no authentication. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native inventory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gith
native inventory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-gxh4-j63w-8jmm - https://github.com/glpi-project/glpi/releases/tag/10.0.8
CVE ID: CVE-2023-35925 State: PUBLISHED Published: 2023-06-23T15:07:03.431Z Last Updated: 2024-11-27T21:02:52.576Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IntellectualSites Products: FastAsyncWorldEdit Problem Types: CWE-400 Description: FastAsyncWorldEdit (FAWE) is designed for efficient world editing. This vulnerability enables the attacker to select a region with the `Infinity` keyword (case-sensitive!) and executes any operation. This has a possibility of bringing the performing server down. This issue has been fixed in version 2.6.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Inte
2.6.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/IntellectualSites/FastAsyncWorldEdit/security/advisories/GHSA-whj9-m24x-qhhp - https://github.com/IntellectualSites/FastAsyncWorldEdit/pull/2285 - https://github.com/IntellectualSites/FastAsyncWorldEdit/releases/tag/2.6.3
CVE ID: CVE-2023-35926 State: PUBLISHED Published: 2023-06-22T13:29:03.361Z Last Updated: 2024-12-05T17:48:07.987Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: backstage Products: backstage Problem Types: CWE-94 Description: Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by design allows for code injection. The library used for this sandbox so far has been `vm2`, but in light of several past vulnerabilities and existing vulnerabilities that may not have a fix, the plugin has switched to using a different sandbox library. A malicious actor with write
ties that may not have a fix, the plugin has switched to using a different sandbox library. A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template YAML definition itself and not by user input data. This is vulnerability is fixed in version 1.15.0 of `@backstage/plugin-scaffolder-backend`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/backstage/backstage/security/advisories/GHSA-wg6p-jmpc-xjmr - https://github.com/backstage/backstage/commit/fb7375507d56faedcb7bb
/backstage/security/advisories/GHSA-wg6p-jmpc-xjmr - https://github.com/backstage/backstage/commit/fb7375507d56faedcb7bb3665480070593c8949a - https://github.com/backstage/backstage/releases/tag/v1.15.0
CVE ID: CVE-2023-35927 State: PUBLISHED Published: 2023-06-23T20:53:33.688Z Last Updated: 2024-11-07T18:29:35.811Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L) Vendors: nextcloud Products: security-advisories Problem Types: CWE-284 Description: NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, when two server are registered as trusted servers
24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, when two server are registered as trusted servers for each other and successfully exchanged the share secrets, the malicious server could modify or delete VCards in the system addressbook on the origin server. This would impact the available and shown information in certain places, such as the user search and avatar menu. If a manipulated user modifies their own data in the personal settings the entry is fixed again. Nextcloud Server n 25.0.7 and 26.0.2 and Nextcloud Enterprise Server 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7, and 26.0.2 contain a patch for this issue. A workaround is available. Remove all truste
2, 23.0.12.7, 24.0.12.2, 25.0.7, and 26.0.2 contain a patch for this issue. A workaround is available. Remove all trusted servers in the "Administration" > "Sharing" settings `…/index.php/settings/admin/sharing`. Afterwards, trigger a recreation of the local system addressbook with the following `occ dav:sync-system-addressbook`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h7f7-535f-7q87 - https://github.com/nextcloud/server/pull/38247 - https://hackerone.com/reports/1976754
CVE ID: CVE-2023-35928 State: PUBLISHED Published: 2023-06-23T20:58:33.225Z Last Updated: 2024-12-05T16:18:09.131Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: nextcloud Products: security-advisories Problem Types: CWE-274 Description: Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 19.0.0 until 19.0.13.9, 20.0.0 until 20.0.14.14, 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, a user could use this funct