Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-3544 State: PUBLISHED Published: 2023-07-07T17:00:04.738Z Last Updated: 2024-08-02T07:01:56.039Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: GZ Scripts Products: Time Slot Booking Calendar PHP Problem Types: CWE-79 Description: A vulnerability was found in GZ Scripts Time Slot Booking Calendar PHP 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-233296. NOTE: The vendor was contacted early about this disclosure but
ely. The identifier of this vulnerability is VDB-233296. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.233296 - https://vuldb.com/?ctiid.233296
CVE ID: CVE-2023-3545 State: PUBLISHED Published: 2023-11-28T07:07:27.183Z Last Updated: 2024-08-02T07:01:57.437Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Chamilo Products: Chamilo Problem Types: CWE-178 Description: Improper sanitisation in `main/inc/lib/fileUpload.lib.php` in Chamilo LMS <= v1.11.20 on Windows and Apache installations allows unauthenticated attackers to bypass file upload security protections and obtain remote code execution via uploading of `.htaccess` file. This vulnerability may be exploited by privileged attackers or chained with unauthenticated arbitrary file write vulnerabilities, such as CVE-2023-3533, to achieve remote cod
ckers or chained with unauthenticated arbitrary file write vulnerabilities, such as CVE-2023-3533, to achieve remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://support.chamilo.org/projects/chamilo-18/wiki/security_issues#Issue-125-2023-07-13-Critical-impact-Moderate-risk-Htaccess-File-Upload-Security-Bypass-on-Windows-CVE-2023-3545 - https://starlabs.sg/advisories/23/23-3545/ - https://github.com/chamilo/chamilo-lms/commit/dc7bfce429fbd843a95a57c184b6992c4d709549
CVE ID: CVE-2023-3547 State: PUBLISHED Published: 2023-09-25T15:56:55.505Z Last Updated: 2025-04-23T16:15:31.643Z Vendors: Unknown Products: All in One B2B for WooCommerce Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly check nonce values in several actions, allowing an attacker to perform CSRF attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3cfb6696-18ad-4a38-9ca3-992f0b768b78
CVE ID: CVE-2023-3548 State: PUBLISHED Published: 2023-07-25T13:01:04.564Z Last Updated: 2024-10-23T19:01:43.727Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Johnson Controls Products: IQ Wifi 6 Problem Types: CWE-307 Description: An unauthorized user could gain account access to IQ Wifi 6 versions prior to 2.0.2 by conducting a brute force authentication attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-23-206-04
CVE ID: CVE-2023-3549 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:33.510Z Description: No description available.
CVE ID: CVE-2023-3550 State: PUBLISHED Published: 2023-09-25T15:20:27.351Z Last Updated: 2025-02-13T16:55:50.983Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: MediaWiki Products: MediaWiki Problem Types: CWE-79 Description: Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a low-privileged user account can use this exploit to become an administrator by sending a malicious link to the instance administrator. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/blondie/ - https://www.
