Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-26923 State: PUBLISHED Published: 2023-03-28T00:00:00.000Z Last Updated: 2025-02-18T20:27:38.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: Musescore 3.0 to 4.0.1 has a stack buffer overflow vulnerability that occurs when reading misconfigured midi files. If attacker can additional information, attacker can execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/musescore/MuseScore/issues/16346
CVE ID: CVE-2023-26924 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T15:37:56.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: LLVM a0dab4950 has a segmentation fault in mlir::outlineSingleBlockRegion. NOTE: third parties dispute this because the LLVM security policy excludes "Language front-ends ... for which a malicious input file can cause undesirable behavior." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/llvm/llvm-project/issues/60216 - https://gist.github.com/Colloportus0/fc16d10d74aedf89d5d1d020ebb89c0c - https://llvm.org/docs/Security.html#what-is-considered-a-security-issue
CVE ID: CVE-2023-26925 State: PUBLISHED Published: 2023-03-31T00:00:00.000Z Last Updated: 2025-02-18T15:16:41.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-882 1.30. A specially crafted network request can lead to the disclosure of sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/laotun-s/POC/blob/main/CVE-2023-26925.txt
CVE ID: CVE-2023-26930 State: PUBLISHED Published: 2023-04-26T00:00:00 Last Updated: 2024-08-02T12:01:31.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via the PDFDoc malloc in the pdftotext.cc function. NOTE: Vendor states “it's an expected abort on out-of-memory error.” Additional Analyst Notes: - CVE Program Container: References: - https://github.com/huanglei3/xpdf_aborted - https://gist.github.com/huanglei3/10e2a9bd07a109995b20ade306612a34
CVE ID: CVE-2023-26931 State: REJECTED Published: N/A Last Updated: 2023-06-02T00:00:00 Description: No description available.
CVE ID: CVE-2023-26934 State: REJECTED Published: 2023-04-26T00:00:00 Last Updated: 2023-07-21T21:32:48.909Z Description: No description available.
CVE ID: CVE-2023-26935 State: REJECTED Published: 2023-04-26T00:00:00 Last Updated: 2023-07-21T21:33:38.671Z Description: No description available.
CVE ID: CVE-2023-26936 State: REJECTED Published: 2023-04-26T00:00:00 Last Updated: 2023-07-21T21:34:32.442Z Description: No description available.
CVE ID: CVE-2023-26937 State: REJECTED Published: 2023-04-26T00:00:00 Last Updated: 2023-07-21T21:34:55.045Z Description: No description available.
CVE ID: CVE-2023-26938 State: REJECTED Published: 2023-04-26T00:00:00 Last Updated: 2023-07-21T21:35:20.422Z Description: No description available.
CVE ID: CVE-2023-26941 State: PUBLISHED Published: 2023-12-04T00:00:00 Last Updated: 2024-08-02T12:01:31.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: Weak encryption mechanisms in RFID Tags in Yale Conexis L1 v1.1.0 allows attackers to create a cloned tag via physical proximity to the original. Additional Analyst Notes: - CVE Program Container: References: - https://www.researchgate.net/publication/375759408_Technical_Report_-_CVE-2022-46480_CVE-2023-26941_CVE-2023-26942_and_CVE-2023-26943#fullTextFileContent - https://arxiv.org/abs/2312.00021
CVE ID: CVE-2023-26942 State: PUBLISHED Published: 2023-12-04T00:00:00 Last Updated: 2024-08-02T12:01:31.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: Weak encryption mechanisms in RFID Tags in Yale IA-210 Alarm v1.0 allows attackers to create a cloned tag via physical proximity to the original. Additional Analyst Notes: - CVE Program Container: References: - https://www.researchgate.net/publication/375759408_Technical_Report_-_CVE-2022-46480_CVE-2023-26941_CVE-2023-26942_and_CVE-2023-26943#fullTextFileContent - https://arxiv.org/abs/2312.00021
CVE ID: CVE-2023-26943 State: PUBLISHED Published: 2023-12-04T00:00:00 Last Updated: 2024-08-02T12:01:32.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: Weak encryption mechanisms in RFID Tags in Yale Keyless Lock v1.0 allows attackers to create a cloned tag via physical proximity to the original. Additional Analyst Notes: - CVE Program Container: References: - https://www.researchgate.net/publication/375759408_Technical_Report_-_CVE-2022-46480_CVE-2023-26941_CVE-2023-26942_and_CVE-2023-26943#fullTextFileContent - https://arxiv.org/abs/2312.00021
