Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-25779 State: PUBLISHED Published: 2024-02-14T13:37:40.708Z Last Updated: 2024-08-16T18:15:45.761Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Thunderbolt(TM) DCH drivers for Windows Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path element in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00851.html
CVE ID: CVE-2023-25780 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-08T18:01:59.090Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Status Internet Co.,Ltd. Products: PowerBPM Problem Types: CWE-306 Description: It is identified a vulnerability of insufficient authentication in an important specific function of Status PowerBPM. A LAN attacker with normal user privilege can exploit this vulnerability to modify substitute agent to arbitrary users, resulting in serious consequence. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7152-d7f5b-1.html
CVE ID: CVE-2023-25781 State: PUBLISHED Published: 2023-05-26T11:19:00.362Z Last Updated: 2024-10-10T17:31:49.544Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Sebastian Krysmanski Products: Upload File Type Settings Plugin Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sebastian Krysmanski Upload File Type Settings plugin <= 1.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/upload-file-type-settings-plugin/wordpress-upload-file-type-settings-plugin-plugin-1-1-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-25782 State: PUBLISHED Published: 2023-03-20T09:49:40.615Z Last Updated: 2024-08-02T11:32:12.620Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Second2none Products: Service Area Postcode Checker Problem Types: CWE-79 Description: Auth. (admin+) vulnerability in Second2none Service Area Postcode Checker plugin <= 2.0.8 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/service-area-postcode-checker/wordpress-service-area-postcode-checker-plugin-2-0-8-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-25783 State: PUBLISHED Published: 2023-05-03T10:34:13.344Z Last Updated: 2025-01-09T15:31:58.492Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Alex Moss Products: FireCask Like & Share Button Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alex Moss FireCask Like & Share Button plugin <= 1.1.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/facebook-like-send-button/wordpress-peadig-s-like-share-button-plugin-1-1-5-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-25784 State: PUBLISHED Published: 2023-05-03T10:19:59.707Z Last Updated: 2025-01-09T15:32:21.608Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Bon Plan Gratos Products: Sticky Ad Bar Plugin Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bon Plan Gratos Sticky Ad Bar plugin <= 1.3.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/sticky-ad-bar/wordpress-sticky-ad-bar-plugin-plugin-1-3-1-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-25785 State: PUBLISHED Published: 2024-04-24T14:43:07.286Z Last Updated: 2024-08-08T17:05:51.337Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Shoaib Saleem Products: WP Post Rating Problem Types: CWE-862 Description: Missing Authorization vulnerability in Shoaib Saleem WP Post Rating allows Functionality Misuse.This issue affects WP Post Rating: from n/a through 2.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-post-comment-rating/wordpress-wp-post-rating-plugin-2-4-5-vote-manipulation-vulnerability?_s_id=cve
CVE ID: CVE-2023-25786 State: PUBLISHED Published: 2023-05-03T10:47:20.339Z Last Updated: 2025-01-09T15:31:48.682Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Thom Stark Products: Eyes Only: User Access Shortcode Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Thom Stark Eyes Only: User Access Shortcode plugin <= 1.8.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/eyes-only-user-access-shortcode/wordpress-eyes-only-user-access-shortcode-plugin-1-8-2-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-25787 State: PUBLISHED Published: 2023-05-03T10:29:48.025Z Last Updated: 2025-01-09T15:32:10.906Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Wbolt team Products: WP资源下载管理 Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wbolt team WP资源下载管理 plugin <= 1.3.9 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/download-info-page/wordpress-wp-plugin-1-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-25788 State: PUBLISHED Published: 2023-10-04T10:30:55.591Z Last Updated: 2024-09-19T18:08:02.339Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Saphali Products: Saphali Woocommerce Lite Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Saphali Saphali Woocommerce Lite plugin <= 1.8.13 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/saphali-woocommerce-lite/wordpress-saphali-woocommerce-lite-plugin-1-8-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-25789 State: PUBLISHED Published: 2023-05-03T10:43:20.195Z Last Updated: 2024-08-02T13:44:31.957Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Tapfiliate Products: Tapfiliate Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tapfiliate plugin <= 3.0.12 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/tapfiliate/wordpress-tapfiliate-plugin-3-0-12-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-25790 State: PUBLISHED Published: 2024-04-24T15:44:12.870Z Last Updated: 2024-08-02T11:32:12.665Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: xtemos Products: WoodMart Problem Types: CWE-287, CWE-79 Description: Improper Authentication, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos WoodMart allows Cross-Site Scripting (XSS).This issue affects WoodMart: from n/a through 7.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woodmart/wordpress-woodmart-theme-7-0-4-unauth-arbitrary-shortcodes
