Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-26537 State: PUBLISHED Published: 2023-06-16T11:13:58.621Z Last Updated: 2025-02-19T21:29:34.987Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: nicolly Products: WP No External Links Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nicolly WP No External Links plugin <= 1.0.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/no-external-links/wordpress-wp-no-external-links-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-26538 State: PUBLISHED Published: 2023-06-13T14:12:48.141Z Last Updated: 2024-11-01T14:02:10.392Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Kamyabsoft Products: Chat Bee Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kamyabsoft Chat Bee plugin <= 1.1.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/chat-bee/wordpress-chat-bee-plugin-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-26539 State: PUBLISHED Published: 2023-06-22T11:50:05.284Z Last Updated: 2024-10-10T17:22:50.977Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Max Chirkov Products: Advanced Text Widget Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Chirkov Advanced Text Widget plugin <= 2.1.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/advanced-text-widget/wordpress-advanced-text-widget-plugin-2-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-26540 State: PUBLISHED Published: 2024-05-17T06:41:55.360Z Last Updated: 2024-08-02T11:53:52.908Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Favethemes Products: Houzez Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in Favethemes Houzez allows Privilege Escalation.This issue affects Houzez: from n/a through 2.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/houzez/wordpress-houzez-theme-2-7-1-privilege-escalation?_s_id=cve
CVE ID: CVE-2023-26541 State: PUBLISHED Published: 2023-06-16T08:56:47.659Z Last Updated: 2024-10-10T18:55:50.472Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Alexander Suess Products: asMember Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alexander Suess asMember plugin <= 1.5.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/asmember/wordpress-asmember-plugin-1-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-26542 State: PUBLISHED Published: 2023-11-22T15:05:57.416Z Last Updated: 2024-08-02T11:53:54.234Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Exeebit Products: phpinfo() WP Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Exeebit phpinfo() WP plugin <= 4.0 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/phpinfo-wp/wordpress-phpinfo-wp-plugin-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-26543 State: PUBLISHED Published: 2023-11-13T00:02:41.555Z Last Updated: 2024-08-29T13:25:18.795Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Aleksandr Guidrevitch Products: WP Meteor Website Speed Optimization Addon Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Aleksandr Guidrevitch WP Meteor Website Speed Optimization Addon plugin <= 3.1.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-meteor/wordpress-wp-meteor-page-speed-optimization-topping-plugin-3-1-4-cross-site-request-forgery-csrf-vulnera
ility/wp-meteor/wordpress-wp-meteor-page-speed-optimization-topping-plugin-3-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-26544 State: PUBLISHED Published: 2023-02-25T00:00:00.000Z Last Updated: 2025-05-05T16:04:24.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel 6.0.8, there is a use-after-free in run_unpack in fs/ntfs3/run.c, related to a difference between NTFS sector size and media sector size. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lkml.org/lkml/2023/2/20/128 - https://security.netapp.com/advisory/ntap-20230316-0010/ - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=887bfc546097fbe8071dac13b2fef73b77920899 - https://bugzilla.suse.com/show_bug.cgi?id=1208697
CVE ID: CVE-2023-26545 State: PUBLISHED Published: 2023-02-25T00:00:00.000Z Last Updated: 2025-03-20T20:45:02.001Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/torvalds/linux/commit/fda6c89fe3d9aca073495a664e1d5aea28cd4377 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fda6c89fe3d9aca073495a664e1d5aea28cd4377 - https://cdn.kernel.org/pub/linux/kerne
rnel/git/torvalds/linux.git/commit/?id=fda6c89fe3d9aca073495a664e1d5aea28cd4377 - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.13 - https://security.netapp.com/advisory/ntap-20230316-0009/ - https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html - https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
CVE ID: CVE-2023-26546 State: PUBLISHED Published: 2023-05-02T00:00:00.000Z Last Updated: 2025-01-30T16:47:42.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: European Chemicals Agency IUCLID before 6.27.6 allows remote authenticated users to execute arbitrary code via Server Side Template Injection (SSTI) with a crafted template file. The attacker must have template manager permission. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://iuclid6.echa.europa.eu - https://iuclid6.echa.europa.eu/download - https://iuclid6.echa.europa.eu/documents/1387205/1809530/note_v6.27.6.pdf/76545a65-e6be-6486-280a-7d7c3d2ad455?t=1677577170669