CVE ID: CVE-2023-26948 State: PUBLISHED Published: 2023-03-09T00:00:00.000Z Last Updated: 2025-02-28T16:29:49.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/file/download. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/keheying/onekeyadmin/issues/5
CVE ID: CVE-2023-26949 State: PUBLISHED Published: 2023-03-06T00:00:00.000Z Last Updated: 2025-03-06T15:19:17.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /admin1/config/update of onekeyadmin v1.3.9 allows attackers to execute arbitrary code via a crafted PHP file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/keheying/onekeyadmin/issues/1
CVE ID: CVE-2023-26950 State: PUBLISHED Published: 2023-03-08T00:00:00.000Z Last Updated: 2025-03-05T18:26:45.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Title parameter under the Adding Categories module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/keheying/onekeyadmin/issues/9
CVE ID: CVE-2023-26951 State: PUBLISHED Published: 2023-03-16T00:00:00.000Z Last Updated: 2025-02-26T16:26:56.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Member List module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/keheying/onekeyadmin/10
CVE ID: CVE-2023-26952 State: PUBLISHED Published: 2023-03-08T00:00:00.000Z Last Updated: 2025-03-03T15:30:40.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Menu module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/keheying/onekeyadmin/issues/7
CVE ID: CVE-2023-26953 State: PUBLISHED Published: 2023-03-07T00:00:00.000Z Last Updated: 2025-03-04T19:35:58.874Z Vendors: n/a Products: n/a Problem Types: n/a Description: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Administrator module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/keheying/onekeyadmin/issues/8
CVE ID: CVE-2023-26954 State: PUBLISHED Published: 2023-03-07T00:00:00.000Z Last Updated: 2025-03-06T17:45:17.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Group module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/keheying/onekeyadmin/issues/11
CVE ID: CVE-2023-26955 State: PUBLISHED Published: 2023-03-07T00:00:00.000Z Last Updated: 2025-03-05T17:00:27.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Admin Group module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/keheying/onekeyadmin/issues/6
CVE ID: CVE-2023-26956 State: PUBLISHED Published: 2023-03-08T00:00:00.000Z Last Updated: 2025-03-05T18:25:17.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/keheying/onekeyadmin/issues/4
CVE ID: CVE-2023-26957 State: PUBLISHED Published: 2023-03-09T00:00:00.000Z Last Updated: 2025-03-05T18:21:28.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\controller\plugins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/keheying/onekeyadmin/issues/3
CVE ID: CVE-2023-26958 State: PUBLISHED Published: 2023-03-27T00:00:00 Last Updated: 2024-08-02T12:01:32.020Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phpgurukul Park Ticketing Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Admin Name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40shiva.infocop/stored-xss-park-ticketing-management-system-phpgurukul-893583dc2e20
CVE ID: CVE-2023-26959 State: PUBLISHED Published: 2023-03-27T00:00:00 Last Updated: 2024-08-02T12:01:32.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phpgurukul Park Ticketing Management System 1.0 is vulnerable to SQL Injection via the User Name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40shiva.infocop/authentication-bypass-park-ticketing-management-system-phpgurukul-427045159c05
CVE ID: CVE-2023-26961 State: PUBLISHED Published: 2023-08-08T00:00:00 Last Updated: 2024-10-15T18:00:54.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: Alteryx Server 2022.1.1.42590 does not employ file type verification for uploaded files. This vulnerability allows attackers to upload arbitrary files (e.g., JavaScript content for stored XSS) via the type field in a JSON document within a PUT /gallery/api/media request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://alteryx.com - https://gist.github.com/DylanGrl/4269ae834c5d0ec77c9b928ad35d3be3
CVE ID: CVE-2023-26964 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-11T15:46:26.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hyperium/hyper/issues/2877 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZYRZ5Y2ALATKKPIITAFAJIS4TR4LUAHO/ - https://lists.fedoraproject.org/
/package-announce%40lists.fedoraproject.org/message/ZYRZ5Y2ALATKKPIITAFAJIS4TR4LUAHO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZHBAE7LQARMPUEEV4TWET4D7G6WCWBUD/