ces: - https://patchstack.com/database/vulnerability/woodmart/wordpress-woodmart-theme-7-0-4-unauth-arbitrary-shortcodes-injection?_s_id=cve
CVE ID: CVE-2023-25791 State: PUBLISHED Published: 2024-12-09T11:31:29.390Z Last Updated: 2024-12-09T18:43:11.445Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Cadus Pro Products: Fontiran Problem Types: CWE-862 Description: Missing Authorization vulnerability in Cadus Pro Fontiran allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fontiran: from n/a through 2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/fontiran/vulnerability/wordpress-fontiran-plugin-2-1-broken-access-control?_s_id=cve
CVE ID: CVE-2023-25792 State: PUBLISHED Published: 2023-05-03T10:15:15.457Z Last Updated: 2025-02-19T21:32:48.528Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: XiaoMac Products: WP Open Social Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in XiaoMac WP Open Social plugin <= 5.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/open-social/wordpress-wp-open-social-plugin-5-0-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-25793 State: PUBLISHED Published: 2023-04-25T18:40:09.289Z Last Updated: 2025-01-09T15:33:53.680Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: George Pattihis Products: Link Juice Keeper Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in George Pattihis Link Juice Keeper plugin <= 2.0.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/link-juice-keeper/wordpress-link-juice-keeper-plugin-2-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-25794 State: PUBLISHED Published: 2023-03-20T10:33:06.780Z Last Updated: 2025-01-13T15:50:16.201Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Mighty Digital Products: Nooz Problem Types: CWE-79 Description: Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Mighty Digital Nooz plugin <= 1.6.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/nooz/wordpress-nooz-plugin-1-6-0-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-25795 State: PUBLISHED Published: 2023-03-20T10:28:46.189Z Last Updated: 2025-01-13T15:50:24.286Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: WP-master.ir Products: Feed Changer & Remover Problem Types: CWE-79 Description: Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in WP-master.Ir Feed Changer & Remover plugin <= 0.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/feed-changer/wordpress-feed-changer-plugin-0-2-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-25796 State: PUBLISHED Published: 2023-05-03T11:08:14.427Z Last Updated: 2025-02-19T21:32:29.591Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Include Products: WP BaiDu Submit Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Include WP BaiDu Submit plugin <= 1.2.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-baidu-submit/wordpress-wp-baidu-submit-plugin-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-25797 State: PUBLISHED Published: 2023-05-03T10:25:10.749Z Last Updated: 2025-02-19T21:32:39.319Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Mr.Vibe Products: vSlider Multi Image Slider for WordPress Problem Types: CWE-79 Description: Auth. Stored Cross-Site Scripting (XSS) vulnerability in Mr.Vibe vSlider Multi Image Slider for WordPress plugin <= 4.1.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/vslider/wordpress-vslider-multi-image-slider-for-wordpress-plugin-4-1-2-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-25798 State: PUBLISHED Published: 2023-05-03T11:04:18.393Z Last Updated: 2025-01-09T15:31:39.047Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Olevmedia Products: Olevmedia Shortcodes Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Olevmedia Olevmedia Shortcodes plugin <= 1.1.9 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/olevmedia-shortcodes/wordpress-olevmedia-shortcodes-plugin-1-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-25799 State: PUBLISHED Published: 2024-06-11T09:15:01.315Z Last Updated: 2024-08-09T18:36:31.119Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: Themeum Products: Tutor LMS Problem Types: CWE-862 Description: Missing Authorization vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.1.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/tutor/wordpress-tutor-lms-plugin-2-1-10-multiple-student-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-25800 State: PUBLISHED Published: 2023-11-03T16:26:12.916Z Last Updated: 2024-09-05T18:29:21.093Z Vendors: Themeum Products: Tutor LMS Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/tutor/wordpress-tutor-lms-plugin-2-1-10-multiple-student-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-25801 State: PUBLISHED Published: 2023-03-24T23:08:50.251Z Last Updated: 2025-02-19T20:44:31.150Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-415 Description: TensorFlow is an open source machine learning platform. Prior to versions 2.12.0 and 2.11.1, `nn_ops.fractional_avg_pool_v2` and `nn_ops.fractional_max_pool_v2` require the first and fourth elements of their parameter `pooling_ratio` to be equal to 1.0, as pooling on batch and channel dimensions is not supported. A fix is included in TensorFlow 2.12.0 and 2.11.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichmen
x is included in TensorFlow 2.12.0 and 2.11.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f49c-87jh-g47q - https://github.com/tensorflow/tensorflow/commit/ee50d1e00f81f62a4517453f721c634bbb478307
CVE ID: CVE-2023-25802 State: PUBLISHED Published: 2023-03-13T19:35:11.243Z Last Updated: 2025-02-25T14:58:23.859Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: hap-wi Products: roxy-wi Problem Types: CWE-26, CWE-22 Description: Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.6.0 don't correctly neutralize `dir/../filename` sequences, such as `/etc/nginx/../passwd`, allowing an actor to gain information about a server. Version 6.3.6.0 has a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hap-wi/roxy-wi/security/advi