VE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/blondie/ - https://www.mediawiki.org/wiki/MediaWiki/ - https://www.debian.org/security/2023/dsa-5520 - https://lists.debian.org/debian-lts-announce/2023/11/msg00027.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/
CVE ID: CVE-2023-3551 State: PUBLISHED Published: 2023-07-08T08:05:24.407Z Last Updated: 2024-10-30T14:49:35.947Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: nilsteampassnet Products: nilsteampassnet/teampass Problem Types: CWE-94 Description: Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/cf8878ff-6cd9-49be-b313-7ac2a94fc7f7 - https://github.com/nilsteampassnet/teampass/commit/cc6abc76aa46ed4a27736c1d2f21e432a5d54e6f
CVE ID: CVE-2023-3552 State: PUBLISHED Published: 2023-07-08T08:19:04.324Z Last Updated: 2024-10-30T14:47:23.427Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: nilsteampassnet Products: nilsteampassnet/teampass Problem Types: CWE-116 Description: Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/aeb2f43f-0602-4ac6-9685-273e87ff4ded - https://github.com/nilsteampassnet/teampass/commit/8acb4dacc2d008a4186a4e13cc143e978f113955
CVE ID: CVE-2023-3553 State: PUBLISHED Published: 2023-07-08T08:33:44.816Z Last Updated: 2024-10-30T14:46:29.538Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: nilsteampassnet Products: nilsteampassnet/teampass Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/857f002a-2794-4807-aa5d-2f340de01870 - https://github.com/nilsteampassnet/teampass/commit/e9f90b746fdde135da3c7fbe4fa22fe2bd32e66b
CVE ID: CVE-2023-3554 State: PUBLISHED Published: 2023-07-08T12:00:05.148Z Last Updated: 2024-08-02T07:01:56.879Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: GZ Scripts Products: GZ Forum Script Problem Types: CWE-79 Description: A vulnerability was found in GZ Scripts GZ Forum Script 1.8 and classified as problematic. Affected by this issue is some unknown functionality of the file /preview.php. The manipulation of the argument catid/topicid/topic/topic_message/free_name leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-233348. NOTE: The vendor was contacted early about this disclosure but did not respond in any wa
is vulnerability is VDB-233348. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.233348 - https://vuldb.com/?ctiid.233348
CVE ID: CVE-2023-3555 State: PUBLISHED Published: 2023-07-08T12:31:03.435Z Last Updated: 2024-10-23T20:25:51.690Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: GZ Scripts Products: PHP Vacation Rental Script Problem Types: CWE-79 Description: A vulnerability was found in GZ Scripts PHP Vacation Rental Script 1.8. It has been classified as problematic. This affects an unknown part of the file /preview.php. The manipulation of the argument page/layout/sort_by/property_id leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-233349 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not r
VDB-233349 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.233349 - https://vuldb.com/?ctiid.233349
CVE ID: CVE-2023-3556 State: PUBLISHED Published: 2023-07-08T13:00:05.071Z Last Updated: 2024-08-02T07:01:56.699Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: GZ Scripts Products: Car Listing Script PHP Problem Types: CWE-79 Description: A vulnerability was found in GZ Scripts Car Listing Script PHP 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file /preview.php. The manipulation of the argument page/sort_by leads to cross site scripting. The attack can be initiated remotely. VDB-233350 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional
his vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.233350 - https://vuldb.com/?ctiid.233350
CVE ID: CVE-2023-3557 State: PUBLISHED Published: 2023-07-08T13:31:03.870Z Last Updated: 2024-10-28T17:06:06.830Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: GZ Scripts Products: Property Listing Script Problem Types: CWE-79 Description: A vulnerability was found in GZ Scripts Property Listing Script 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /preview.php. The manipulation of the argument page/layout/sort_by leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-233351. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
vulnerability is VDB-233351. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.233351 - https://vuldb.com/?ctiid.233351
CVE ID: CVE-2023-3558 State: PUBLISHED Published: 2023-07-08T14:00:04.816Z Last Updated: 2024-08-02T07:01:56.648Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: GZ Scripts Products: Event Booking Calendar Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in GZ Scripts Event Booking Calendar 1.8. Affected is an unknown function of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-233352. NOTE: The vendor was contacted early about this disclosure but did not respond in any
