Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-45101 State: PUBLISHED Published: 2025-01-02T11:59:49.130Z Last Updated: 2025-01-06T20:20:48.158Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: CusRev Products: Customer Reviews for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in CusRev Customer Reviews for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customer Reviews for WooCommerce: from n/a through 5.36.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/customer-reviews-woocommerce/vulnerability/wordpress-customer-reviews-for-
ps://patchstack.com/database/wordpress/plugin/customer-reviews-woocommerce/vulnerability/wordpress-customer-reviews-for-woocommerce-plugin-5-36-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-45102 State: PUBLISHED Published: 2023-10-12T14:30:23.613Z Last Updated: 2024-09-17T17:47:23.745Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: OTWthemes Products: Blog Manager Light Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Blog Manager Light plugin <= 1.20 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/blog-manager-light/wordpress-blog-manager-light-plugin-1-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45103 State: PUBLISHED Published: 2023-10-12T14:33:33.651Z Last Updated: 2024-09-17T18:31:24.121Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: YAS Global Team Products: Permalinks Customizer Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in YAS Global Team Permalinks Customizer plugin <= 2.8.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/permalinks-customizer/wordpress-permalinks-customizer-plugin-2-8-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45104 State: PUBLISHED Published: 2025-01-02T11:59:49.780Z Last Updated: 2025-01-06T20:18:56.133Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: WPDeveloper Products: BetterLinks Problem Types: CWE-862 Description: Missing Authorization vulnerability in WPDeveloper BetterLinks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BetterLinks: from n/a through 1.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/betterlinks/vulnerability/wordpress-betterlinks-plugin-1-6-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-45105 State: PUBLISHED Published: 2023-12-19T19:48:25.903Z Last Updated: 2024-08-02T20:14:19.812Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: SERVIT Software Solutions Products: affiliate-toolkit – WordPress Affiliate Plugin Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SERVIT Software Solutions affiliate-toolkit – WordPress Affiliate Plugin.This issue affects affiliate-toolkit – WordPress Affiliate Plugin: from n/a through 3.3.9. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/affiliate-toolkit-starter/wordpress-affi
Program Container: References: - https://patchstack.com/database/vulnerability/affiliate-toolkit-starter/wordpress-affiliate-toolkit-wordpress-affiliate-plugin-plugin-3-3-9-open-redirection-vulnerability?_s_id=cve
CVE ID: CVE-2023-45106 State: PUBLISHED Published: 2023-10-12T14:57:04.186Z Last Updated: 2024-09-17T18:30:24.078Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Fedor Urvanov, Aram Kocharyan Products: Urvanov Syntax Highlighter Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Fedor Urvanov, Aram Kocharyan Urvanov Syntax Highlighter plugin <= 2.8.33 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/urvanov-syntax-highlighter/wordpress-urvanov-syntax-highlighter-plugin-2-8-33-cross-site-request-forgery-csrf-vulnerability?_s_id
yntax-highlighter/wordpress-urvanov-syntax-highlighter-plugin-2-8-33-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45107 State: PUBLISHED Published: 2023-10-13T12:00:17.567Z Last Updated: 2024-09-16T19:11:22.267Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: GoodBarber Products: GoodBarber Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in GoodBarber plugin <= 1.0.22 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/goodbarber/wordpress-goodbarber-plugin-1-0-22-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45108 State: PUBLISHED Published: 2023-10-13T12:03:15.049Z Last Updated: 2024-09-16T19:09:40.816Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Mailrelay Products: Mailrelay Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Mailrelay plugin <= 2.1.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mailrelay/wordpress-mailrelay-plugin-2-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45109 State: PUBLISHED Published: 2023-10-13T13:18:49.859Z Last Updated: 2024-09-16T19:09:24.924Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: ZAKSTAN Products: WhitePage Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in ZAKSTAN WhitePage plugin <= 1.1.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/white-page-publication/wordpress-whitepage-plugin-1-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-45110 State: PUBLISHED Published: 2025-01-02T11:59:50.374Z Last Updated: 2025-01-06T20:07:56.117Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: BoldThemes Products: Bold Timeline Lite Problem Types: CWE-862 Description: Missing Authorization vulnerability in BoldThemes Bold Timeline Lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bold Timeline Lite: from n/a through 1.1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bold-timeline-lite/vulnerability/wordpress-bold-timeline-lite-plugin-1-1-9-broken-access-control-vulnerabilit
ess/plugin/bold-timeline-lite/vulnerability/wordpress-bold-timeline-lite-plugin-1-1-9-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-45111 State: PUBLISHED Published: 2023-11-02T01:42:20.337Z Last Updated: 2024-09-05T19:17:07.135Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Examination System Problem Types: CWE-89 Description: Online Examination System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'email' parameter of the feed.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/pires - https://projectworlds.in/
CVE ID: CVE-2023-45112 State: REJECTED Published: 2023-11-02T01:44:00.473Z Last Updated: 2024-01-02T19:26:25.801Z Description: No description available.