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-qcmp-q5h3-784m - https://github.com/hap-wi/roxy-wi/commit/0054f25da7cf8c7480452f48e39308b5e392dc67
CVE ID: CVE-2023-25803 State: PUBLISHED Published: 2023-03-13T00:00:00.000Z Last Updated: 2025-02-25T14:58:49.343Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: hap-wi Products: roxy-wi Problem Types: CWE-22 Description: Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.5.0 have a directory traversal vulnerability that allows the inclusion of server-side files. This issue is fixed in version 6.3.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-cv9w-j9gh-5j3w
CVE ID: CVE-2023-25804 State: PUBLISHED Published: 2023-03-15T17:39:55.532Z Last Updated: 2025-02-25T14:57:24.659Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: hap-wi Products: roxy-wi Problem Types: CWE-22 Description: Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.5.0 have a limited path traversal vulnerability. An SSH key can be saved into an unintended location, for example the `/tmp` folder using a payload `../../../../../tmp/test111_dev`. This issue has been fixed in version 6.3.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.co
ion 6.3.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-69j6-crq8-rrhv
CVE ID: CVE-2023-25805 State: PUBLISHED Published: 2023-02-20T15:45:43.255Z Last Updated: 2025-03-10T21:07:54.788Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: commenthol Products: versionn Problem Types: CWE-77 Description: versionn, software for changing version information across multiple files, has a command injection vulnerability in all versions prior to version 1.1.0. This issue is patched in version 1.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/commenthol/versionn/security/advisories/GHSA-fj78-2vc5-f6cm - https://github.com/commenthol/versionn/commit/2ca128823efe962b37f2698f0e
sionn/security/advisories/GHSA-fj78-2vc5-f6cm - https://github.com/commenthol/versionn/commit/2ca128823efe962b37f2698f0eb530c2b124842d
CVE ID: CVE-2023-25806 State: PUBLISHED Published: 2023-03-02T03:04:26.889Z Last Updated: 2025-03-05T21:28:42.975Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: opensearch-project Products: security Problem Types: CWE-208 Description: OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provider (IdP), and not other externally configured IdPs. Patches were released in versions 1.3.9 and 2.6.0, there
tity provider (IdP), and not other externally configured IdPs. Patches were released in versions 1.3.9 and 2.6.0, there are no workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/opensearch-project/security/security/advisories/GHSA-c6wg-cm5x-rqvj
CVE ID: CVE-2023-25807 State: PUBLISHED Published: 2023-02-28T15:05:33.087Z Last Updated: 2025-03-06T16:26:01.200Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: dataease Products: dataease Problem Types: CWE-79 Description: DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified and store malicious code. This vulnerability can lead to the execution of malicious code stored by the attacker on the server side when the user accesses the dashboard. The vulnerability has been fixed in version 1.18.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
ility has been fixed in version 1.18.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-xj3h-3wmw-j5vf - https://github.com/dataease/dataease/commit/cc94fb8e69ddbb37c96d02ec0f0ddcd74273ef49
CVE ID: CVE-2023-25809 State: PUBLISHED Published: 2023-03-29T18:22:56.875Z Last Updated: 2025-02-12T16:02:24.090Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: opencontainers Products: runc Problem Types: CWE-281 Description: runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or 2. when runc is e
nshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or 2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected. Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. Additi
is is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/opencontainers/runc/security/advisories/GHSA-m8cg-xc2p-r3fc - https://github.com/opencontainers/runc/commit/0d62b950e60f6980b54fe3bafd9a9c608dc1df17
CVE ID: CVE-2023-25810 State: PUBLISHED Published: 2023-02-21T20:45:38.072Z Last Updated: 2025-03-10T21:07:41.199Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: louislam Products: uptime-kuma Problem Types: CWE-79 Description: Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma status page allows a persistent XSS attack. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/louislam/uptime-kuma/security/advisories/GHSA-wh8j-xr66-f296
CVE ID: CVE-2023-25811 State: PUBLISHED Published: 2023-02-21T20:45:39.863Z Last Updated: 2025-03-10T21:07:35.752Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: louislam Products: uptime-kuma Problem Types: CWE-79 Description: Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma `name` parameter allows a persistent XSS attack. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/louislam/uptime-kuma/security/advisories/GHSA-553g-fcpf-m3wp
CVE ID: CVE-2023-25812 State: PUBLISHED Published: 2023-02-21T20:32:34.798Z Last Updated: 2025-03-10T21:07:48.029Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: minio Products: minio Problem Types: CWE-281 Description: Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Access Denied" to all users attempting to DELETE a versionId with the special header `X-Amz-Bypass-Governance-Retention: true`. However, this was not honored instead the request will be honored and an object under governance would be incorrectly deleted. All users are advised to upgrade.