CVE ID: CVE-2023-26547 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T15:44:57.288Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Serialization/deserialization mismatch vulnerability Description: The InputMethod module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-0000001529824505 - https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE ID: CVE-2023-26548 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T15:43:20.215Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Serialization/deserialization mismatch vulnerability Description: The pgmng module has a vulnerability in serialization/deserialization. Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-0000001529824505 - https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE ID: CVE-2023-26549 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T15:41:58.403Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Improper parameters vulnerability Description: The SystemUI module has a vulnerability of repeated app restart due to improper parameters. Successful exploitation of this vulnerability may affect confidentiality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-0000001529824505 - https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE ID: CVE-2023-26550 State: PUBLISHED Published: 2023-02-25T00:00:00.000Z Last Updated: 2025-03-11T20:29:33.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in BMC Control-M before 9.0.20.214 allows attackers to execute arbitrary SQL commands via the memname JSON field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.synacktiv.com/sites/default/files/2023-02/Synacktiv-ControlM-Multiple-Vulnerabilities.pdf
CVE ID: CVE-2023-26551 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-11T15:32:41.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/spwpun/ntp-4.2.8p15-cves/blob/main/CVE-2023-26551 - https://github.com/spwpun/ntp-4.2.8p15-cves/issues/1#issuecomment-1506667321
CVE ID: CVE-2023-26552 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-11T15:30:15.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/spwpun/ntp-4.2.8p15-cves/blob/main/CVE-2023-26552 - https://github.com/spwpun/ntp-4.2.8p15-cves/issues/1#issuecomment-1506667321
CVE ID: CVE-2023-26553 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-11T15:27:09.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/spwpun/ntp-4.2.8p15-cves/blob/main/CVE-2023-26553 - https://github.com/spwpun/ntp-4.2.8p15-cves/issues/1#issuecomment-1506667321
CVE ID: CVE-2023-26554 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-11T15:26:14.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/spwpun/ntp-4.2.8p15-cves/blob/main/CVE-2023-26554 - https://github.com/spwpun/ntp-4.2.8p15-cves/issues/1#issuecomment-1506667321
CVE ID: CVE-2023-26555 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-11T21:03:51.172Z Vendors: n/a Products: n/a Problem Types: n/a Description: praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method would be complex, e.g., with a manipulated GPS receiver. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/spwpun/ntp-4.2.8p15-cves/blob/main/CVE-2023-26555 - https://github.com/spwpun/ntp-4.2.8p15-cves/issues/1#issuecomment-1506546409 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IY2SVYH4MKPAXEYHCCXD3Z6VGINL
://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IY2SVYH4MKPAXEYHCCXD3Z6VGINLSVHK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3VHEHHWCTYSB7HVJLYPVK4RPJZ5LX52/
CVE ID: CVE-2023-26556 State: PUBLISHED Published: 2023-04-21T00:00:00.000Z Last Updated: 2025-02-05T14:43:19.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implementation in Go crypto/elliptic, which is not constant time (there is an if statement in a loop). One leak is in ecdsa/keygen/round_2.go. (bnb-chain/tss-lib and thorchain/tss are also affected.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/IoFinnet/tss-lib/releases/tag/v2.0.0 - https://github.com/bnb-chain/tss-lib/tree/v1.
t: References: - https://github.com/IoFinnet/tss-lib/releases/tag/v2.0.0 - https://github.com/bnb-chain/tss-lib/tree/v1.3.5 - https://gitlab.com/thorchain/tss/tss-lib/-/tags/v0.1.3 - https://medium.com/%40iofinnet/security-disclosure-for-ecdsa-and-eddsa-threshold-signature-schemes-4e969af7155b
CVE ID: CVE-2023-26557 State: PUBLISHED Published: 2023-04-21T00:00:00.000Z Last Updated: 2025-02-05T14:35:44.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, which is not constant time for Cmp, modular exponentiation, or modular inverse. An example leak is in crypto/paillier/paillier.go. (bnb-chain/tss-lib and thorchain/tss are also affected.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/IoFinnet/tss-lib/releases/tag/v2.0.0 - https://github.com/bnb-chain/tss-lib/tree/v1.3.5 -
ferences: - https://github.com/IoFinnet/tss-lib/releases/tag/v2.0.0 - https://github.com/bnb-chain/tss-lib/tree/v1.3.5 - https://gitlab.com/thorchain/tss/tss-lib/-/tags/v0.1.3 - https://medium.com/%40iofinnet/security-disclosure-for-ecdsa-and-eddsa-threshold-signature-schemes-4e969af7155b
CVE ID: CVE-2023-26559 State: PUBLISHED Published: 2023-04-14T00:00:00.000Z Last Updated: 2025-02-07T16:05:03.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal vulnerability in Oxygen XML Web Author before 25.0.0.3 build 2023021715 and Oxygen Content Fusion before 5.0.3 build 2023022015 allows an attacker to read files from a WEB-INF directory via a crafted HTTP request. (XML Web Author 24.1.0.3 build 2023021714 and 23.1.1.4 build 2023021715 are also fixed versions.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://oxygenxml.com - https://www.oxygenxml.com/security/advisory/SYNC-2023-042301.html
CVE ID: CVE-2023-26560 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-04T15:15:50.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: Northern.tech CFEngine Enterprise before 3.21.1 allows a subset of authenticated users to leverage the Scheduled Reports feature to read arbitrary files and potentially discover credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://northern.tech - https://cfengine.com/blog/2023/cve-2023-26560/
CVE ID: CVE-2023-26562 State: PUBLISHED Published: 2024-02-13T00:00:00 Last Updated: 2024-10-28T14:55:42.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Zimbra Collaboration (ZCS) 8.8.15 and 9.0, a closed account (with 2FA and generated passwords) can send e-mail messages when configured for Imap/smtp. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