CVE ID: CVE-2023-26965 State: PUBLISHED Published: 2023-06-14T00:00:00.000Z Last Updated: 2025-11-03T20:35:23.723Z Vendors: n/a Products: n/a Problem Types: n/a Description: loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/libtiff/libtiff/-/merge_requests/472 - https://security.netapp.com/advisory/ntap-20230706-0009/ - https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html
CVE ID: CVE-2023-26966 State: PUBLISHED Published: 2023-06-29T00:00:00.000Z Last Updated: 2025-11-03T20:35:25.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/libtiff/libtiff/-/issues/530 - https://gitlab.com/libtiff/libtiff/-/merge_requests/473 - https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html
CVE ID: CVE-2023-26968 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T16:36:00.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Atrocore 1.5.25, the Create Import Feed option with glyphicon-glyphicon-paperclip function is vulnerable to Unauthenticated File upload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/atrocore/atrocore-1.5.25
CVE ID: CVE-2023-26969 State: PUBLISHED Published: 2023-04-14T00:00:00.000Z Last Updated: 2025-02-07T16:01:42.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: Atropim 1.5.26 is vulnerable to Directory Traversal. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/atrocore/atrocore-1.5.26
CVE ID: CVE-2023-26974 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-13T15:27:51.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: Irfanview v4.62 allows a user-mode write access violation via a crafted JPEG 2000 file starting at JPEG2000+0x0000000000001bf0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/overXsky/IrfanviewPoc
CVE ID: CVE-2023-26976 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-13T15:24:32.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Funcy33/Vluninfo_Repo/tree/main/CNVDs/AC6/205_1
CVE ID: CVE-2023-26978 State: PUBLISHED Published: 2023-04-07T00:00:00.000Z Last Updated: 2025-02-12T20:06:53.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pppoeAcName parameter at /setting/setWanIeCfg. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Am1ngl/ttt/tree/main/28
CVE ID: CVE-2023-26979 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T20:07:56.705Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bluetens Electrostimulation Device BluetensQ device app version 4.3.15 is vulnerable to Man-in-the-middle attacks in the BLE channel. It allows attackers to decrease or increase the intensity of the stimulator by hijacking the BLE communication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://bluetens.com - https://www.secura.com/blog/serious-safety-impact-found-in-bluetooth-low-energy-based-medical-devices
CVE ID: CVE-2023-26980 State: PUBLISHED Published: 2023-04-14T00:00:00 Last Updated: 2024-08-02T12:01:32.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: PAX Technology PAX A920 Pro PayDroid 8.1suffers from a Race Condition vulnerability, which allows attackers to bypass the payment software and force the OS to boot directly to Android during the boot process. NOTE: the vendor disputes this because the attack is not feasible: the home launcher will be loaded before any user applications. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://drive.google.com/drive/u/0/folders/14X-XTYhkiaIVBS3zf68VigG4-imbKEuV - https://uploads.strikin
er: References: - https://drive.google.com/drive/u/0/folders/14X-XTYhkiaIVBS3zf68VigG4-imbKEuV - https://uploads.strikinglycdn.com/files/f1d54bf4-3803-480c-b4d3-0943f7dac76e/A920_EN_20200605.pdf?id=237392 - https://docs.google.com/document/d/189b1494s8RF8ksaOijKhKb-3B8gj3pLUmgn0dqg-jqs/edit
CVE ID: CVE-2023-26982 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T16:33:56.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trudesk v1.2.6 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Tags parameter under the Create Ticket function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/polonel/trudesk/releases/tag/v1.2.6 - https://trudesk.io/ - https://github.com/bypazs/CVE-2023-26982
CVE ID: CVE-2023-26984 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T16:31:32.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the password reset function of Peppermint v0.2.4 allows attackers to access the emails and passwords of the Tickets page via a crafted request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://peppermint.sh/ - https://github.com/Peppermint-Lab/peppermint/tree/master - https://github.com/bypazs/CVE-2023-26984