this vulnerability is VDB-233352. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.233352 - https://vuldb.com/?ctiid.233352
CVE ID: CVE-2023-3559 State: PUBLISHED Published: 2023-07-08T14:31:03.417Z Last Updated: 2024-10-23T20:02:47.889Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: GZ Scripts Products: PHP GZ Appointment Scheduling Script Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in GZ Scripts PHP GZ Appointment Scheduling Script 1.8. Affected by this vulnerability is an unknown functionality of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. The attack can be launched remotely. The identifier VDB-233353 was assigned to this vulnerability. NOTE: The vendor was contacted ear
n be launched remotely. The identifier VDB-233353 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.233353 - https://vuldb.com/?ctiid.233353
CVE ID: CVE-2023-3560 State: PUBLISHED Published: 2023-07-08T15:00:04.138Z Last Updated: 2024-08-02T07:01:55.960Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: GZ Scripts Products: Ticket Booking Script Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in GZ Scripts Ticket Booking Script 1.8. Affected by this issue is some unknown functionality of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. The attack may be launched remotely. VDB-233354 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclo
ely. VDB-233354 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.233354 - https://vuldb.com/?ctiid.233354
CVE ID: CVE-2023-3561 State: PUBLISHED Published: 2023-07-08T15:31:03.360Z Last Updated: 2024-08-02T07:01:55.910Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: GZ Scripts Products: PHP GZ Hotel Booking Script Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in GZ Scripts PHP GZ Hotel Booking Script 1.8. This affects an unknown part of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-233355. NOTE: The vendor was contacted early about this disclosure
he associated identifier of this vulnerability is VDB-233355. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.233355 - https://vuldb.com/?ctiid.233355
CVE ID: CVE-2023-3562 State: PUBLISHED Published: 2023-07-08T16:00:05.017Z Last Updated: 2024-08-02T07:01:56.063Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: GZ Scripts Products: PHP CRM Platform Problem Types: CWE-79 Description: A vulnerability has been found in GZ Scripts PHP CRM Platform 1.8 and classified as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument action leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-233356. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program C
ndor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.233356 - https://vuldb.com/?ctiid.233356
CVE ID: CVE-2023-3563 State: PUBLISHED Published: 2023-07-08T16:31:03.315Z Last Updated: 2024-11-21T15:59:23.573Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: GZ Scripts Products: GZ E Learning Platform Problem Types: CWE-79 Description: A vulnerability was found in GZ Scripts GZ E Learning Platform 1.8 and classified as problematic. This issue affects some unknown processing of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-233357 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.233357
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.233357 - https://vuldb.com/?ctiid.233357
CVE ID: CVE-2023-3564 State: PUBLISHED Published: 2023-07-08T17:00:03.885Z Last Updated: 2024-08-02T07:01:55.930Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: GZ Scripts Products: GZ Multi Hotel Booking System Problem Types: CWE-79 Description: A vulnerability was found in GZ Scripts GZ Multi Hotel Booking System 1.8. It has been classified as problematic. Affected is an unknown function of the file /index.php. The manipulation of the argument adults/children/cal_id leads to cross site scripting. It is possible to launch the attack remotely. VDB-233358 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuld
identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.233358 - https://vuldb.com/?ctiid.233358
CVE ID: CVE-2023-3565 State: PUBLISHED Published: 2023-07-08T13:24:33.695Z Last Updated: 2024-10-30T14:37:07.361Z Severity: MEDIUM (CVSS 5.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N) Vendors: nilsteampassnet Products: nilsteampassnet/teampass Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/fcf46e1f-2ab6-4057-9d25-cf493ab09530 - https://github.com/nilsteampassnet/teampass/commit/820bb49a362a566c9038e4a3048b26d654babb0e
