Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-40311 State: PUBLISHED Published: 2023-08-14T17:31:29.877Z Last Updated: 2024-09-27T21:57:16.869Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: The OpenNMS Group Products: Horizon, Meridian Problem Types: CWE-79 Description: Multiple stored XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms that allow an attacker to store on database and then load on JSPs or Angular templates. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they
22.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Jordi Miralles Comins for reporting this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenNMS/opennms - https://github.com/OpenNMS/opennms/pull/6365 - https://github.com/OpenNMS/opennms/pull/6366
CVE ID: CVE-2023-40312 State: PUBLISHED Published: 2023-08-14T17:35:26.710Z Last Updated: 2024-09-27T21:57:09.816Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: The OpenNMS Group Products: Horizon, Meridian Problem Types: CWE-79 Description: Multiple reflected XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms that an attacker can modify to craft a malicious XSS payload. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for insta
0.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Jordi Miralles Comins for reporting this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.opennms.com/horizon/32/releasenotes/changelog.html - https://github.com/OpenNMS/opennms/pull/6356
CVE ID: CVE-2023-40313 State: PUBLISHED Published: 2023-08-17T18:24:08.866Z Last Updated: 2024-10-08T13:04:43.357Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: The OpenNMS Group Products: Horizon, Meridian Description: A BeanShell interpreter in remote server mode runs in OpenMNS Horizon versions earlier than 32.0.2 and in related Meridian versions which could allow arbitrary remote Java code execution. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not
tion instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.opennms.com/horizon/32/releasenotes/changelog.html - https://github.com/OpenNMS/opennms/pull/6368
CVE ID: CVE-2023-40314 State: PUBLISHED Published: 2023-11-16T21:14:07.488Z Last Updated: 2024-08-29T14:45:44.028Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: The OpenNMS Group, The OpenNMS Group Products: Horizon, Meridian Problem Types: CWE-20, CWE-79 Description: Cross-site scripting in bootstrap.jsp in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Horizon 32.0.5 or newer and Meridian 2023.1.9 or newer Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be dir
structions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Moshe Apelbaum for reporting this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenNMS/opennms/pull/6791
CVE ID: CVE-2023-40315 State: PUBLISHED Published: 2023-08-17T19:04:01.437Z Last Updated: 2024-10-28T19:17:45.325Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L) Vendors: The OpenNMS Group Products: Horizon, Meridian Description: In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 and related Meridian versions, any user that has the ROLE_FILESYSTEM_EDITOR can easily escalate their privileges to ROLE_ADMIN or any other role. The solution is to upgrade to Meridian 2023.1.5 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly a
ons state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenNMS/opennms/pull/6250 - https://docs.opennms.com/meridian/2023/releasenotes/changelog.html#releasenotes-changelog-Meridian-2023.1.5
CVE ID: CVE-2023-40327 State: PUBLISHED Published: 2025-01-02T14:59:13.527Z Last Updated: 2025-01-03T18:57:14.723Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Putler / Storeapps Products: Putler Connector for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in Putler / Storeapps Putler Connector for WooCommerce.This issue affects Putler Connector for WooCommerce: from n/a through 2.12.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woocommerce-putler-connector/vulnerability/wordpress-putler-connector-for-woocommerce-plugin-2-12-0-unauthenticated-broken
