Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
nfiguration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/arduino/arduino-create-agent/security/advisories/GHSA-m5jc-r4gf-c6p8 - https://github.com/arduino/arduino-create-agent/releases/tag/1.3.3 - https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide - https://lists.debian.org/debian-lts-announce/2023/11/msg00005.html
CVE ID: CVE-2023-43804 State: PUBLISHED Published: 2023-10-04T16:01:50.447Z Last Updated: 2025-11-03T21:49:44.074Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: urllib3 Products: urllib3 Problem Types: CWE-200 Description: urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 vers
cts to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f - https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb - https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d - https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I3PR7C6RJ6JUBQKIJ644DMIJSUP36VDY/ - https://lists.fedoraproject.org/archives/list/
ounce@lists.fedoraproject.org/message/I3PR7C6RJ6JUBQKIJ644DMIJSUP36VDY/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAGZXYJ7H2G3SB47M453VQVNAWKAEJJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5/
CVE ID: CVE-2023-43805 State: PUBLISHED Published: 2023-10-04T20:24:43.110Z Last Updated: 2024-09-20T14:55:56.424Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: nexryai Products: nexkey Problem Types: CWE-287 Description: Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possible to avoid this by blocking access using tools such as Cloudflare's WAF. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment
access using tools such as Cloudflare's WAF. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nexryai/nexkey/security/advisories/GHSA-g8w5-568f-ffwf - https://github.com/misskey-dev/misskey/security/advisories/GHSA-9fj2-gjcf-cqqc - https://github.com/nexryai/nexkey/commit/d89575c521fd4492f5e2ba5a221c5e8f1382081d
CVE ID: CVE-2023-43809 State: PUBLISHED Published: 2023-10-04T20:40:41.822Z Last Updated: 2024-09-20T14:51:49.413Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: charmbracelet Products: soft-serve Problem Types: CWE-287 Description: Soft Serve is a self-hostable Git server for the command line. Prior to version 0.6.2, a security vulnerability in Soft Serve could allow an unauthenticated, remote attacker to bypass public key authentication when keyboard-interactive SSH authentication is active, through the `allow-keyless` setting, and the public key requires additional client-side verification for example using FIDO2 or GPG. This is due to insufficient validat
lic key requires additional client-side verification for example using FIDO2 or GPG. This is due to insufficient validation procedures of the public key step during SSH request handshake, granting unauthorized access if the keyboard-interaction mode is utilized. An attacker could exploit this vulnerability by presenting manipulated SSH requests using keyboard-interactive authentication mode. This could potentially result in unauthorized access to the Soft Serve. Users should upgrade to the latest Soft Serve version `v0.6.2` to receive the patch for this issue. To workaround this vulnerability without upgrading, users can temporarily disable Keyboard-Interactive SSH Authentication using the `
this vulnerability without upgrading, users can temporarily disable Keyboard-Interactive SSH Authentication using the `allow-keyless` setting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-mc97-99j4-vm2v - https://github.com/charmbracelet/soft-serve/issues/389 - https://github.com/charmbracelet/soft-serve/commit/407c4ec72d1006cee1ff8c1775e5bcc091c2bc89 - https://github.com/charmbracelet/soft-serve/releases/tag/v0.6.2
CVE ID: CVE-2023-43810 State: PUBLISHED Published: 2023-10-06T13:53:17.622Z Last Updated: 2024-09-19T18:45:01.962Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: open-telemetry Products: opentelemetry-python-contrib Problem Types: CWE-400 Description: OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, logs. Autoinstrumentation out of the box adds the label `http_method` that has unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. HTTP method for requests
y. It leads to the server's potential memory exhaustion when many malicious requests are sent. HTTP method for requests can be easily set by an attacker to be random and long. In order to be affected program has to be instrumented for HTTP handlers and does not filter any unknown HTTP methods on the level of CDN, LB, previous middleware, etc. This issue has been patched in version 0.41b0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/open-telemetry/opentelemetry-python-contrib/security/advisories/GHSA-5rv5-6h4r-h22v - https://github.com/open-telemetry/opentelemetry-python-contrib/commit/6007e0c013071e7f8b9612d3bc68aeb9d600d74e -
h22v - https://github.com/open-telemetry/opentelemetry-python-contrib/commit/6007e0c013071e7f8b9612d3bc68aeb9d600d74e - https://github.com/open-telemetry/opentelemetry-python-contrib/releases/tag/v0.41b0