CVE ID: CVE-2023-3566 State: PUBLISHED Published: 2023-07-08T17:31:03.631Z Last Updated: 2024-08-02T07:01:55.917Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: wallabag Problem Types: CWE-770 Description: A vulnerability was found in wallabag 2.5.4. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /config of the component Profile Config. The manipulation of the argument Name leads to allocation of resources. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233359. NOTE: The vendor was contacted early about this disclosur
The associated identifier of this vulnerability is VDB-233359. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.233359 - https://vuldb.com/?ctiid.233359 - https://github.com/ctflearner/Vulnerability/blob/main/WALLABAG/NAME-LIMIT.md - https://youtu.be/ouwud0PlHkE
CVE ID: CVE-2023-3567 State: PUBLISHED Published: 2023-07-24T15:19:19.795Z Last Updated: 2025-11-06T19:46:34.822Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-416 Description: A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_scr
erprise Linux 7 Problem Types: CWE-416 Description: A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:0412 - https://access.redhat.com/errata/RHSA-2024:0431 - https://access.redhat.com/errata/RHSA-2024:0432 - https://access.redhat.com/errata/RHSA-2024:0439 - https://access.redhat.com/errata/RHSA-2024:0448 - https://access.redhat.com/errata/RHSA-2024:0575 - https://access.redhat.com/errata/RHSA-2024:2394 - https://
2024:0448 - https://access.redhat.com/errata/RHSA-2024:0575 - https://access.redhat.com/errata/RHSA-2024:2394 - https://access.redhat.com/errata/RHSA-2024:2950 - https://access.redhat.com/errata/RHSA-2024:3138 - https://access.redhat.com/security/cve/CVE-2023-3567 - https://bugzilla.redhat.com/show_bug.cgi?id=2221463 - https://www.spinics.net/lists/stable-commits/msg285184.html
CVE ID: CVE-2023-3568 State: PUBLISHED Published: 2023-07-10T07:28:46.277Z Last Updated: 2024-11-07T15:11:16.277Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: alextselegidis Products: alextselegidis/easyappointments Problem Types: CWE-601 Description: Open Redirect in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/e8d530db-a6a7-4f79-a95d-b77654cc04f8 - https://github.com/alextselegidis/easyappointments/commit/b37b46019553089db4f22eb2fe998bca84b2cb64
CVE ID: CVE-2023-3569 State: PUBLISHED Published: 2023-08-08T06:56:40.395Z Last Updated: 2025-02-27T21:10:39.956Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: PHOENIX CONTACT Products: CLOUD CLIENT 1101T-TX/TX, TC CLOUD CLIENT 1002-4G, TC CLOUD CLIENT 1002-4G ATT, TC CLOUD CLIENT 1002-4G VZW, TC ROUTER 3002T-4G, TC ROUTER 3002T-4G ATT, TC ROUTER 3002T-4G VZW Problem Types: CWE-776 Description: In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an authenticated remote attacker with admin privileges could upload a crafted XML file which causes a denial-of-service. Additional Ana
d remote attacker with admin privileges could upload a crafted XML file which causes a denial-of-service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2023-017 - http://seclists.org/fulldisclosure/2023/Aug/12 - http://packetstormsecurity.com/files/174152/Phoenix-Contact-TC-Cloud-TC-Router-2.x-XSS-Memory-Consumption.html
CVE ID: CVE-2023-3570 State: PUBLISHED Published: 2023-08-08T06:52:57.641Z Last Updated: 2024-10-15T19:13:29.756Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PHOENIX CONTACT Products: WP 6070-WVPS, WP 6101-WXPS, WP 6121-WXPS, WP 6156-WHPS, WP 6185-WHPS, WP 6215-WHPS Problem Types: CWE-78 Description: In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP DELETE request to gain full access to the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2023-018/
CVE ID: CVE-2023-3571 State: PUBLISHED Published: 2023-08-08T06:52:05.745Z Last Updated: 2024-11-04T17:15:17.983Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PHOENIX CONTACT Products: WP 6070-WVPS, WP 6101-WXPS, WP 6121-WXPS, WP 6156-WHPS, WP 6185-WHPS, WP 6215-WHPS Problem Types: CWE-78 Description: In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP POST releated to certificate operations to gain full access to the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2023-018/
CVE ID: CVE-2023-3572 State: PUBLISHED Published: 2023-08-08T06:52:29.820Z Last Updated: 2024-10-15T19:18:16.801Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: PHOENIX CONTACT Products: WP 6070-WVPS, WP 6101-WXPS, WP 6121-WXPS, WP 6156-WHPS, WP 6185-WHPS, WP 6215-WHPS Problem Types: CWE-78 Description: In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote, unauthenticated attacker may use an attribute of a specific HTTP POST request releated to date/time operations to gain full access to the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2023-018/