Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-29431 State: PUBLISHED Published: 2024-12-09T11:31:08.651Z Last Updated: 2024-12-09T18:45:41.055Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: OntheGoSystems Products: qTranslate X Cleanup and WPML Import Problem Types: CWE-862 Description: Missing Authorization vulnerability in OntheGoSystems qTranslate X Cleanup and WPML Import allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects qTranslate X Cleanup and WPML Import: from n/a through 3.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/qtranslate-to-wpml-export/vulnerability/wordpre
richment: References: - https://patchstack.com/database/wordpress/plugin/qtranslate-to-wpml-export/vulnerability/wordpress-qtranslate-x-cleanup-and-wpml-import-plugin-3-0-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-29432 State: PUBLISHED Published: 2023-12-20T17:12:57.374Z Last Updated: 2024-09-16T18:24:12.670Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: Favethemes Products: Houzez - Real Estate WordPress Theme Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme.This issue affects Houzez - Real Estate WordPress Theme: from n/a before 2.8.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/houzez/wordpress-houzez-theme-2-8-3-unauth-sql
Vulnrichment: References: - https://patchstack.com/database/vulnerability/houzez/wordpress-houzez-theme-2-8-3-unauth-sql-injection-sqli-vulnerability?_s_id=cve
CVE ID: CVE-2023-29433 State: PUBLISHED Published: 2024-12-09T11:31:07.824Z Last Updated: 2024-12-09T18:45:48.320Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: 腾讯云 Products: tencentcloud-cos Problem Types: CWE-862 Description: Missing Authorization vulnerability in 腾讯云 tencentcloud-cos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects tencentcloud-cos: from n/a through 1.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/tencentcloud-cos/vulnerability/wordpress-tencentcloud-cos-plugin-1-0-7-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-29434 State: PUBLISHED Published: 2023-06-26T10:08:54.601Z Last Updated: 2024-08-02T14:07:46.211Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: FancyThemes Products: Optin Forms – Simple List Building Plugin for WordPress Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in FancyThemes Optin Forms – Simple List Building Plugin for WordPress plugin <= 1.3.1 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/optin-forms/wordpress-optin-forms-plugin-1-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-29435 State: PUBLISHED Published: 2023-06-26T11:09:39.269Z Last Updated: 2024-10-10T17:10:11.040Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Zwaply Products: Cryptocurrency All-in-One Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Zwaply Cryptocurrency All-in-One plugin <= 3.0.19 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/cryptocurrency-prices/wordpress-cryptocurrency-all-in-one-plugin-3-0-19-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-29436 State: PUBLISHED Published: 2023-06-26T10:46:07.399Z Last Updated: 2024-10-10T17:10:29.218Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Flyn San Products: IFrame Shortcode Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Flyn San IFrame Shortcode plugin <= 1.0.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/flynsarmy-iframe-shortcode/wordpress-iframe-shortcode-plugin-1-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-29437 State: PUBLISHED Published: 2023-06-26T12:00:29.999Z Last Updated: 2024-10-10T17:09:54.957Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Steven A. Zahm Products: Connections Business Directory Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Steven A. Zahm Connections Business Directory plugin <= 10.4.36 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/connections/wordpress-connections-business-directory-plugin-10-4-36-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-29438 State: PUBLISHED Published: 2023-06-26T12:04:21.491Z Last Updated: 2024-10-10T17:09:38.758Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Eric Martin Products: SimpleModal Contact Form (SMCF) Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eric Martin SimpleModal Contact Form (SMCF) plugin <= 1.2.9 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/simplemodal-contact-form-smcf/wordpress-simplemodal-contact-form-smcf-plugin-1-2-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-29439 State: PUBLISHED Published: 2023-05-16T14:11:22.935Z Last Updated: 2025-01-09T15:14:35.861Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: FooPlugins Products: FooGallery Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FooPlugins FooGallery plugin <= 2.2.35 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/foogallery/wordpress-foogallery-plugin-2-2-35-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve - https://lourcode.kr/posts/CVE-2023-29439-Analysis?_s_id=cve