CVE ID: CVE-2023-43813 State: PUBLISHED Published: 2023-12-13T18:17:21.359Z Last Updated: 2024-08-02T19:52:11.294Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-89 Description: GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, the saved search feature can be used to perform a SQL injection. Version 10.0.11 contains a patch for the issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-94c3-fw5r-3362 - https://github.com/glpi-project/glpi/commit/4bd7f02d940953b9cbc9d285f
ect/glpi/security/advisories/GHSA-94c3-fw5r-3362 - https://github.com/glpi-project/glpi/commit/4bd7f02d940953b9cbc9d285f7544bb0e490e75e - https://github.com/glpi-project/glpi/releases/tag/10.0.11
CVE ID: CVE-2023-43814 State: PUBLISHED Published: 2023-10-16T21:09:16.620Z Last Updated: 2024-09-13T18:59:34.638Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-200, CWE-284 Description: Discourse is an open source platform for community discussion. Attackers with details specific to a poll in a topic can use the `/polls/grouped_poll_results` endpoint to view the content of options in the poll and the number of votes for groups of poll participants. This impacts private polls where the results were intended to only be viewable by authorized users. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versio
were intended to only be viewable by authorized users. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. There is no workaround for this issue apart from upgrading to the fixed version. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-3x57-846g-7qcw
CVE ID: CVE-2023-43815 State: PUBLISHED Published: 2024-01-18T21:15:04.830Z Last Updated: 2025-06-02T15:03:27.434Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Delta Electronics Products: DOPSoft Problem Types: CWE-119 Description: A buffer overflow vulnerability exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wScreenDESCTextLen field of a DPS file. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/18/delt
lyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wscreendesctextlen-buffer-overflow-remote-code-execution/
CVE ID: CVE-2023-43816 State: PUBLISHED Published: 2024-01-18T21:15:21.742Z Last Updated: 2024-11-13T19:16:27.274Z Severity: N/A (CVSS 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P) Vendors: Delta Electronics Products: DOPSoft Problem Types: CWE-119 Description: A buffer overflow vulnerability exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wKPFStringLen field of a DPS file. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-indu
m Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wkpfstringlen-buffer-overflow-remote-code-execution/
CVE ID: CVE-2023-43817 State: PUBLISHED Published: 2024-01-18T21:15:32.931Z Last Updated: 2025-06-17T21:19:20.267Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DOPSoft Problem Types: CWE-119 Description: A buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wMailContentLen field of a DPS file. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/18/delta-electronics-del
Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wmailcontentlen-buffer-overflow-remote-code-execution/
CVE ID: CVE-2023-43818 State: PUBLISHED Published: 2024-01-18T21:15:44.367Z Last Updated: 2025-06-17T21:19:20.389Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DOPSoft Problem Types: CWE-119 Description: A buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-w
: References: - https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wtextlen-buffer-overflow-remote-code-execution/
CVE ID: CVE-2023-43819 State: PUBLISHED Published: 2024-01-18T21:15:53.528Z Last Updated: 2025-06-17T21:19:20.514Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DOPSoft Problem Types: CWE-119 Description: A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the InitialMacroLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/18
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-initialmacrolen-buffer-overflow-remote-code-execution/
CVE ID: CVE-2023-43820 State: PUBLISHED Published: 2024-01-18T21:16:04.515Z Last Updated: 2024-08-29T19:59:03.682Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DOPSoft Problem Types: CWE-119 Description: A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesPrevValueLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/202
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wlogtitlesprevvaluelen-buffer-overflow-remote-code-execution/
CVE ID: CVE-2023-43821 State: PUBLISHED Published: 2024-01-18T21:16:15.341Z Last Updated: 2024-10-21T11:40:44.007Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DOPSoft Problem Types: CWE-119 Description: A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesActionLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/0
ional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wlogtitlesactionlen-buffer-overflow-remote-code-execution/
CVE ID: CVE-2023-43822 State: PUBLISHED Published: 2024-01-18T21:16:25.943Z Last Updated: 2025-06-16T19:44:40.200Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DOPSoft Problem Types: CWE-119 Description: A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesTimeLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wlogtitlestimelen-buffer-overflow-remote-code-execution/
CVE ID: CVE-2023-43823 State: PUBLISHED Published: 2024-01-18T21:16:36.971Z Last Updated: 2025-06-02T15:03:21.184Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DOPSoft Problem Types: CWE-119 Description: A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTTitleLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/18/delt
lyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wttitlelen-buffer-overflow-remote-code-execution/
CVE ID: CVE-2023-43824 State: PUBLISHED Published: 2024-01-18T21:16:48.103Z Last Updated: 2024-09-12T18:41:05.560Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DOPSoft Problem Types: CWE-119 Description: A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTitleTextLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/18/d
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/18/delta-electronics-delta-industrial-automation-dopsoft-dps-file-wtitletextlen-buffer-overflow-remote-code-execution/
CVE ID: CVE-2023-43825 State: PUBLISHED Published: 2023-09-27T07:14:02.216Z Last Updated: 2024-09-24T14:09:53.212Z Vendors: EKAKIN Products: Shihonkanri Plus Problem Types: Relative path traversal Description: Relative path traversal vulnerability in Shihonkanri Plus Ver9.0.3 and earlier allows a local attacker to execute an arbitrary code by having a legitimate user import a specially crafted backup file of the product.. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://ekakin.la.coocan.jp/index.htm - https://jvn.jp/en/jp/JVN17434995/
CVE ID: CVE-2023-43826 State: PUBLISHED Published: 2023-12-19T19:50:15.188Z Last Updated: 2025-08-21T03:55:15.133Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Apache Software Foundation Products: Apache Guacamole Problem Types: CWE-190 Description: Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process. Users are recommended to upgrade to version 1.5.4, which fixes
xecuted with the privileges of the running guacd process. Users are recommended to upgrade to version 1.5.4, which fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/23gzwftpfgtq97tj6ttmbclry53kmwv6 - http://www.openwall.com/lists/oss-security/2023/12/19/4
CVE ID: CVE-2023-43828 State: PUBLISHED Published: 2023-09-27T00:00:00 Last Updated: 2024-09-24T14:20:21.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Title' parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/al3zx/xss_languages_subrion_4.2.1
CVE ID: CVE-2023-43830 State: PUBLISHED Published: 2023-09-27T00:00:00 Last Updated: 2024-09-24T14:19:56.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into several fields: 'Minimum deposit', 'Maximum deposit' and/or 'Maximum balance'. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/al3zx/xss_financial_subrion_4.2.1
CVE ID: CVE-2023-43835 State: PUBLISHED Published: 2023-10-02T00:00:00 Last Updated: 2024-09-23T16:37:28.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: Super Store Finder 3.7 and below is vulnerable to authenticated Arbitrary PHP Code Injection that could lead to Remote Code Execution when settings overwrite config.inc.php content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://packetstormsecurity.com/files/174756/Super-Store-Finder-3.7-Remote-Command-Execution.html
CVE ID: CVE-2023-43836 State: PUBLISHED Published: 2023-10-02T00:00:00 Last Updated: 2024-09-23T16:17:25.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a SQL injection vulnerability in the Jizhicms 2.4.9 backend, which users can use to obtain database information Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Fliggyaaa/jizhicmssql/ - https://gist.github.com/Fliggyaaa/417f8335ce0f0546e95dda91d4b54604
CVE ID: CVE-2023-43838 State: PUBLISHED Published: 2023-10-04T00:00:00 Last Updated: 2024-09-20T14:58:30.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in Personal Management System v1.4.64 allows attackers to execute arbitrary code via uploading a crafted SVG file into a user profile's avatar. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.w3.org/2000/svg - https://github.com/Volmarg - https://github.com/Volmarg/personal-management-system - https://github.com/Volmarg/personal-management-system/blob/39d3c0df641a5435f2028b37a27d26ba61a3b97b/src/assets/scripts/core/ui/DataProcessor/Spe
rg/personal-management-system/blob/39d3c0df641a5435f2028b37a27d26ba61a3b97b/src/assets/scripts/core/ui/DataProcessor/SpecialAction.ts#L35 - https://github.com/rootd4ddy/ - https://github.com/rootd4ddy/CVE-2023-43838
CVE ID: CVE-2023-43842 State: PUBLISHED Published: 2024-05-28T18:16:21.209Z Last Updated: 2025-02-13T15:46:49.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the account management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to alter user and administrator accounts credentials via HTTP POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/setersora/pe6208
CVE ID: CVE-2023-43843 State: PUBLISHED Published: 2024-05-28T18:16:56.230Z Last Updated: 2025-02-13T15:46:50.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the account management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to read user and administrator accounts passwords via HTTP GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/setersora/pe6208