Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-5874 State: PUBLISHED Published: 2023-12-04T21:28:13.541Z Last Updated: 2024-11-21T19:21:06.239Z Vendors: Unknown Products: Popup box Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ebe3e873-1259-43b9-a027-daa4dbd937f3
CVE ID: CVE-2023-5875 State: PUBLISHED Published: 2023-11-02T08:27:05.082Z Last Updated: 2024-09-05T18:12:33.829Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Desktop Problem Types: CWE-693 Description: Mattermost Desktop fails to correctly handle permissions or prompt the user for consent on certain sensitive ones allowing media exploitation from a malicious mattermost server Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-5876 State: PUBLISHED Published: 2023-11-02T08:26:01.611Z Last Updated: 2024-09-05T18:12:06.794Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Desktop Problem Types: CWE-400 Description: Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-5877 State: PUBLISHED Published: 2024-01-01T14:18:58.165Z Last Updated: 2025-06-03T14:54:16.413Z Vendors: Unknown Products: affiliate-toolkit Problem Types: CWE-918 Server-Side Request Forgery (SSRF) Description: The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/39ed493
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/39ed4934-3d91-4924-8acc-25759fef9e81
CVE ID: CVE-2023-5878 State: PUBLISHED Published: 2025-02-06T14:10:30.295Z Last Updated: 2025-02-18T18:13:44.990Z Vendors: Honeywell Products: OneWireless Network Wireless Device Manager Problem Types: CWE-77 Description: Honeywell OneWireless Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 contains a command injection vulnerability. An attacker who is authenticated could use the firmware update process to potentially exploit the vulnerability, leading to a command injection. Honeywell recommends updating to R322.3, R330.2 or the most recent version of this product2. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
22.3, R330.2 or the most recent version of this product2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://process.honeywell.com/
CVE ID: CVE-2023-5879 State: PUBLISHED Published: 2024-01-03T19:15:59.436Z Last Updated: 2025-06-17T19:39:08.880Z Vendors: The Genie Company Products: Aladdin Connect Mobile Application Problem Types: CWE-922 Description: Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 (and below) on Android Devices. This allows the attacker, with access to the android device, to potentially retrieve users' clear text authentication credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/2024/01/03/genie-aladdin-connect-retrofit-ga
er: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/2024/01/03/genie-aladdin-connect-retrofit-garage-door-opener-multiple-vulnerabilities/
CVE ID: CVE-2023-5880 State: PUBLISHED Published: 2024-01-03T19:16:44.618Z Last Updated: 2024-08-27T15:30:42.784Z Vendors: The Genie Company Products: Aladdin Connect (Retrofit-Kit) Problem Types: CWE-79 Description: When the Genie Company Aladdin Connect garage door opener (Retrofit-Kit Model ALDCM) is placed into configuration mode the web servers “Garage Door Control Module Setup” page is vulnerable to XSS via a broadcast SSID name containing malicious code with client side Java Script and/or HTML. This allows the attacker to inject malicious code with client side Java Script and/or HTML into the users' web browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichmen
cript and/or HTML into the users' web browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/2024/01/03/genie-aladdin-connect-retrofit-garage-door-opener-multiple-vulnerabilities/
CVE ID: CVE-2023-5881 State: PUBLISHED Published: 2024-01-03T19:22:08.506Z Last Updated: 2024-09-05T20:52:05.695Z Vendors: The Genie Company Products: Aladdin Connect (Retrofit-Kit) Problem Types: CWE-306 Description: Unauthenticated access permitted to web interface page The Genie Company Aladdin Connect (Retrofit-Kit Model ALDCM) "Garage Door Control Module Setup" and modify the Garage door's SSID settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/2024/01/03/genie-aladdin-connect-retrofit-garage-door-opener-multiple-vulnerabilities/
