Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-5600 State: PUBLISHED Published: 2025-06-20T19:31:08.397Z Last Updated: 2025-06-20T19:52:09.173Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-862 Description: An issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. Arbitrary access to the titles of an private specific references could be leaked through the service-desk custom email template. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/428268 - https
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/428268 - https://hackerone.com/reports/2209702
CVE ID: CVE-2023-5601 State: PUBLISHED Published: 2023-11-06T20:41:49.307Z Last Updated: 2025-03-25T19:30:35.535Z Vendors: Unknown Products: WooCommerce Ninja Forms Product Add-ons Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The WooCommerce Ninja Forms Product Add-ons WordPress plugin before 1.7.1 does not validate the file to be uploaded, allowing any unauthenticated users to upload arbitrary files to the server, leading to RCE. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0035ec5e-d405-4eb7-8fe4-29dd0c71e4bc
CVE ID: CVE-2023-5602 State: PUBLISHED Published: 2023-10-20T07:29:33.549Z Last Updated: 2025-02-05T19:03:45.995Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: socialdude Products: Social Media Share Buttons & Social Sharing Icons Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on several functions corresponding to AJAX actions. This makes it possible for unauthenticated attackers to invoke those actions via a forged requ
sponding to AJAX actions. This makes it possible for unauthenticated attackers to invoke those actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d44a45fb-3bff-4a1f-8319-a58a47a9d76b?source=cve - https://plugins.trac.wordpress.org/changeset/2975574/ultimate-social-media-icons/tags/2.8.6/libs/controllers/sfsi_buttons_controller.php?old=2956446&old_path=ultimate-social-media-icons%2Ftags%2F2.8.5%2Flibs%2Fcontrollers%2Fsfsi_buttons_controller.php
CVE ID: CVE-2023-5604 State: PUBLISHED Published: 2023-11-27T16:22:00.940Z Last Updated: 2025-06-05T14:03:11.558Z Vendors: Unknown Products: Asgaros Forum Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administrators, to set insecure configuration that allows unauthenticated users to upload dangerous files (e.g. .php, .phtml), potentially leading to remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/4ce69d71-87bf-4d95-90f2-63d558c78b69
CVE ID: CVE-2023-5605 State: PUBLISHED Published: 2023-11-06T20:42:09.334Z Last Updated: 2024-08-02T08:07:32.124Z Vendors: Unknown Products: URL Shortify Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The URL Shortify WordPress plugin before 1.7.9.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9ec03ef0-0c04-4517-b761-df87af722a64
CVE ID: CVE-2023-5606 State: PUBLISHED Published: 2023-11-02T08:31:43.007Z Last Updated: 2025-02-05T18:52:15.220Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: quantumcloud Products: AI ChatBot Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The ChatBot for WordPress is vulnerable to Stored Cross-Site Scripting via the FAQ Builder in versions 4.8.6 through 4.9.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever
ers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. NOTE: This vulnerability is a re-introduction of CVE-2023-4253. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fc305c48-8337-42b7-ad61-61aea8018def?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2987335%40chatbot%2Ftrunk&old=2986133%40chatbot%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-5607 State: PUBLISHED Published: 2023-11-27T10:36:51.928Z Last Updated: 2024-08-02T08:07:32.355Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Trellix Products: Trellix Application and Change Control (TACC) Problem Types: CWE-22 Description: An improper limitation of a path name to a restricted directory (path traversal) vulnerability in the TACC ePO extension, for on-premises ePO servers, prior to version 8.4.0 could lead to an authorised administrator attacker executing arbitrary code through uploading a specially crafted GTI reputation file. The attacker would need the appropriate privileges to access the relevant section of the User Inte
GTI reputation file. The attacker would need the appropriate privileges to access the relevant section of the User Interface. The import logic has been updated to restrict file types and content. Additional Analyst Notes: - CVE Program Container: References: - https://kcm.trellix.com/corporate/index?page=content&id=SB10411
CVE ID: CVE-2023-5609 State: PUBLISHED Published: 2023-11-20T18:55:06.964Z Last Updated: 2024-08-02T08:07:32.191Z Vendors: Unknown Products: Seraphinite Accelerator Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/aac4bcc8-b826-4165-aed3-f422dd178692
CVE ID: CVE-2023-5610 State: PUBLISHED Published: 2023-11-20T18:55:09.577Z Last Updated: 2024-08-02T08:07:32.179Z Vendors: Unknown Products: Seraphinite Accelerator Problem Types: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') Description: The Seraphinite Accelerator WordPress plugin before 2.2.29 does not validate the URL to redirect any authenticated user to, leading to an arbitrary redirect Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e880a9fb-b089-4f98-9781-7d946f22777e