ocommerce-putler-connector/vulnerability/wordpress-putler-connector-for-woocommerce-plugin-2-12-0-unauthenticated-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-40328 State: PUBLISHED Published: 2023-09-06T08:26:46.076Z Last Updated: 2024-09-24T18:49:00.840Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Carrrot Products: Carrrot Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Carrrot plugin <= 1.1.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/carrrot/wordpress-carrot-plugin-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-40329 State: PUBLISHED Published: 2023-09-06T08:24:13.637Z Last Updated: 2024-09-24T18:49:12.692Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: WPZest Products: Custom Admin Login Page | WPZest Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPZest Custom Admin Login Page | WPZest plugin <= 1.2.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/custom-admin-login-styler-wpzest/wordpress-custom-admin-login-page-wpzest-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-40330 State: PUBLISHED Published: 2023-09-27T05:35:16.564Z Last Updated: 2024-09-23T18:17:32.055Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Milan Petrovic Products: GD Security Headers Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Milan Petrovic GD Security Headers plugin <= 1.6.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/gd-security-headers/wordpress-gd-security-headers-plugin-1-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-40331 State: PUBLISHED Published: 2024-12-13T14:24:07.027Z Last Updated: 2024-12-13T18:18:55.488Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: bqworks Products: Accordion Slider Problem Types: CWE-862 Description: Missing Authorization vulnerability in bqworks Accordion Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion Slider: from n/a through 1.9.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/accordion-slider/vulnerability/wordpress-accordion-slider-plugin-1-9-6-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-40332 State: PUBLISHED Published: 2024-06-04T07:18:30.124Z Last Updated: 2024-08-02T18:31:53.287Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Lester ‘GaMerZ’ Chan Products: WP-PostRatings Problem Types: CWE-799 Description: Improper Control of Interaction Frequency vulnerability in Lester ‘GaMerZ’ Chan WP-PostRatings allows Functionality Misuse.This issue affects WP-PostRatings: from n/a through 1.91. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-postratings/wordpress-wp-postratings-plugin-1-91-rating-limit-bypass-vulnerability?_s_id=cve
CVE ID: CVE-2023-40333 State: PUBLISHED Published: 2023-09-27T11:25:35.617Z Last Updated: 2024-09-23T12:50:16.175Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Qode Interactive Products: Bridge Core Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Qode Interactive Bridge Core plugin <= 3.0.9 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/bridge-core/wordpress-bridge-core-plugin-3-0-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-40334 State: PUBLISHED Published: 2024-12-13T14:24:07.581Z Last Updated: 2024-12-13T18:09:26.357Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: realmag777 Products: HUSKY Problem Types: CWE-862 Description: Missing Authorization vulnerability in realmag777 HUSKY allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HUSKY: from n/a through 1.3.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woocommerce-products-filter/vulnerability/wordpress-husky-products-filter-for-woocommerce-professional-plugin-1-3-4-2-broken-access-control-vulner
r/vulnerability/wordpress-husky-products-filter-for-woocommerce-professional-plugin-1-3-4-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-40335 State: PUBLISHED Published: 2023-11-13T09:48:58.774Z Last Updated: 2024-08-28T15:09:10.576Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Jeremy O'Connell Products: Cleverwise Daily Quotes Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Jeremy O'Connell Cleverwise Daily Quotes allows Stored XSS.This issue affects Cleverwise Daily Quotes: from n/a through 3.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/cleverwise-daily-quotes/wordpress-cleverwise-daily-quotes-plugin-3-2-cross-site-scripting-xss-vulnerabilit
vulnerability/cleverwise-daily-quotes/wordpress-cleverwise-daily-quotes-plugin-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-40336 State: PUBLISHED Published: 2023-08-16T14:32:49.394Z Last Updated: 2024-10-08T18:33:08.705Z Vendors: Jenkins Project Products: Jenkins Folders Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy folders. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3106 - http://www.openwall.com/lists/oss-security/2023/08/16/3