CVE ID: CVE-2023-5882 State: PUBLISHED Published: 2023-12-18T20:08:04.861Z Last Updated: 2024-11-21T19:22:55.348Z Vendors: Unknown Products: Export any WordPress data to XML/CSV, WP All Export Pro Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/72be4b5c-21be-46af-a3
: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/72be4b5c-21be-46af-a3f4-08b4c190a7e2
CVE ID: CVE-2023-5884 State: PUBLISHED Published: 2023-12-04T21:29:32.963Z Last Updated: 2024-08-02T08:14:24.267Z Vendors: Unknown Products: Word Balloon Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f4a7937c-6f4b-49dd-b88a-67ebe718ad19
CVE ID: CVE-2023-5885 State: PUBLISHED Published: 2023-11-27T21:48:30.996Z Last Updated: 2024-08-02T08:14:24.628Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Franklin Electric Fueling Systems Products: Colibri Problem Types: CWE-35 Description: The discontinued FFS Colibri product allows a remote user to access files on the system including files containing login credentials for other users. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/ICSA-23-331-02 - https://www.franklinfueling.com/en/landing-pages/firmware/colibri-firmware/ - https://www.franklinfueling.com/en/contact-us/
CVE ID: CVE-2023-5886 State: PUBLISHED Published: 2023-12-18T20:07:57.546Z Last Updated: 2024-08-02T08:14:24.320Z Vendors: Unknown Products: Export any WordPress data to XML/CSV, WP All Export Pro Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the ability to upload files to make logged in users perform unwanted actions leading to PHAR deserialization, which may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https:
zation, which may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0a08e49d-d34e-4140-a15d-ad64444665a3
CVE ID: CVE-2023-5888 State: REJECTED Published: N/A Last Updated: 2024-08-16T19:05:56.787Z Description: No description available.
CVE ID: CVE-2023-5889 State: PUBLISHED Published: 2023-11-01T00:00:18.857Z Last Updated: 2024-09-12T19:46:53.033Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: pkp Products: pkp/pkp-lib Problem Types: CWE-613 Description: Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/fba2991a-1b8a-4c89-9689-d708526928e1 - https://github.com/pkp/pkp-lib/commit/32d071ef2090fc336bc17d56a86d1dff90c26f0b
CVE ID: CVE-2023-5890 State: PUBLISHED Published: 2023-11-01T00:00:18.404Z Last Updated: 2025-02-27T20:38:32.041Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: pkp Products: pkp/pkp-lib Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/b60e6e1f-e44d-4b11-acf8-b0548b915686 - https://github.com/pkp/pkp-lib/commit/a868f1cdd98a4f1255a70fd6d8320511e0083f38
CVE ID: CVE-2023-5891 State: PUBLISHED Published: 2023-11-01T00:00:18.684Z Last Updated: 2025-02-27T20:38:11.533Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: pkp Products: pkp/pkp-lib Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository pkp/pkp-lib prior to 3.3.0-16. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/ce4956e4-9ef5-4e0e-bfb2-481ec5cfb0a5 - https://github.com/pkp/pkp-lib/commit/d4111c4d0eef783f1ed2e55654a5b83d9d527d97
CVE ID: CVE-2023-5892 State: PUBLISHED Published: 2023-11-01T00:00:18.543Z Last Updated: 2025-02-27T20:38:17.650Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: pkp Products: pkp/pkp-lib Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/16719252-d88d-43cc-853a-24ff75a067d8 - https://github.com/pkp/pkp-lib/commit/a0485a5c7410821e0432c079ca676ee6026bffb9
CVE ID: CVE-2023-5893 State: PUBLISHED Published: 2023-11-01T00:00:18.533Z Last Updated: 2025-02-27T20:38:24.420Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: pkp Products: pkp/pkp-lib Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/a965aa16-79ce-4185-8f58-3d3b0d74a71e - https://github.com/pkp/pkp-lib/commit/992ca674e9fb705751b1cbf929a1856ebe29b30a
CVE ID: CVE-2023-5894 State: PUBLISHED Published: 2023-11-01T00:00:18.898Z Last Updated: 2025-02-27T20:38:04.550Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: pkp Products: pkp/ojs Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pkp/ojs prior to 3.3.0-16. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/aba3ba5b-aa6b-4076-b663-4237b4a0761d - https://github.com/pkp/ojs/commit/66927de1a82e3a3004db9741d1505ddac0980e63
