Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-3425 State: PUBLISHED Published: 2023-08-25T08:08:05.954Z Last Updated: 2024-08-28T18:29:48.168Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: M-Files Products: M-Files Server Problem Types: CWE-125 Description: Out-of-bounds read issue in M-Files Server versions below 23.8.12892.6 and LTS Service Release Versions before 23.2 LTS SR3 allows unauthenticated user to read restricted amount of bytes from memory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://product.m-files.com/security-advisories/cve-2023-3425/
CVE ID: CVE-2023-3426 State: PUBLISHED Published: 2023-08-02T09:40:28.090Z Last Updated: 2024-10-11T14:09:13.856Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Liferay Products: DXP, Portal Problem Types: CWE-425 Description: The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-3426
CVE ID: CVE-2023-3427 State: PUBLISHED Published: 2023-06-28T01:48:22.850Z Last Updated: 2024-11-06T18:52:24.792Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: wordpresschef Products: Salon booking system Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or incorrect nonce validation on the 'save_customer' function. This makes it possible for unauthenticated attackers to change the admin role to customer or change the user meta to arbitrary values via a forged request, granted they can
to change the admin role to customer or change the user meta to arbitrary values via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/93875f19-d9b9-4e33-bba9-afc75cf26bf2?source=cve - https://plugins.trac.wordpress.org/browser/salon-booking-system/trunk/src/SLN/Admin/Customers.php?rev=2779160#L68 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2931406%40salon-booking-system&new=2931406%40salon-booking-system&sfp_email=&sfph_mail=
CVE ID: CVE-2023-3428 State: PUBLISHED Published: 2023-10-04T18:02:23.724Z Last Updated: 2025-11-20T17:26:30.887Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-122 Description: A heap-based buffer overflow vulnerability was found in coders/tiff.c in ImageMagick. This issue may allow a local attacker to trick the user into opening a specially crafted file, resulting in an application crash and denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-3428 - https://bugz
Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-3428 - https://bugzilla.redhat.com/show_bug.cgi?id=2218369
CVE ID: CVE-2023-3430 State: PUBLISHED Published: 2023-12-18T13:40:05.145Z Last Updated: 2024-08-02T06:55:03.301Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a, Fedora Products: OpenImageIO, Extra Packages for Enterprise Linux, Fedora Problem Types: CWE-122 Description: A vulnerability was found in OpenImageIO, where a heap buffer overflow exists in the src/gif.imageio/gifinput.cpp file. This flaw allows a remote attacker to pass a specially crafted file to the application, which triggers a heap-based buffer overflow and could cause a crash, leading to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.
rash, leading to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2218380
CVE ID: CVE-2023-3431 State: PUBLISHED Published: 2023-06-27T14:28:33.739Z Last Updated: 2025-02-13T16:55:25.947Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: plantuml Products: plantuml/plantuml Problem Types: CWE-284 Description: Improper Access Control in GitHub repository plantuml/plantuml prior to 1.2023.9. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/fa741f95-b53c-4ed7-b157-e32c5145164c - https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FV7XL3CY3K3K5ER3ASMEQA546MIQQ7QM/
CVE ID: CVE-2023-3432 State: PUBLISHED Published: 2023-06-27T14:30:23.442Z Last Updated: 2025-02-13T16:55:27.498Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: plantuml Products: plantuml/plantuml Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in GitHub repository plantuml/plantuml prior to 1.2023.9. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/8ac3316f-431c-468d-87e4-3dafff2ecf51 - https://github.com/plantuml/plantuml/commit/b32500bb61ae617bb312496d6d832e4be8190797 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FV7XL3CY3K3K5ER3ASMEQA546MI
tps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FV7XL3CY3K3K5ER3ASMEQA546MIQQ7QM/