CVE ID: CVE-2023-45113 State: REJECTED Published: 2023-11-02T01:45:28.083Z Last Updated: 2024-01-02T19:26:38.318Z Description: No description available.
CVE ID: CVE-2023-45114 State: REJECTED Published: 2023-11-02T01:46:22.140Z Last Updated: 2024-01-02T19:26:52.364Z Description: No description available.
CVE ID: CVE-2023-45115 State: PUBLISHED Published: 2023-12-21T15:36:52.752Z Last Updated: 2025-05-21T14:10:51.475Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Examination System Problem Types: CWE-89 Description: Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'ch' parameter of the /update.php?q=addqns resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/argerich/ - https://projectworlds.i
ontainer: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/argerich/ - https://projectworlds.in/
CVE ID: CVE-2023-45116 State: PUBLISHED Published: 2023-12-21T15:42:37.992Z Last Updated: 2025-05-19T14:09:12.616Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Examination System Problem Types: CWE-89 Description: Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'demail' parameter of the /update.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/argerich/ - https://projectworlds.in/
CVE ID: CVE-2023-45117 State: PUBLISHED Published: 2023-12-21T15:47:00.234Z Last Updated: 2025-05-19T14:09:43.559Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Examination System Problem Types: CWE-89 Description: Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'eid' parameter of the /update.php?q=rmquiz resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/argerich/ - https://projectworlds.
Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/argerich/ - https://projectworlds.in/
CVE ID: CVE-2023-45118 State: PUBLISHED Published: 2023-12-21T15:51:50.440Z Last Updated: 2025-05-19T14:10:01.595Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Examination System Problem Types: CWE-89 Description: Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'fdid' parameter of the /update.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/argerich/ - https://projectworlds.in/
CVE ID: CVE-2023-45119 State: PUBLISHED Published: 2023-12-21T16:03:38.226Z Last Updated: 2025-05-19T14:10:27.422Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Examination System Problem Types: CWE-89 Description: Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'n' parameter of the /update.php?q=quiz resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/argerich/ - https://projectworlds.in/
CVE ID: CVE-2023-45120 State: PUBLISHED Published: 2023-12-21T16:21:38.806Z Last Updated: 2025-05-19T14:11:02.286Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Examination System Problem Types: CWE-89 Description: Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'qid' parameter of the /update.php?q=quiz&step=2 resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/argerich/ - https://projectwo
gram Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/argerich/ - https://projectworlds.in/
CVE ID: CVE-2023-45121 State: PUBLISHED Published: 2023-12-21T16:23:47.795Z Last Updated: 2025-05-19T14:11:21.801Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Examination System Problem Types: CWE-89 Description: Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'desc' parameter of the /update.php?q=addquiz resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/argerich/ - https://projectworlds.in/
CVE ID: CVE-2023-45122 State: REJECTED Published: 2023-12-21T16:37:03.961Z Last Updated: 2025-02-13T17:13:44.298Z Description: No description available.
CVE ID: CVE-2023-45123 State: REJECTED Published: 2023-12-21T16:42:55.086Z Last Updated: 2025-02-13T17:13:44.913Z Description: No description available.
CVE ID: CVE-2023-45124 State: REJECTED Published: 2023-12-21T18:53:13.624Z Last Updated: 2025-02-13T17:13:45.468Z Description: No description available.
CVE ID: CVE-2023-45125 State: REJECTED Published: 2023-12-21T18:53:53.289Z Last Updated: 2025-02-13T17:13:46.109Z Description: No description available.
CVE ID: CVE-2023-45126 State: REJECTED Published: 2023-12-21T18:54:32.617Z Last Updated: 2025-02-13T17:13:46.671Z Description: No description available.
CVE ID: CVE-2023-45127 State: REJECTED Published: 2023-12-21T18:55:19.200Z Last Updated: 2025-02-13T17:13:47.207Z Description: No description available.