CVE ID: CVE-2023-5895 State: PUBLISHED Published: 2023-11-01T00:00:19.147Z Last Updated: 2025-02-27T20:37:59.046Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: pkp Products: pkp/pkp-lib Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - DOM in GitHub repository pkp/pkp-lib prior to 3.3.0-16. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/2cc80417-32b2-4024-bbcd-d95a039c11ae - https://github.com/pkp/pkp-lib/commit/83fa560d6fb54458b312addd23a91ee6520dbe63
CVE ID: CVE-2023-5896 State: PUBLISHED Published: 2023-11-01T00:00:41.580Z Last Updated: 2025-02-27T20:37:46.965Z Severity: LOW (CVSS 2.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: pkp Products: pkp/pkp-lib Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.4.0-4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/a1f05be5-24ed-4ec5-9858-fce4233f7bb1 - https://github.com/pkp/pkp-lib/commit/18b318f83105ffa7fa214179f8e20507b0754236
CVE ID: CVE-2023-5897 State: PUBLISHED Published: 2023-11-01T00:00:41.904Z Last Updated: 2025-02-27T20:37:26.233Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: pkp Products: pkp/customLocale Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository pkp/customLocale prior to 1.2.0-1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/7c215b8e-63f6-4146-b8e3-8482c731876f - https://github.com/pkp/customLocale/commit/407ba30f12f78efe79122591c1d85709c10b6831
CVE ID: CVE-2023-5898 State: PUBLISHED Published: 2023-11-01T00:00:41.808Z Last Updated: 2025-02-27T20:37:32.347Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: pkp Products: pkp/pkp-lib Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/19801d12-b8ad-45e7-86e1-8f0230667c9e - https://github.com/pkp/pkp-lib/commit/01feef7a9392d314bf75b97a7e099cf0a307acd9
CVE ID: CVE-2023-5899 State: PUBLISHED Published: 2023-11-01T00:00:41.225Z Last Updated: 2025-02-27T20:37:53.080Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: pkp Products: pkp/pkp-lib Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/0c7f1981-3bba-4508-a07e-4cb9a2553216 - https://github.com/pkp/pkp-lib/commit/04e0e0eaeacd5d754b2f39c42148b31f646113c5
CVE ID: CVE-2023-5900 State: PUBLISHED Published: 2023-11-01T00:00:42.738Z Last Updated: 2024-12-03T14:36:06.991Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: pkp Products: pkp/pkp-lib Problem Types: CWE-352 Description: Cross-Site Request Forgery in GitHub repository pkp/pkp-lib prior to 3.3.0-16. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/c3f011d4-9f76-4b2b-b3d4-a5e2ecd2e354 - https://github.com/pkp/pkp-lib/commit/4d77a00be9050fac7eb8d2d1cbedcdaaa1a5a803
CVE ID: CVE-2023-5901 State: PUBLISHED Published: 2023-11-01T00:00:42.521Z Last Updated: 2024-08-02T08:14:24.974Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: pkp Products: pkp/pkp-lib Problem Types: CWE-79 Description: Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/8fb9b06b-cadd-469e-862d-5ce026019597 - https://github.com/pkp/pkp-lib/commit/44d8bde60eb2575fd4087b76540aec9b49389e23
CVE ID: CVE-2023-5902 State: PUBLISHED Published: 2023-11-01T00:00:41.753Z Last Updated: 2025-02-27T20:37:40.078Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: pkp Products: pkp/pkp-lib Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/8b93c7bf-5052-424a-85cc-7e5491c61f20 - https://github.com/pkp/pkp-lib/commit/2d04e770d2bbbdd899fdec382fbf2a1d4a4ffec8
CVE ID: CVE-2023-5903 State: PUBLISHED Published: 2023-11-01T00:00:42.777Z Last Updated: 2025-02-27T20:37:20.941Z Severity: LOW (CVSS 2.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: pkp Products: pkp/pkp-lib Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/5c147ff8-3cc4-4f21-9f1c-13fd50957dad - https://github.com/pkp/pkp-lib/commit/8b26ee404af3b11803a40e904f985f0a0b215a5c
CVE ID: CVE-2023-5904 State: PUBLISHED Published: 2023-11-01T00:01:44.457Z Last Updated: 2025-02-27T20:37:13.412Z Severity: LOW (CVSS 2.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: pkp Products: pkp/pkp-lib Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/4df6bce6-dbe3-48e4-9830-e95cdc5138b6 - https://github.com/pkp/pkp-lib/commit/aa5c6acb634fbe460765facb2dc26df4b0d7424b