CVE ID: CVE-2023-3433 State: PUBLISHED Published: 2023-07-14T12:28:53.363Z Last Updated: 2024-10-22T14:51:50.722Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Savoir-faire Linux Products: Jami Problem Types: CWE-20 Description: The "nickname" field within Savoir-faire Linux's Jami application is susceptible to a failed state when a user inserts special characters into the field. When present, these special characters, make it so the application cannot create the signature for the user and results in a local denial of service to the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://review.jami.ne
cation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://review.jami.net/c/jami-daemon/+/23575 - https://git.jami.net/savoirfairelinux/jami-client-qt/-/wikis/Changelog#nightly-january-10 - https://blog.blacklanternsecurity.com/p/Jami-Local-Denial-Of-Service-and-QRC-Handler-Vulnerabilities
CVE ID: CVE-2023-3434 State: PUBLISHED Published: 2023-07-14T12:29:34.563Z Last Updated: 2024-10-22T14:32:14.447Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) Vendors: Savoir-faire Linux Products: Jami Problem Types: CWE-20 Description: Improper Input Validation in the hyperlink interpretation in Savoir-faire Linux's Jami (version 20222284) on Windows. This allows an attacker to send a custom HTML anchor tag to pass a string value to the Windows QRC Handler through the Jami messenger. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://review.jami.net/c/jami-client-qt/+/23569 - https://git.jami.net/savoirfairelinux/jam
Vulnrichment: References: - https://review.jami.net/c/jami-client-qt/+/23569 - https://git.jami.net/savoirfairelinux/jami-client-qt/-/wikis/Changelog#nightly-january-10 - https://blog.blacklanternsecurity.com/p/Jami-Local-Denial-Of-Service-and-QRC-Handler-Vulnerabilities
CVE ID: CVE-2023-3435 State: PUBLISHED Published: 2023-08-14T19:10:19.283Z Last Updated: 2024-10-09T13:21:07.606Z Vendors: Unknown Products: User Activity Log Problem Types: CWE-89 SQL Injection Description: The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/30a37a61-0d16-46f7-b9d8-721d983afc6b
CVE ID: CVE-2023-3436 State: PUBLISHED Published: 2023-06-27T20:55:21.049Z Last Updated: 2024-11-07T17:00:22.993Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Xpdf Products: Xpdf Problem Types: CWE-833 Description: Xpdf 4.04 will deadlock on a PDF object stream whose "Length" field is itself in another object stream. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forum.xpdfreader.com/viewtopic.php?t=42618
CVE ID: CVE-2023-3437 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:40.606Z Description: No description available.
CVE ID: CVE-2023-3438 State: PUBLISHED Published: 2023-07-03T07:35:24.255Z Last Updated: 2024-10-25T13:07:01.819Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Trellix Products: Trellix Move Problem Types: CWE-428 Description: An unquoted Windows search path vulnerability existed in the install the MOVE 4.10.x and earlier Windows install service (mvagtsce.exe). The misconfiguration allowed an unauthorized local user to insert arbitrary code into the unquoted service path to obtain privilege escalation and stop antimalware services. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kcm.trellix.com/corporate/in
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kcm.trellix.com/corporate/index?page=content&id=SB10404
CVE ID: CVE-2023-3439 State: PUBLISHED Published: 2023-06-28T00:00:00.000Z Last Updated: 2025-03-10T21:08:54.880Z Vendors: n/a Products: Linux Kernel (mctp) Problem Types: CWE-416 Description: A flaw was found in the MCTP protocol in the Linux kernel. The function mctp_unregister() reclaims the device's relevant resource when a netcard detaches. However, a running routine may be unaware of this and cause the use-after-free of the mdev->addrs object, potentially leading to a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2217915 - https://github.com/torvalds/linux/commit/b561275d633bcd8e0
nces: - https://bugzilla.redhat.com/show_bug.cgi?id=2217915 - https://github.com/torvalds/linux/commit/b561275d633bcd8e0e8055ab86f1a13df75a0269 - http://www.openwall.com/lists/oss-security/2023/07/02/1
CVE ID: CVE-2023-3440 State: PUBLISHED Published: 2023-10-03T01:05:42.803Z Last Updated: 2024-08-02T06:55:03.179Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hitachi Products: JP1/Performance Management - Manager, JP1/Performance Management - Base, JP1/Performance Management - Agent Option for Application Server, JP1/Performance Management - Agent Option for Enterprise Applications, JP1/Performance Management - Agent Option for HiRDB, JP1/Performance Management - Agent Option for IBM Lotus Domino, JP1/Performance Management - Agent Option for Microsoft(R) Exchange Server, JP1/Performance Management - Agent Option for Microsoft(R) Internet Information Serve