CVE ID: CVE-2023-26986 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-02-11T17:18:20.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in China Mobile OA Mailbox PC v2.9.23 allows remote attackers to execute arbitrary commands on a victim host via user interaction with a crafted EML file sent to their OA mailbox. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/YZLCQX/Mailbox-remote-command-execution - https://gist.github.com/YZLCQX/0da0a438292a5479470c52dad8210462
CVE ID: CVE-2023-26987 State: PUBLISHED Published: 2023-05-01T00:00:00.000Z Last Updated: 2025-01-30T16:43:00.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in Konga 0.14.9 allows remote attackers to manipulate user accounts regardless of privilege via crafted POST request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/redteambrasil/nuclei-templates - https://docs.google.com/document/d/14DYoZfKN__As8gBXMFae7wChKJXpmbuUdMn2Gf803Lw - https://docs.google.com/document/d/14DYoZfKN__As8gBXMFae7wChKJXpmbuUdMn2Gf803Lw/edit
CVE ID: CVE-2023-26991 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-12T15:56:37.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: SWFTools v0.9.2 was discovered to contain a stack-use-after-scope in the swf_ReadSWF2 function in lib/rfxswf.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matthiaskramm/swftools/issues/196
CVE ID: CVE-2023-26998 State: PUBLISHED Published: 2024-01-09T00:00:00.000Z Last Updated: 2025-06-03T14:34:16.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the creator parameter of the Alert Configuration page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://netscout.com - http://ngeniusone.com - https://piotrryciak.com/posts/netscout-multiple-vulnerabilities/
CVE ID: CVE-2023-26999 State: PUBLISHED Published: 2024-01-09T00:00:00.000Z Last Updated: 2025-06-16T18:29:57.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://netscout.com - http://ngeniusone.com - https://piotrryciak.com/posts/netscout-multiple-vulnerabilities/
CVE ID: CVE-2023-27000 State: PUBLISHED Published: 2024-01-09T00:00:00.000Z Last Updated: 2025-06-18T16:56:47.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the name parameter of the Profile and Exclusion List page(s). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://netscout.com - http://ngeniusone.com - https://piotrryciak.com/posts/netscout-multiple-vulnerabilities/
CVE ID: CVE-2023-27001 State: PUBLISHED Published: 2024-02-08T00:00:00.000Z Last Updated: 2025-06-17T13:42:00.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in Egerie Risk Manager v4.0.5 allows attackers to bypass the signature mechanism and tamper with the values inside the JWT payload resulting in privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2023-27001.pdf
CVE ID: CVE-2023-27008 State: PUBLISHED Published: 2023-03-28T00:00:00.000Z Last Updated: 2025-02-18T20:18:14.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site scripting (XSS) vulnerability in the function encrypt_password() in login.tmpl.php in ATutor 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plantplants213607121.wordpress.com/2023/02/16/atutor-2-2-1-cross-site-scripting-via-the-token-body-parameter/
CVE ID: CVE-2023-27010 State: PUBLISHED Published: 2023-03-13T00:00:00.000Z Last Updated: 2025-03-03T17:07:06.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wondershare Dr.Fone v12.9.6 was discovered to contain weak permissions for the service WsDrvInst. This vulnerability allows attackers to escalate privileges via modifying or overwriting the executable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/250.html - https://packetstormsecurity.com/files/171301/Wondershare-Dr-Fone-12.9.6-Weak-Permissions-Privilege-Escalation.html
CVE ID: CVE-2023-27012 State: PUBLISHED Published: 2023-04-07T00:00:00.000Z Last Updated: 2025-02-12T20:06:04.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the setSchedWifi function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/DrizzlingSun/Tenda/blob/main/AC10/5/5.md
CVE ID: CVE-2023-27013 State: PUBLISHED Published: 2023-04-07T00:00:00.000Z Last Updated: 2025-02-12T20:05:20.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the get_parentControl_list_Info function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/DrizzlingSun/Tenda/blob/main/AC10/2/2.md