CVE ID: CVE-2023-45128 State: PUBLISHED Published: 2023-10-16T20:45:07.068Z Last Updated: 2024-09-16T14:23:48.099Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L) Vendors: gofiber Products: fiber Problem Types: CWE-20, CWE-352, CWE-565, CWE-807 Description: Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow an attacker to inject arbitrary values without any authentication, or perform various malicious actions on behalf of an authenticated use
ject arbitrary values without any authentication, or perform various malicious actions on behalf of an authenticated user, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This issue has been addressed in version 2.50.0 and users are advised to upgrade. Users should take additional security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes as defense in depth measures. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Pro
as defense in depth measures. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gofiber/fiber/security/advisories/GHSA-94w9-97p3-p368 - https://github.com/gofiber/fiber/commit/8c3916dbf4ad2ed427d02c6eb63ae8b2fa8f019a
CVE ID: CVE-2023-45129 State: PUBLISHED Published: 2023-10-10T17:17:11.146Z Last Updated: 2025-02-13T17:13:47.801Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: matrix-org Products: synapse Problem Types: CWE-770 Description: Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Prior to version 1.94.0, a malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service. Homeservers running on a closed federation (which presumably do not need to use server ACLs) are not affected. Server administrators are advised to upgrade to Synapse 1.94.0 or later. As a worka
o use server ACLs) are not affected. Server administrators are advised to upgrade to Synapse 1.94.0 or later. As a workaround, rooms with malicious server ACL events can be purged and blocked using the admin API. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matrix-org/synapse/security/advisories/GHSA-5chr-wjw5-3gq4 - https://github.com/matrix-org/synapse/pull/16360 - https://matrix-org.github.io/synapse/latest/admin_api/rooms.html#version-2-new-version - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WRO4MPQ6HOXIUZM6RJP6VTCTMV7RD2T3/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fe
.org/message/WRO4MPQ6HOXIUZM6RJP6VTCTMV7RD2T3/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEVRB4MG5UXQ5RLZHSUJXM5GWEBYYS5B/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6P4QULVUE254WI7XF2LWWOGHCYVFXFY/ - https://security.gentoo.org/glsa/202401-12
CVE ID: CVE-2023-45130 State: PUBLISHED Published: 2023-10-13T12:14:15.105Z Last Updated: 2024-09-17T14:30:56.468Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: paritytech Products: frontier Problem Types: CWE-770 Description: Frontier is Substrate's Ethereum compatibility layer. Prior to commit aea528198b3b226e0d20cce878551fd4c0e3d5d0, at the end of a contract execution, when opcode SUICIDE marks a contract to be deleted, the software uses `storage::remove_prefix` (now renamed to `storage::clear_prefix`) to remove all storages associated with it. This is a single IO primitive call passing the WebAssembly boundary. For large contracts, the call (without prov
ith it. This is a single IO primitive call passing the WebAssembly boundary. For large contracts, the call (without providing a `limit` parameter) can be slow. In addition, for parachains, all storages to be deleted will be part of the PoV, which easily exceed relay chain PoV size limit. On the other hand, Frontier's maintainers only charge a fixed cost for opcode SUICIDE. The maintainers consider the severity of this issue high, because an attacker can craft a contract with a lot of storage values on a parachain, and then call opcode SUICIDE on the contract. If the transaction makes into a parachain block, the parachain will then stall because the PoV size will exceed relay chain's limit. T
tion makes into a parachain block, the parachain will then stall because the PoV size will exceed relay chain's limit. This is especially an issue for XCM transactions, because they can't be skipped. Commit aea528198b3b226e0d20cce878551fd4c0e3d5d0 contains a patch for this issue. For parachains, it's recommended to issue an emergency runtime upgrade as soon as possible. For standalone chains, the impact is less severe because the issue mainly affects PoV sizes. It's recommended to issue a normal runtime upgrade as soon as possible. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/paritytech/frontier/s
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/paritytech/frontier/security/advisories/GHSA-gc88-2gvv-gp3v - https://github.com/paritytech/frontier/pull/1212 - https://github.com/paritytech/frontier/commit/aea528198b3b226e0d20cce878551fd4c0e3d5d0
CVE ID: CVE-2023-45131 State: PUBLISHED Published: 2023-10-16T21:24:10.688Z Last Updated: 2024-09-16T15:41:43.734Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-200 Description: Discourse is an open source platform for community discussion. New chat messages can be read by making an unauthenticated POST request to MessageBus. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/disc
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-84gf-hhrc-9pw6
CVE ID: CVE-2023-45132 State: PUBLISHED Published: 2023-10-11T20:21:26.313Z Last Updated: 2024-09-17T13:57:09.781Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: wargio Products: naxsi Problem Types: CWE-693 Description: NAXSI is an open-source maintenance web application firewall (WAF) for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious `X-Forwarded-For` IP matches `IgnoreIP` `IgnoreCIDR` rules. This old code was arranged to allow older NGINX versions to also support `IgnoreIP` `IgnoreCIDR` when multiple reverse proxies were present. The issue is patched in version 1.6. As a worka
port `IgnoreIP` `IgnoreCIDR` when multiple reverse proxies were present. The issue is patched in version 1.6. As a workaround, do not set any `IgnoreIP` `IgnoreCIDR` for older versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wargio/naxsi/security/advisories/GHSA-7qjc-q4j9-pc8x - https://github.com/wargio/naxsi/pull/103 - https://github.com/wargio/naxsi/commit/1b712526ed3314dd6be7e8b0259eabda63c19537
CVE ID: CVE-2023-45133 State: PUBLISHED Published: 2023-10-12T16:17:08.624Z Last Updated: 2025-02-13T17:13:48.413Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: babel Products: babel Problem Types: CWE-184 Description: Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@
te()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any "polyfill provider" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/traverse@7.23.2` and `@babel/traverse@8.0.0-alpha.4`. Those who cannot upgrade `@babel/traver