for Microsoft(R) Exchange Server, JP1/Performance Management - Agent Option for Microsoft(R) Internet Information Server, JP1/Performance Management - Agent Option for Microsoft(R) SQL Server, JP1/Performance Management - Agent Option for Oracle, JP1/Performance Management - Agent Option for Platform, JP1/Performance Management - Agent Option for Service Response, JP1/Performance Management - Agent Option for Transaction System, JP1/Performance Management - Remote Monitor for Microsoft(R) SQL Server, JP1/Performance Management - Remote Monitor for Oracle, JP1/Performance Management - Remote Monitor for Platform, JP1/Performance Management - Remote Monitor for Virtual Machine, JP1/Performanc
anagement - Remote Monitor for Platform, JP1/Performance Management - Remote Monitor for Virtual Machine, JP1/Performance Management - Agent Option for Domino, JP1/Performance Management - Agent Option for IBM WebSphere Application Server, JP1/Performance Management - Agent Option for IBM WebSphere MQ, JP1/Performance Management - Agent Option for JP1/AJS3, JP1/Performance Management - Agent Option for OpenTP1, JP1/Performance Management - Agent Option for Oracle WebLogic Server, JP1/Performance Management - Agent Option for uCosminexus Application Server, JP1/Performance Management - Agent Option for Virtual Machine Problem Types: CWE-276 Description: Incorrect Default Permissions vulnerabi
anagement - Agent Option for Virtual Machine Problem Types: CWE-276 Description: Incorrect Default Permissions vulnerability in Hitachi JP1/Performance Management on Windows allows File Manipulation.This issue affects JP1/Performance Management - Manager: from 09-00 before 12-50-07; JP1/Performance Management - Base: from 09-00 through 10-50-*; JP1/Performance Management - Agent Option for Application Server: from 11-00 before 11-50-16; JP1/Performance Management - Agent Option for Enterprise Applications: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for HiRDB: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for IBM Lotus Domino: from 10-00 befo
n for HiRDB: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for IBM Lotus Domino: from 10-00 before 11-50-16; JP1/Performance Management - Agent Option for Microsoft(R) Exchange Server: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for Microsoft(R) Internet Information Server: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for Microsoft(R) SQL Server: from 09-00 before 12-50-07; JP1/Performance Management - Agent Option for Oracle: from 09-00 before 12-10-08; JP1/Performance Management - Agent Option for Platform: from 09-00 before 12-50-07; JP1/Performance Management - Agent Option for Service Response: from 09-00 before
Platform: from 09-00 before 12-50-07; JP1/Performance Management - Agent Option for Service Response: from 09-00 before 11-50-16; JP1/Performance Management - Agent Option for Transaction System: from 11-00 before 12-00-14; JP1/Performance Management - Remote Monitor for Microsoft(R) SQL Server: from 09-00 before 12-50-07; JP1/Performance Management - Remote Monitor for Oracle: from 09-00 before 12-10-08; JP1/Performance Management - Remote Monitor for Platform: from 09-00 before 12-10-08; JP1/Performance Management - Remote Monitor for Virtual Machine: from 10-00 before 12-50-07; JP1/Performance Management - Agent Option for Domino: from 09-00 through 09-00-*; JP1/Performance Management - A
-50-07; JP1/Performance Management - Agent Option for Domino: from 09-00 through 09-00-*; JP1/Performance Management - Agent Option for IBM WebSphere Application Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for IBM WebSphere MQ: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for JP1/AJS3: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for OpenTP1: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for Oracle WebLogic Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for uCosminexus Application Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Opti