CVE ID: CVE-2023-5611 State: PUBLISHED Published: 2023-11-27T16:22:05.826Z Last Updated: 2024-08-02T08:07:32.623Z Vendors: Unknown Products: Seraphinite Accelerator Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The Seraphinite Accelerator WordPress plugin before 2.20.32 does not have authorisation and CSRF checks when resetting and importing its settings, allowing unauthenticated users to reset them Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8cb8a5e9-2ab6-4d9b-9ffc-ef530e346f8d
CVE ID: CVE-2023-5612 State: PUBLISHED Published: 2024-01-26T02:02:39.783Z Last Updated: 2025-11-20T04:10:48.267Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-862 Description: An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ - https://
References: - https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ - https://gitlab.com/gitlab-org/gitlab/-/issues/428441 - https://hackerone.com/reports/2208790
CVE ID: CVE-2023-5613 State: PUBLISHED Published: 2023-10-20T04:30:32.364Z Last Updated: 2025-02-05T19:12:06.408Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themepoints Products: Super Testimonials Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tpsscode' shortcode in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above pe
ping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/52659f1c-642e-4c88-b3d0-d5c5a206b11c?source=cve - https://plugins.trac.wordpress.org/browser/super-testimonial/tags/2.8/tp-testimonials.php#L214 - https://plugins.trac.wordpress.org/changeset/2979378/super-testimonial#file9
CVE ID: CVE-2023-5614 State: PUBLISHED Published: 2023-10-20T04:30:31.808Z Last Updated: 2025-02-05T19:12:15.214Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: specialk Products: Theme Switcha – Easily Switch Themes for Development and Testing Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Theme Switcha plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'theme_switcha_list' shortcode in all versions up to, and including, 3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat
insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2b0937fe-3ea6-427a-aef7-539c08687abb?source=cve - https://plugins.trac.wordpress.org/browser/theme-switcha/tags/3.3/inc/plugin-core.php#L445 - https://plugins.trac.wordpress.org/changeset/2979783/theme-switcha#file1
CVE ID: CVE-2023-5615 State: PUBLISHED Published: 2023-10-20T07:29:23.396Z Last Updated: 2025-02-05T19:06:04.693Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ravanh Products: Skype Legacy Buttons Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Skype Legacy Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skype-status' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above
scaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/914bcc8f-fecd-450e-b2a7-0989b7a0dd4c?source=cve - https://plugins.trac.wordpress.org/browser/skype-online-status/tags/3.1/skype-classes.php#L316
CVE ID: CVE-2023-5616 State: PUBLISHED Published: 2025-04-15T18:29:54.565Z Last Updated: 2025-04-15T20:51:31.399Z Vendors: Canonical Ltd. Products: Ubuntu's gnome-control-center Description: In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-server. This could unknowingly leave the local machine exposed to remote SSH access contrary to expectation of the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugs.launchpad.net/ubuntu/+source/gnome-control-center/+bug/2039577 - https://ubuntu.com/security/notices/USN-6554-1 - https://ubuntu.com/security/CVE-2023-56
e-control-center/+bug/2039577 - https://ubuntu.com/security/notices/USN-6554-1 - https://ubuntu.com/security/CVE-2023-5616
CVE ID: CVE-2023-5617 State: PUBLISHED Published: 2024-02-28T22:30:40.128Z Last Updated: 2024-08-29T14:47:10.616Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Hitachi Vantara Products: Pentaho Data Integration & Analytics Problem Types: CWE-550 Description: Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x and 8.3.x, display the version of Tomcat when a server error is encountered. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/24313358254861--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Server-ge
port.pentaho.com/hc/en-us/articles/24313358254861--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Server-generated-Error-Message-Containing-Sensitive-Information-Versions-before-10-1-0-0-and-9-3-0-6-including-all-versions-before-10-0-x-Impacted-CVE-2023-5617
CVE ID: CVE-2023-5618 State: PUBLISHED Published: 2023-10-20T11:33:24.931Z Last Updated: 2025-02-05T19:02:31.244Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: prismtechstudios Products: Modern Footnotes Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Modern Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and including, 1.4.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above,
r supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c20c674f-54b5-470f-b470-07a63501eb4d?source=cve - https://plugins.trac.wordpress.org/changeset/2980695/modern-footnotes
CVE ID: CVE-2023-5619 State: REJECTED Published: N/A Last Updated: 2024-01-04T19:11:30.595Z Description: No description available.