CVE ID: CVE-2023-40337 State: PUBLISHED Published: 2023-08-16T14:32:50.031Z Last Updated: 2024-10-08T17:52:04.237Z Vendors: Jenkins Project Products: Jenkins Folders Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3105 - http://www.openwall.com/lists/oss-security/2023/08/16/3
CVE ID: CVE-2023-40338 State: PUBLISHED Published: 2023-08-16T14:32:50.674Z Last Updated: 2024-08-02T18:31:53.633Z Vendors: Jenkins Project Products: Jenkins Folders Plugin Description: Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when attempting to access the Scan Organization Folder Log if no logs are available, exposing information about the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3109 - http://www.openwall.com/lists/oss-security/2023/08/16/3
CVE ID: CVE-2023-40339 State: PUBLISHED Published: 2023-08-16T14:32:51.314Z Last Updated: 2024-10-08T17:49:36.202Z Vendors: Jenkins Project Products: Jenkins Config File Provider Plugin Description: Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they're written to the build log. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3090 - http://www.openwall.com/lists/oss-security/2023/08/16/3
CVE ID: CVE-2023-40340 State: PUBLISHED Published: 2023-08-16T14:32:51.990Z Last Updated: 2024-10-08T17:41:11.724Z Vendors: Jenkins Project Products: Jenkins NodeJS Plugin Description: Jenkins NodeJS Plugin 1.6.0 and earlier does not properly mask (i.e., replace with asterisks) credentials specified in the Npm config file in Pipeline build logs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3196 - http://www.openwall.com/lists/oss-security/2023/08/16/3
CVE ID: CVE-2023-40341 State: PUBLISHED Published: 2023-08-16T14:32:52.615Z Last Updated: 2024-10-08T18:32:10.012Z Vendors: Jenkins Project Products: Jenkins Blue Ocean Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.27.5 and earlier allows attackers to connect to an attacker-specified URL, capturing GitHub credentials associated with an attacker-specified job. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3116 - http://www.openwall.com/lists/oss-security/2023/08/16/3
CVE ID: CVE-2023-40342 State: PUBLISHED Published: 2023-08-16T14:32:53.258Z Last Updated: 2024-10-08T18:31:29.153Z Vendors: Jenkins Project Products: Jenkins Flaky Test Handler Plugin Description: Jenkins Flaky Test Handler Plugin 1.2.2 and earlier does not escape JUnit test contents when showing them on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control JUnit report file contents. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3223 - http://www.openwall.com/lists/oss-security/2023/08/16/3
CVE ID: CVE-2023-40343 State: PUBLISHED Published: 2023-08-16T14:32:53.909Z Last Updated: 2024-10-08T18:30:49.930Z Vendors: Jenkins Project Products: Jenkins Tuleap Authentication Plugin Description: Jenkins Tuleap Authentication Plugin 1.1.20 and earlier uses a non-constant time comparison function when validating an authentication token allowing attackers to use statistical methods to obtain a valid authentication token. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3229 - http://www.openwall.com/lists/oss-security/2023/08/16/3
CVE ID: CVE-2023-40344 State: PUBLISHED Published: 2023-08-16T14:32:54.541Z Last Updated: 2024-10-08T18:29:42.817Z Vendors: Jenkins Project Products: Jenkins Delphix Plugin Description: A missing permission check in Jenkins Delphix Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3214%20(1) - http://www.openwall.com/lists/oss-security/2023/08/16/3 - https://support.delphix.com/Support_Policies_and_Technical_Bulletins/Technical_Bulletins/TB111_Delphix_Plugin_f
8/16/3 - https://support.delphix.com/Support_Policies_and_Technical_Bulletins/Technical_Bulletins/TB111_Delphix_Plugin_for_Jenkins_Vulnerable_to_Credential_Enumeration_and_Capture
CVE ID: CVE-2023-40345 State: PUBLISHED Published: 2023-08-16T14:32:55.174Z Last Updated: 2024-10-08T18:28:25.965Z Vendors: Jenkins Project Products: Jenkins Delphix Plugin Description: Jenkins Delphix Plugin 3.0.2 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Overall/Read permission to access and capture credentials they are not entitled to. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3214%20(2) - http://www.openwall.com/lists/oss-security/2023/08/16/3 - https://support.delphix.com/Support_Policies_and_Technical_Bulletins/Technical_Bu