CVE ID: CVE-2023-29440 State: PUBLISHED Published: 2023-11-10T13:46:49.806Z Last Updated: 2024-09-03T17:52:54.476Z Vendors: PressTigers Products: Simple Job Board Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board plugin <= 2.10.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/simple-job-board/wordpress-simple-job-board-plugin-2-10-3-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2023-29441 State: PUBLISHED Published: 2023-09-06T07:58:12.441Z Last Updated: 2024-08-02T14:48:53.958Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Robert Heller Products: WebLibrarian Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Robert Heller WebLibrarian plugin <= 3.5.8.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/weblibrarian/wordpress-weblibrarian-plugin-3-5-8-1-multiple-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-29442 State: PUBLISHED Published: 2023-04-26T00:00:00.000Z Last Updated: 2025-02-03T17:38:59.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Applications Manager before 16400 allows proxy.html DOM XSS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2023-29442.html
CVE ID: CVE-2023-29443 State: PUBLISHED Published: 2023-04-26T00:00:00.000Z Last Updated: 2025-02-03T19:08:40.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/service-desk/CVE-2023-29443.html
CVE ID: CVE-2023-29444 State: PUBLISHED Published: 2024-01-10T17:06:35.965Z Last Updated: 2025-05-14T20:14:19.414Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: PTC Products: Kepware KEPServerEX, ThingWorx Kepware Server, ThingWorx Industrial Connectivity Problem Types: CWE-427 Description: An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software and trick victims into downloading and installing their malicious version to gain initial access and code execution. Additional Analy
tims into downloading and installing their malicious version to gain initial access and code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03 - https://www.ptc.com/en/support/article/cs399528
CVE ID: CVE-2023-29445 State: PUBLISHED Published: 2024-01-10T20:17:12.837Z Last Updated: 2025-06-17T20:59:11.408Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: PTC Products: Kepware KEPServerEX, ThingWorx Kepware Server, ThingWorx Industrial Connectivity Problem Types: CWE-427 Description: An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03 - https://www.ptc.com/en/support/article/cs399528
ces: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03 - https://www.ptc.com/en/support/article/cs399528 - https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/
CVE ID: CVE-2023-29446 State: PUBLISHED Published: 2024-01-10T20:21:51.434Z Last Updated: 2024-11-14T17:23:37.514Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: PTC Products: Kepware KEPServerEX, ThingWorx Kepware Server, ThingWorx Industrial Connectivity Problem Types: CWE-40 Description: An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. This allows an adversary to capture NLTMv2 hashes and potentially crack them offline. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03 - https://www.ptc.com/en/support/article/cs399528 - https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/
CVE ID: CVE-2023-29447 State: PUBLISHED Published: 2024-01-10T20:24:52.983Z Last Updated: 2025-06-17T20:59:11.540Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: PTC Products: Kepware KEPServerEX, ThingWorx Kepware Server, ThingWorx Industrial Connectivity Problem Types: CWE-522 Description: An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03 - https://www.ptc.com/en/support/article/cs399528 -
s: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03 - https://www.ptc.com/en/support/article/cs399528 - https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/
CVE ID: CVE-2023-29449 State: PUBLISHED Published: 2023-07-13T08:24:00.766Z Last Updated: 2025-11-03T21:47:46.390Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Zabbix Products: Zabbix Problem Types: CWE-400 Description: JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level
form tasks that require more control over the system. The security risk is limited because not all users have this level of access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-22589
CVE ID: CVE-2023-29450 State: PUBLISHED Published: 2023-07-13T08:25:27.911Z Last Updated: 2025-11-03T21:47:47.831Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Zabbix Products: Zabbix Problem Types: CWE-200, CWE-552 Description: JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-22588 - https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
CVE ID: CVE-2023-29451 State: PUBLISHED Published: 2023-07-13T09:29:42.494Z Last Updated: 2025-02-13T16:49:18.150Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Zabbix Products: Zabbix Problem Types: CWE-20 Description: Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-22587 - https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
CVE ID: CVE-2023-29452 State: PUBLISHED Published: 2023-07-13T09:29:55.833Z Last Updated: 2024-10-22T16:23:20.957Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Zabbix Products: Zabbix Problem Types: CWE-20 Description: Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-22981
CVE ID: CVE-2023-29453 State: PUBLISHED Published: 2023-10-12T05:50:19.866Z Last Updated: 2024-09-18T15:21:57.439Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Zabbix Products: Zabbix Problem Types: CWE-94 Description: Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to terminate the literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather complex, and themselves ca
injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather complex, and themselves can do string interpolation, the decision was made to simply disallow Go template actions from being used inside of them (e.g., "var a = {{.}}"), since there is no obviously safe way to allow this behavior. This takes the same approach as github.com/google/safehtml. With fix, Template. Parse returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is currently unexported but will be exported in the release of Go 1.21. Users who rely on the previous behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat
1.21. Users who rely on the previous behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will now be escaped. This should be used with caution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-23388
CVE ID: CVE-2023-29454 State: PUBLISHED Published: 2023-07-13T09:30:27.523Z Last Updated: 2025-11-03T21:47:49.270Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: Zabbix Products: Zabbix Problem Types: CWE-20 Description: Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the payload for every victim visiting its web pages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/
s. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-22985 - https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
CVE ID: CVE-2023-29455 State: PUBLISHED Published: 2023-07-13T09:33:18.965Z Last Updated: 2025-11-03T21:47:50.746Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Zabbix Products: Zabbix Problem Types: CWE-20 Description: Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious scripts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-22986 - https://lists.de
Program Container: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-22986 - https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
CVE ID: CVE-2023-29456 State: PUBLISHED Published: 2023-07-13T09:33:32.720Z Last Updated: 2025-11-03T21:47:52.224Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L) Vendors: Zabbix Products: Zabbix Problem Types: CWE-20 Description: URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-22987 - https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
CVE ID: CVE-2023-29457 State: PUBLISHED Published: 2023-07-13T09:35:24.594Z Last Updated: 2025-11-03T21:47:53.671Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Zabbix Products: Zabbix Problem Types: CWE-20 Description: Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action form fields, which can be sent as request to a website with a vulnerability that enables execution of malicious scripts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-22988 - https://lists.debian.org/debian
er: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-22988 - https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
CVE ID: CVE-2023-29458 State: PUBLISHED Published: 2023-07-13T09:33:46.403Z Last Updated: 2025-11-03T21:47:55.154Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Zabbix Products: Zabbix Problem Types: CWE-129 Description: Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-22989
CVE ID: CVE-2023-29459 State: PUBLISHED Published: 2023-06-26T00:00:00 Last Updated: 2024-12-03T19:05:17.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: The laola.redbull application through 5.1.9-R for Android exposes the exported activity at.redbullsalzburg.android.AppMode.Default.Splash.SplashActivity, which accepts a data: URI. The target of this URI is subsequently loaded into the application's webview, thus allowing the loading of arbitrary content into the context of the application. This can occur via the fcrbs schema or an explicit intent invocation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://play.google.com/stor
. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://play.google.com/store/apps/details?id=laola.redbull - http://packetstormsecurity.com/files/172701/FC-Red-Bull-Salzburg-App-5.1.9-R-Improper-Authorization.html
CVE ID: CVE-2023-29460 State: PUBLISHED Published: 2023-05-09T13:19:43.980Z Last Updated: 2025-01-28T17:28:40.238Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Rockwell Automation Products: Arena Simulation Problem Types: CWE-125 Description: An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow potentially resulting in a complete loss of confidentiality, integrity, and availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
tiality, integrity, and availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139391
CVE ID: CVE-2023-29461 State: PUBLISHED Published: 2023-05-09T13:26:24.146Z Last Updated: 2025-01-28T17:25:39.339Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Rockwell Automation Products: Arena Simulation Problem Types: CWE-125 Description: An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow in the heap. potentially resulting in a complete loss of confidentiality, integrity, and availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnric
s of confidentiality, integrity, and availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139391
CVE ID: CVE-2023-29462 State: PUBLISHED Published: 2023-05-09T13:27:57.411Z Last Updated: 2025-01-28T17:21:18.530Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Rockwell Automation Products: Arena Simulation Problem Types: CWE-787 Description: An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow in the heap. potentially resulting in a complete loss of confidentiality, integrity, and availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnric