Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-49994 State: PUBLISHED Published: 2023-12-12T00:00:00.000Z Last Updated: 2025-11-04T18:20:28.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: Espeak-ng 1.52-dev was discovered to contain a Floating Point Exception via the function PeaksToHarmspect at wavegen.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/espeak-ng/espeak-ng/issues/1823 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4/
CVE ID: CVE-2023-49999 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-11-26T15:30:10.704Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W30E V16.01.0.12(4843) was discovered to contain a command injection vulnerability via the function setUmountUSBPartition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_setUmountUSBPartition/w30e_setUmountUSBPartition.md
CVE ID: CVE-2023-4000 State: PUBLISHED Published: 2023-08-31T05:33:11.745Z Last Updated: 2025-02-05T19:32:42.266Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: pluginbuilders Products: Waiting: One-click countdowns Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Waiting: One-click countdowns plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.2. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to create and delete countdowns, via forged request granted they can trick a site administrator into performing
tackers to create and delete countdowns, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7ffba592-6d0d-408f-89fa-079066750b0a?source=cve - https://plugins.trac.wordpress.org/browser/waiting/trunk/waiting.php?rev=2826039
CVE ID: CVE-2023-4001 State: PUBLISHED Published: 2024-01-15T11:10:19.517Z Last Updated: 2025-11-20T19:52:00.512Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 8 Problem Types: CWE-290 Description: An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the password hash for the GRUB password protection feature. An attacker capable of attaching an external drive such as a USB stick contai
for the GRUB password protection feature. An attacker capable of attaching an external drive such as a USB stick containing a file system with a duplicate UUID (the same as in the "/boot/" file system) can bypass the GRUB password protection feature on UEFI systems, which enumerate removable drives before non-removable ones. This issue was introduced in a downstream patch in Red Hat's version of grub2 and does not affect the upstream package. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:0437 - https://access.redhat.com/errata/RHSA-2024:0456 - https://access.redhat.com/errata/RHSA-2024:0468 - https://acce
:0437 - https://access.redhat.com/errata/RHSA-2024:0456 - https://access.redhat.com/errata/RHSA-2024:0468 - https://access.redhat.com/security/cve/CVE-2023-4001 - https://bugzilla.redhat.com/show_bug.cgi?id=2224951 - https://dfir.ru/2024/01/15/cve-2023-4001-a-vulnerability-in-the-downstream-grub-boot-manager/
CVE ID: CVE-2023-4002 State: PUBLISHED Published: 2023-08-04T00:30:28.797Z Last Updated: 2024-10-03T06:23:13.894Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-201 Description: An issue has been discovered in GitLab EE affecting all versions starting from 14.1 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for EE-licensed users to link any security policy project by its ID to projects or groups the user has access to, potentially revealing the security projects's configured security policies. Additional Analyst Notes: - CVE Program Conta
otentially revealing the security projects's configured security policies. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/416647
CVE ID: CVE-2023-4003 State: PUBLISHED Published: 2023-09-27T12:11:23.114Z Last Updated: 2024-09-23T20:08:03.356Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: One Products: One Problem Types: CWE-250 Description: One Identity Password Manager version 5.9.7.1 - An unauthenticated attacker with physical access to a workstation may upgrade privileges to SYSTEM through an unspecified method. CWE-250: Execution with Unnecessary Privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2023-4004 State: PUBLISHED Published: 2023-07-31T16:22:18.380Z Last Updated: 2025-11-08T03:13:35.436Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux
x 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-416 Description: A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/e
r privileges on the system. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:4961 - https://access.redhat.com/errata/RHSA-2023:4962 - https://access.redhat.com/errata/RHSA-2023:4967 - https://access.redhat.com/errata/RHSA-2023:5069 - https://access.redhat.com/errata/RHSA-2023:5091 - https://access.redhat.com/errata/RHSA-2023:5093 - https://access.redhat.com/errata/RHSA-2023:5221 - https://access.redhat.com/errata/RHSA-2023:5244 - https://access.redhat.com/errata/RHSA-2023:5255 - https://access.redhat.com/errata/RHSA-2023:5548 - https://access.redhat.com/errata/RHSA-2023:5627 - https://access.redhat.com/errata/RHSA-2023:7382 - https:/