t - Agent Option for uCosminexus Application Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for Virtual Machine: from 09-00 through 09-01-*. Additional Analyst Notes: - CVE Program Container: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-145/index.html
CVE ID: CVE-2023-3441 State: PUBLISHED Published: 2024-10-01T09:47:16.444Z Last Updated: 2024-10-01T13:28:02.702Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-213 Description: An issue has been discovered in GitLab EE/CE affecting all versions starting from 8.0 before 16.4. The product did not sufficiently warn about security implications of granting merge rights to protected branches. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/416482 - https://hackerone.com/reports/2033561 - https://gitlab.com/gitlab-org/gitlab/-/issues/417284 - https://hackeron
416482 - https://hackerone.com/reports/2033561 - https://gitlab.com/gitlab-org/gitlab/-/issues/417284 - https://hackerone.com/reports/2041385
CVE ID: CVE-2023-3442 State: PUBLISHED Published: 2023-07-26T18:32:19.787Z Last Updated: 2024-10-15T15:53:14.154Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: ServiceNow Products: Jenkins plug-in for ServiceNow DevOps Problem Types: CWE-862 Description: A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins plug-in for ServiceNow DevOps on your Jenkins server. No changes are required on your instances of the Now Platform. Additional Analyst N
ceNow DevOps on your Jenkins server. No changes are required on your instances of the Now Platform. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1434119
CVE ID: CVE-2023-3443 State: PUBLISHED Published: 2023-12-01T07:02:33.126Z Last Updated: 2025-11-20T04:07:43.258Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in GitLab affecting all versions starting from 12.1 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a Guest user to add an emoji on confidential work items. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/416497 - https://hackerone.com/reports/2036500
CVE ID: CVE-2023-3444 State: PUBLISHED Published: 2023-07-13T02:08:20.930Z Last Updated: 2024-11-05T15:15:46.783Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to merge arbitrary code into protected branches. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/406803 - https://hackerone.com/repor
CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/406803 - https://hackerone.com/reports/1928709
CVE ID: CVE-2023-3445 State: PUBLISHED Published: 2023-06-28T13:22:48.106Z Last Updated: 2024-11-06T20:22:53.327Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: spinacms Products: spinacms/spina Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository spinacms/spina prior to 2.15.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/18a74a9d-4a2d-4bf8-ae62-56a909427070 - https://github.com/spinacms/spina/commit/9adfe7b4807b3cc10dbb7351a26cc32f5d8c14a3
CVE ID: CVE-2023-3446 State: PUBLISHED Published: 2023-07-19T11:31:34.994Z Last Updated: 2025-04-23T16:20:00.400Z Vendors: OpenSSL Products: OpenSSL Problem Types: CWE-606 Description: Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not
H_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions.
lernable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20230719.txt - https://git.openssl.org/git
r: - CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20230719.txt - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c
CVE ID: CVE-2023-3447 State: PUBLISHED Published: 2023-06-29T04:28:35.916Z Last Updated: 2024-11-26T19:32:37.110Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: cyberlord92 Products: Active Directory Integration / LDAP Integration Problem Types: CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') Description: The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4.1.5. This is due to insufficient escaping on the supplied username value. This makes it possible for unauthenticated attackers to extract potentially sensitive information fro
ed username value. This makes it possible for unauthenticated attackers to extract potentially sensitive information from the LDAP directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cd7553e8-e43d-4740-b2ee-e3d8dc351e53?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2928150%40ldap-login-for-intranet-sites&new=2928150%40ldap-login-for-intranet-sites&sfp_email=&sfph_mail=
CVE ID: CVE-2023-3448 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:05.700Z Description: No description available.