CVE ID: CVE-2023-26563 State: PUBLISHED Published: 2023-07-12T00:00:00 Last Updated: 2024-11-07T15:10:35.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Syncfusion EJ2 Node File Provider 0102271 is vulnerable to filesystem-server.js directory traversal. As a result, an unauthenticated attacker can: - On Windows, list files in any directory, read any file, delete any file, upload any file to any directory accessible by the web server. - On Linux, read any file, download any directory, delete any file, upload any file to any directory accessible by the web server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Sy
server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/SyncfusionExamples/ej2-filemanager-node-filesystem - https://ej2.syncfusion.com/documentation/file-manager/file-system-provider/ - https://github.com/RupturaInfoSec/CVE-2023-26563-26564-26565/
CVE ID: CVE-2023-26564 State: PUBLISHED Published: 2023-07-12T00:00:00 Last Updated: 2024-11-07T15:09:03.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Syncfusion EJ2 ASPCore File Provider 3ac357f is vulnerable to Models/PhysicalFileProvider.cs directory traversal. As a result, an unauthenticated attacker can list files within a directory, download any file, or upload any file to any directory accessible by the web server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ej2.syncfusion.com/documentation/file-manager/file-system-provider/ - https://github.com/SyncfusionExamples/ej2-aspcore-file-provider - https://github.com
ile-manager/file-system-provider/ - https://github.com/SyncfusionExamples/ej2-aspcore-file-provider - https://github.com/RupturaInfoSec/CVE-2023-26563-26564-26565/
CVE ID: CVE-2023-26566 State: PUBLISHED Published: 2024-05-10T16:14:57.308Z Last Updated: 2025-02-13T15:46:39.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sangoma FreePBX 1805 through 2203 on Linux contains hardcoded credentials for the Asterisk REST Interface (ARI), which allows remote attackers to reconfigure Asterisk and make external and internal calls via HTTP and WebSocket requests sent to the API. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://qsecure.com.cy/resources/advisories/sangoma-freepbx-linux-hardcoded-credentials
CVE ID: CVE-2023-26567 State: PUBLISHED Published: 2023-04-26T00:00:00.000Z Last Updated: 2025-02-03T17:41:54.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of global variables. This exposes cleartext authentication credentials for the Asterisk Database (MariaDB/MySQL) and Asterisk Manager Interface. For example, an attacker can make a /ari/asterisk/variable?variable=AMPDBPASS API call. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.freepbx.org - https://www.sangoma.com/products/open-sourc
Container: - CISA ADP Vulnrichment: References: - https://www.freepbx.org - https://www.sangoma.com/products/open-source/ - https://qsecure.com.cy/resources/advisories/sangoma-freepbx-linux-insecure-permissions
CVE ID: CVE-2023-26568 State: PUBLISHED Published: 2023-10-25T08:34:57.572Z Last Updated: 2024-09-11T13:15:15.269Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IDAttend Pty Ltd Products: IDWeb Problem Types: CWE-89 Description: Unauthenticated SQL injection in the GetStudentGroupStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-26568
CVE ID: CVE-2023-26569 State: PUBLISHED Published: 2023-10-25T08:35:38.289Z Last Updated: 2024-09-10T20:53:41.385Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IDAttend Pty Ltd Products: IDWeb Problem Types: CWE-89 Description: Unauthenticated SQL injection in the StudentPopupDetails_Timetable method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-26569
CVE ID: CVE-2023-26570 State: PUBLISHED Published: 2023-10-25T08:38:38.666Z Last Updated: 2024-10-15T18:32:48.982Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IDAttend Pty Ltd Products: IDWeb Problem Types: CWE-306 Description: Missing authentication in the StudentPopupDetails_Timetable method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthenticated attackers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-26570
CVE ID: CVE-2023-26571 State: PUBLISHED Published: 2023-10-25T08:41:56.846Z Last Updated: 2024-10-15T18:32:32.660Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: IDAttend Pty Ltd Products: IDWeb Problem Types: CWE-306 Description: Missing authentication in the SetStudentNotes method in IDAttend’s IDWeb application 3.1.052 and earlier allows modification of student data by unauthenticated attackers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-26571
CVE ID: CVE-2023-26572 State: PUBLISHED Published: 2023-10-25T08:44:57.535Z Last Updated: 2024-09-10T20:34:13.115Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IDAttend Pty Ltd Products: IDWeb Problem Types: CWE-89 Description: Unauthenticated SQL injection in the GetExcursionList method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-26572
CVE ID: CVE-2023-26573 State: PUBLISHED Published: 2023-10-25T08:48:08.077Z Last Updated: 2024-10-15T18:32:23.647Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: IDAttend Pty Ltd Products: IDWeb Problem Types: CWE-306 Description: Missing authentication in the SetDB method in IDAttend’s IDWeb application 3.1.052 and earlier allows denial of service or theft of database login credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-26573
CVE ID: CVE-2023-26574 State: PUBLISHED Published: 2023-10-25T08:51:06.315Z Last Updated: 2024-10-15T18:31:58.453Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IDAttend Pty Ltd Products: IDWeb Problem Types: CWE-306 Description: Missing authentication in the SearchStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthenticated attackers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-26574