-2023:5548 - https://access.redhat.com/errata/RHSA-2023:5627 - https://access.redhat.com/errata/RHSA-2023:7382 - https://access.redhat.com/errata/RHSA-2023:7389 - https://access.redhat.com/errata/RHSA-2023:7411 - https://access.redhat.com/errata/RHSA-2023:7417 - https://access.redhat.com/errata/RHSA-2023:7431 - https://access.redhat.com/errata/RHSA-2023:7434 - https://access.redhat.com/security/cve/CVE-2023-4004 - https://bugzilla.redhat.com/show_bug.cgi?id=2225275 - https://patchwork.ozlabs.org/project/netfilter-devel/patch/20230719190824.21196-1-fw@strlen.de/
CVE ID: CVE-2023-4005 State: PUBLISHED Published: 2023-07-31T00:00:19.477Z Last Updated: 2024-10-11T19:42:51.262Z Severity: LOW (CVSS 3.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: fossbilling Products: fossbilling/fossbilling Problem Types: CWE-613 Description: Insufficient Session Expiration in GitHub repository fossbilling/fossbilling prior to 0.5.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/f0aacce1-79bc-4765-95f1-7e824433b9e4 - https://github.com/fossbilling/fossbilling/commit/20c23b051eb690cb4ae60a257f6bb46eb3aae2d1
CVE ID: CVE-2023-4006 State: PUBLISHED Published: 2023-07-31T00:00:20.202Z Last Updated: 2024-10-11T19:41:41.559Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-1236 Description: Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/36149a42-cbd5-445e-a371-e351c899b189 - https://github.com/thorsten/phpmyfaq/commit/03946eca488724251eaed8d9d36fed92e6d8fd22
CVE ID: CVE-2023-4007 State: PUBLISHED Published: 2023-07-31T00:00:43.190Z Last Updated: 2024-10-11T19:13:31.117Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.16. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/e891dcbc-2092-49d3-9518-23e37187a5ea - https://github.com/thorsten/phpmyfaq/commit/40eb9685198128908e83c2bef4c228751fd43a0e
CVE ID: CVE-2023-4008 State: PUBLISHED Published: 2023-08-03T06:31:21.677Z Last Updated: 2024-10-03T06:23:13.999Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-708 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to takeover GitLab Pages with unique domain URLs if the random string added was known. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/415942
CVE ID: CVE-2023-4009 State: PUBLISHED Published: 2023-08-08T08:37:20.529Z Last Updated: 2025-02-13T17:03:23.334Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: MongoDB Inc. Products: MongoDB Ops Manager Problem Types: CWE-648 Description: In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-serve
ADP Vulnrichment: References: - https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-6-0 - https://www.mongodb.com/docs/ops-manager/v5.0/release-notes/application/#onprem-server-5-0-22 - https://security.netapp.com/advisory/ntap-20230831-0013/
CVE ID: CVE-2023-4010 State: PUBLISHED Published: 2023-07-31T16:22:24.371Z Last Updated: 2025-11-20T19:52:05.501Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-835 Description: A flaw was found in the USB Host Controller Driver framework in the Linux kernel. The usb_giveback_urb function has a logic loophole in its implementation. Due to the inappropriate judgment condition of the goto statement, the function cannot return under the input of a specific malformed descriptor file, so it falls into an endless loop
nt, the function cannot return under the input of a specific malformed descriptor file, so it falls into an endless loop, resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-4010 - https://bugzilla.redhat.com/show_bug.cgi?id=2227726 - https://github.com/wanrenmi/a-usb-kernel-bug
CVE ID: CVE-2023-4011 State: PUBLISHED Published: 2023-08-02T05:30:35.128Z Last Updated: 2024-10-03T06:23:14.085Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource consumption resulting in DoS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/409367
CVE ID: CVE-2023-4012 State: PUBLISHED Published: 2023-08-07T17:30:33.452Z Last Updated: 2024-08-30T15:47:52.675Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: NTPsec Products: ntpsec Problem Types: CWE-372 Description: ntpd will crash if the server is not NTS-enabled (no certificate) and it receives an NTS-enabled client request (mode 3). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/NTPsec/ntpsec/-/issues/794 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1038422
CVE ID: CVE-2023-4013 State: PUBLISHED Published: 2023-08-30T14:22:02.044Z Last Updated: 2025-04-23T16:19:00.440Z Vendors: Unknown Products: GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent) Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent) WordPress plugin before 4.12.5 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/54e4494c-a280-4d91-803d-7d55159cdbc5
CVE ID: CVE-2023-4014 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:04:52.537Z Description: No description available.