.com/lists/oss-security/2023/08/16/3 - https://support.delphix.com/Support_Policies_and_Technical_Bulletins/Technical_Bulletins/TB111_Delphix_Plugin_for_Jenkins_Vulnerable_to_Credential_Enumeration_and_Capture
CVE ID: CVE-2023-40346 State: PUBLISHED Published: 2023-08-16T14:32:55.806Z Last Updated: 2024-10-08T18:26:40.504Z Vendors: Jenkins Project Products: Jenkins Shortcut Job Plugin Description: Jenkins Shortcut Job Plugin 0.4 and earlier does not escape the shortcut redirection URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure shortcut jobs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3071 - http://www.openwall.com/lists/oss-security/2023/08/16/3
CVE ID: CVE-2023-40347 State: PUBLISHED Published: 2023-08-16T14:32:56.439Z Last Updated: 2024-10-08T18:25:42.222Z Vendors: Jenkins Project Products: Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin Description: Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.14 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3153 - http://www.openwall.com/lists/oss-security/2023/08/16/3
CVE ID: CVE-2023-40348 State: PUBLISHED Published: 2023-08-16T14:32:57.072Z Last Updated: 2024-10-08T18:24:13.826Z Vendors: Jenkins Project Products: Jenkins Gogs Plugin Description: The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs in its output. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-2894 - http://www.openwall.com/lists/oss-security/2023/08/16/3
CVE ID: CVE-2023-40349 State: PUBLISHED Published: 2023-08-16T14:32:57.708Z Last Updated: 2024-10-08T18:22:33.595Z Vendors: Jenkins Project Products: Jenkins Gogs Plugin Description: Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-2894 - http://www.openwall.com/lists/oss-security/2023/08/16/3
CVE ID: CVE-2023-40350 State: PUBLISHED Published: 2023-08-16T14:32:58.359Z Last Updated: 2024-10-08T18:19:03.691Z Vendors: Jenkins Project Products: Jenkins Docker Swarm Plugin Description: Jenkins Docker Swarm Plugin 1.11 and earlier does not escape values returned from Docker before inserting them into the Docker Swarm Dashboard view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control responses from Docker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-2811 - http://www.openwall.com/lists/oss-security/2023/08/16/3
CVE ID: CVE-2023-40351 State: PUBLISHED Published: 2023-08-16T14:32:59.006Z Last Updated: 2024-10-08T19:04:29.960Z Vendors: Jenkins Project Products: Jenkins Favorite View Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Favorite View Plugin 5.v77a_37f62782d and earlier allows attackers to add or remove views from another user's favorite views tab bar. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3201 - http://www.openwall.com/lists/oss-security/2023/08/16/3
CVE ID: CVE-2023-40352 State: PUBLISHED Published: 2023-08-21T00:00:00 Last Updated: 2024-10-04T18:02:07.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: McAfee Safe Connect before 2.16.1.126 may allow an adversary with system privileges to achieve privilege escalation by loading arbitrary DLLs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mcafee.com/en-us/consumer-corporate/mcafee-labs/product-security-bulletins.html - https://www.mcafee.com/support/?articleId=TS103462&page=shell&shell=article-view
CVE ID: CVE-2023-40353 State: PUBLISHED Published: 2023-09-08T00:00:00 Last Updated: 2024-09-26T17:52:15.819Z Severity: LOW (CVSS 2 CVSS:3.1/AC:L/AV:L/A:L/C:N/I:N/PR:H/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Exynos Mobile Processor 980 and 2100. An integer overflow at a buffer index can prevent the execution of requested services via a crafted application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE ID: CVE-2023-40354 State: PUBLISHED Published: 2023-08-14T00:00:00 Last Updated: 2024-10-09T14:52:33.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MariaDB MaxScale before 23.02.3. A user enters an encrypted password on a "maxctrl create service" command line, but this password is then stored in cleartext in the resulting .cnf file under /var/lib/maxscale/maxscale.cnf.d. The fixed versions are 2.5.28, 6.4.9, 22.08.8, and 23.02.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.mariadb.org/browse/MXS-4681