CVE ID: CVE-2023-5905 State: PUBLISHED Published: 2024-01-15T15:10:43.450Z Last Updated: 2025-06-20T16:52:07.644Z Vendors: Unknown Products: DeMomentSomTres WordPress Export Posts With Images Problem Types: CWE-862 Missing Authorization Description: The DeMomentSomTres WordPress Export Posts With Images WordPress plugin through 20220825 does not check authorization of requests to export the blog data, allowing any logged in user, such as subscribers to export the contents of the blog, including restricted and unpublished posts, as well as passwords of protected posts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f9
ional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f94e91ef-1773-476c-9945-37e89ceefd3f
CVE ID: CVE-2023-5906 State: PUBLISHED Published: 2023-11-27T16:21:59.373Z Last Updated: 2024-08-02T08:14:24.813Z Vendors: Unknown Products: Job Manager & Career Problem Types: CWE-200 Information Exposure Description: The Job Manager & Career WordPress plugin before 1.4.4 contains a vulnerability in the Directory Listings system, which allows an unauthorized user to view and download private files of other users. This vulnerability poses a serious security threat because it allows an attacker to gain access to confidential data and files of other users without their permission. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/911d495c-3867-42
sion. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/911d495c-3867-4259-a73a-572cd4fccdde
CVE ID: CVE-2023-5907 State: PUBLISHED Published: 2023-12-11T19:22:37.067Z Last Updated: 2025-05-27T14:42:08.040Z Vendors: Unknown Products: File Manager Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowed to modify the sites files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.c
sites files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f250226f-4a05-4d75-93c4-5444a4ce919e
CVE ID: CVE-2023-5908 State: PUBLISHED Published: 2023-11-30T22:03:58.098Z Last Updated: 2024-08-02T08:14:24.586Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: PTC, Rockwell Automation , GE Gigital, Software Toolbox Products: KEPServerEX, ThingWorx Kepware Server, ThingWorx Industrial Connectivity, OPC-Aggregator, ThingWorx Kepware Edge, KEPServer Enterprise, Industrial Gateway Server, TOP Server Problem Types: CWE-122 Description: KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-eve
ssed or leak information. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-03
CVE ID: CVE-2023-5909 State: PUBLISHED Published: 2023-11-30T22:05:59.595Z Last Updated: 2024-08-02T08:14:24.693Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: PTC, Rockwell Automation , GE Gigital, Software Toolbox Products: KEPServerEX, ThingWorx Kepware Server, ThingWorx Industrial Connectivity, OPC-Aggregator, ThingWorx Kepware Edge, KEPServer Enterprise, Industrial Gateway Server, TOP Server Problem Types: CWE-297 Description: KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/ic
ect. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-03
CVE ID: CVE-2023-5910 State: PUBLISHED Published: 2023-11-01T23:31:05.269Z Last Updated: 2024-08-02T08:14:24.695Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: n/a Products: PopojiCMS Problem Types: CWE-79 Description: A vulnerability was found in PopojiCMS 2.0.1 and classified as problematic. This issue affects some unknown processing of the file install.php of the component Web Config. The manipulation of the argument Site Title with the input <script>alert(1)</script> leads to cross site scripting. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to t
e complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-244229 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.244229 - https://vuldb.com/?ctiid.244229 - https://github.com/hujiahua1997/popojicms2.0.1-Storage-xss-exists/blob/main/popojicms2.0.1-Storage-xss-exists.md - https://github.com/hujiahua1997/popojicms2.0.1-Storage-xss-exists/blob/main/image-20231020213521150-16978089243571.png