CVE ID: CVE-2023-4015 State: PUBLISHED Published: 2023-09-06T13:52:44.724Z Last Updated: 2025-02-13T17:03:23.988Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Kernel Problem Types: CWE-416 Description: A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used. We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2. Additional Analyst Notes: - CVE Program Container:
mmend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0a771f7b266b02d262900c75f1e175c7fe76fec2 - https://kernel.dance/0a771f7b266b02d262900c75f1e175c7fe76fec2 - https://www.debian.org/security/2023/dsa-5492
CVE ID: CVE-2023-4016 State: PUBLISHED Published: 2023-08-02T04:20:20.645Z Last Updated: 2025-02-13T17:03:24.515Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Linux Products: Linux Kernal Problem Types: CWE-122 Description: Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/procps-ng/procps - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SUETRRT24OFGPYK6ACPM5VUGHNKH5CQ5/
CVE ID: CVE-2023-4017 State: PUBLISHED Published: 2024-06-29T11:50:44.441Z Last Updated: 2024-08-02T07:17:11.369Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: everthemess Products: Goya Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’, 'attra-size', and 'product-cata' parameters in versions up to, and including, 1.0.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if t
scaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2cce2a10-3d5f-4249-9085-923a1fa76385?source=cve - https://themeforest.net/item/goya-modern-woocommerce-theme/25175097 - https://goya.everthemes.com/help-center/changelog/#1-0-8-8-august-7-2023
CVE ID: CVE-2023-4018 State: PUBLISHED Published: 2023-09-01T10:30:41.985Z Last Updated: 2025-11-20T04:09:28.335Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-425 Description: An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to create model experiments in public projects. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/420301 - https://hackerone.com/reports/2083440
CVE ID: CVE-2023-4019 State: PUBLISHED Published: 2023-09-04T11:27:02.512Z Last Updated: 2025-04-23T16:17:56.670Z Vendors: Unknown Products: Media from FTP Problem Types: CWE-863 Incorrect Authorization Description: The Media from FTP WordPress plugin before 11.17 does not properly limit who can use the plugin, which may allow users with author+ privileges to move files around, like wp-config.php, which may lead to RCE in some cases. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0d323b07-c6e7-4aba-85bc-64659ad0c85d
CVE ID: CVE-2023-4020 State: PUBLISHED Published: 2023-12-15T20:37:20.123Z Last Updated: 2024-09-26T14:11:59.084Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: silabs.com Products: GSDK Problem Types: CWE-125, CWE-787 Description: An unvalidated input in a library function responsible for communicating between secure and non-secure memory in Silicon Labs TrustZone implementation allows reading/writing of memory in the secure region of memory from the non-secure region of memory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SiliconLabs/gecko_sdk/releases - https://community.silabs.com/069Vm0000004b95IAA
CVE ID: CVE-2023-4021 State: PUBLISHED Published: 2023-10-20T07:29:39.818Z Last Updated: 2025-02-05T19:02:47.972Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: webnus/ Products: Modern Events Calendar Lite Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Modern Events Calendar lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Google API key and Calendar ID in versions up to, but not including, 7.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, t
d output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f213fb42-5bab-4017-80ea-ce6543031af2?source=cve - https://webnus.net/modern-events-calendar/change-log/
CVE ID: CVE-2023-4022 State: PUBLISHED Published: 2023-09-11T19:46:06.069Z Last Updated: 2025-04-23T16:16:56.932Z Vendors: Unknown Products: Herd Effects Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Herd Effects WordPress plugin before 5.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c4ac0b19-58b1-4620-b3b7-fbe6dd6c8dd5
CVE ID: CVE-2023-4023 State: PUBLISHED Published: 2023-08-30T14:22:03.825Z Last Updated: 2025-05-05T15:18:57.229Z Vendors: Unknown Products: All Users Messenger Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/682c0226-28bd-4051-830d-8b679626213d
CVE ID: CVE-2023-4024 State: PUBLISHED Published: 2024-08-17T07:34:21.024Z Last Updated: 2024-08-19T15:13:13.059Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: princeahmed Products: Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress Problem Types: CWE-862 Description: The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_player function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to delete player instances. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.co
rs to delete player instances. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3f408f1f-207e-427a-a5d0-d0fadf453d7e?source=cve - https://plugins.svn.wordpress.org/radio-player/tags/2.0.7/readme.txt - https://plugins.trac.wordpress.org/changeset/2942906/radio-player/trunk/includes/class-ajax.php - https://plugins.trac.wordpress.org/changeset/3048105
CVE ID: CVE-2023-4025 State: PUBLISHED Published: 2024-08-17T07:34:24.054Z Last Updated: 2024-08-19T18:20:59.587Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: princeahmed Products: Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress Problem Types: CWE-862 Description: The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_player function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update player instances. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.co