CVE ID: CVE-2023-5620 State: PUBLISHED Published: 2023-11-27T16:22:07.320Z Last Updated: 2024-08-02T08:07:32.570Z Vendors: Unknown Products: Web Push Notifications Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Web Push Notifications WordPress plugin before 4.35.0 does not prevent visitors on the site from changing some of the plugin options, some of which may be used to conduct Stored XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a03330c2-3ae0-404d-a114-33b18cc47666
CVE ID: CVE-2023-5621 State: PUBLISHED Published: 2023-10-18T07:31:16.506Z Last Updated: 2025-02-05T19:15:21.772Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: nik00726 Products: Thumbnail Slider With Lightbox Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Title field in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web
escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/547c425d-8b0f-4e65-8b8a-c3a3059301fe?source=cve - https://wordpress.org/plugins/wp-responsive-slider-with-lightbox/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1263536%40wp-responsive-slider-with-lightbox&new=1263
s.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1263536%40wp-responsive-slider-with-lightbox&new=1263536%40wp-responsive-slider-with-lightbox&sfp_email=&sfph_mail=
CVE ID: CVE-2023-5622 State: PUBLISHED Published: 2023-10-26T16:18:16.410Z Last Updated: 2024-08-02T08:07:32.319Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Tenable Products: Nessus Network Monitor Description: Under certain conditions, Nessus Network Monitor could allow a low privileged user to escalate privileges to NT AUTHORITY\SYSTEM on Windows hosts by replacing a specially crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.tenable.com/security/tns-2023-34
CVE ID: CVE-2023-5623 State: PUBLISHED Published: 2023-10-26T16:25:17.792Z Last Updated: 2024-09-09T15:50:01.791Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Tenable Products: Nessus Network Monitor Description: NNM failed to properly set ACLs on its installation directory, which could allow a low privileged user to run arbitrary code with SYSTEM privileges where NNM is installed to a non-standard location Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/tns-2023-34
CVE ID: CVE-2023-5624 State: PUBLISHED Published: 2023-10-26T16:36:32.251Z Last Updated: 2024-09-09T15:48:24.575Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Tenable Products: Nessus Network Monitor Problem Types: CWE-20 Description: Under certain conditions, Nessus Network Monitor was found to not properly enforce input validation. This could allow an admin user to alter parameters that could potentially allow a blindSQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/tns-2023-34
CVE ID: CVE-2023-5625 State: PUBLISHED Published: 2023-11-01T13:28:10.190Z Last Updated: 2025-11-20T18:06:27.969Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Ironic content for Red Hat OpenShift Container Platform 4.12, Red Hat OpenStack Platform 17.1 for RHEL 8, Red Hat OpenStack Platform 17.1 for RHEL 9 Problem Types: CWE-770 Description: A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419 not being applied for all builds of all products. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - ht
all builds of all products. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:6128 - https://access.redhat.com/errata/RHSA-2024:0188 - https://access.redhat.com/errata/RHSA-2024:0213 - https://access.redhat.com/security/cve/CVE-2023-5625 - https://bugzilla.redhat.com/show_bug.cgi?id=2244717
CVE ID: CVE-2023-5626 State: PUBLISHED Published: 2023-10-17T23:22:41.615Z Last Updated: 2024-09-13T16:20:28.980Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: pkp Products: pkp/ojs Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/c99279c1-709a-4e7b-a042-010c2bb44d6b - https://github.com/pkp/ojs/commit/99a9f393190383454aa5ddffedffc89596f6c682
CVE ID: CVE-2023-5627 State: PUBLISHED Published: 2023-11-01T15:04:13.625Z Last Updated: 2024-09-05T15:45:44.046Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Moxa Products: NPort 6000 Series Problem Types: CWE-303, CWE-257, CWE-327 Description: A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implementation of sensitive information protection, potentially allowing malicious users to gain unauthorized access to the web service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-s
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-232905-nport-6000-series-incorrect-implementation-of-authentication-algorithm-vulnerability
CVE ID: CVE-2023-5629 State: PUBLISHED Published: 2023-12-14T04:42:32.540Z Last Updated: 2024-08-02T08:07:32.488Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: Schneider Electric Products: Trio Q-Series Ethernet Data Radio, Trio E-Series Ethernet Data Radio, Trio J-Series Ethernet Data Radio Problem Types: CWE-601 Description: A CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could cause disclosure of information through phishing attempts over HTTP. Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-346-01&p_enDocType=Security+and+Safety+Noti
erences: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-346-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-346-01.pdf
CVE ID: CVE-2023-5630 State: PUBLISHED Published: 2023-12-14T04:49:38.476Z Last Updated: 2024-08-02T08:07:32.371Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: Schneider Electric Products: Trio Q-Series Ethernet Data Radio, Trio E-Series Ethernet Data Radio, Trio J-Series Ethernet Data Radio Problem Types: CWE-494 Description: A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a privileged user to install an untrusted firmware. Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-346-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD
download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-346-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-346-01.pdf