Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-47580 State: PUBLISHED Published: 2023-11-15T05:40:43.526Z Last Updated: 2024-08-14T18:39:13.041Z Vendors: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. Products: TELLUS, TELLUS Lite Problem Types: Improper restriction of operations within the bounds of a memory buffer Description: Multiple improper restriction of operations within the bounds of a memory buffer issues exist in TELLUS V4.0.17.0 and earlier and TELLUS Lite V4.0.17.0 and earlier. If a user opens a specially crafted file (X1, V8, or V9 file), information may be disclosed and/or arbitrary code may be executed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
ary code may be executed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php - https://hakko-elec.co.jp/site/download/03tellus_inf/index.php - https://jvn.jp/en/vu/JVNVU93840158/
CVE ID: CVE-2023-47581 State: PUBLISHED Published: 2023-11-15T05:40:54.802Z Last Updated: 2024-11-29T16:41:28.612Z Vendors: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. Products: TELLUS, TELLUS Lite Problem Types: Out-of-bounds read Description: Out-of-bounds read vulnerability exists in TELLUS V4.0.17.0 and earlier and TELLUS Lite V4.0.17.0 and earlier. If a user opens a specially crafted file (X1, V8, or V9 file), information may be disclosed and/or arbitrary code may be executed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php - https://hakko-elec.co.jp/site/downl
ences: - https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php - https://hakko-elec.co.jp/site/download/03tellus_inf/index.php - https://jvn.jp/en/vu/JVNVU93840158/
CVE ID: CVE-2023-47582 State: PUBLISHED Published: 2023-11-15T05:41:09.146Z Last Updated: 2024-08-29T15:17:08.167Z Vendors: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. Products: TELLUS, TELLUS Lite Problem Types: Access of uninitialized pointer Description: Access of uninitialized pointer vulnerability exists in TELLUS V4.0.17.0 and earlier and TELLUS Lite V4.0.17.0 and earlier. If a user opens a specially crafted file (X1, V8, or V9 file), information may be disclosed and/or arbitrary code may be executed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php - https://h
SA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php - https://hakko-elec.co.jp/site/download/03tellus_inf/index.php - https://jvn.jp/en/vu/JVNVU93840158/
CVE ID: CVE-2023-47583 State: PUBLISHED Published: 2023-11-15T05:41:35.113Z Last Updated: 2025-01-07T18:52:18.981Z Vendors: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. Products: TELLUS Simulator Problem Types: Out-of-bounds read Description: Multiple out-of-bounds read vulnerabilities exist in TELLUS Simulator V4.0.17.0 and earlier. If a user opens a specially crafted file (X1 or V9 file), information may be disclosed and/or arbitrary code may be executed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php - https://hakko-elec.co.jp/site/download/03tellus_inf/index.php
.fujielectric.com/site/download-e/03tellus_inf/index.php - https://hakko-elec.co.jp/site/download/03tellus_inf/index.php - https://jvn.jp/en/vu/JVNVU93840158/
CVE ID: CVE-2023-47584 State: PUBLISHED Published: 2023-11-15T06:03:19.425Z Last Updated: 2024-08-29T15:15:45.277Z Vendors: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. Products: V-Server, V-Server Lite Problem Types: Out-of-bounds write Description: Out-of-bounds write vulnerability exists in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier. If a user opens a specially crafted VPR file, information may be disclosed and/or arbitrary code may be executed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php - https://hakko-elec.co.jp/site/download/03t
- https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php - https://hakko-elec.co.jp/site/download/03tellus_inf/index.php - https://jvn.jp/en/vu/JVNVU93840158/
CVE ID: CVE-2023-47585 State: PUBLISHED Published: 2023-11-15T06:03:31.138Z Last Updated: 2024-08-29T15:13:49.252Z Vendors: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. Products: V-Server, V-Server Lite Problem Types: Out-of-bounds read Description: Out-of-bounds read vulnerability exists in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier. If a user opens a specially crafted VPR file, information may be disclosed and/or arbitrary code may be executed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php - https://hakko-elec.co.jp/site/download/03tel
https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php - https://hakko-elec.co.jp/site/download/03tellus_inf/index.php - https://jvn.jp/en/vu/JVNVU93840158/
CVE ID: CVE-2023-47586 State: PUBLISHED Published: 2023-11-15T06:03:46.888Z Last Updated: 2024-08-29T17:50:00.621Z Vendors: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. Products: V-Server, V-Server Lite Problem Types: Heap-based buffer overflow Description: Multiple heap-based buffer overflow vulnerabilities exist in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier. If a user opens a specially crafted VPR file, information may be disclosed and/or arbitrary code may be executed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php - https://hakko-elec
lnrichment: References: - https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php - https://hakko-elec.co.jp/site/download/03tellus_inf/index.php - https://jvn.jp/en/vu/JVNVU93840158/
CVE ID: CVE-2023-47609 State: PUBLISHED Published: 2023-11-14T05:12:19.484Z Last Updated: 2025-01-08T16:44:16.361Z Vendors: Thinkingreed Inc. Products: OSS Calendar Problem Types: SQL Injection Description: SQL injection vulnerability in OSS Calendar versions prior to v.2.0.3 allows a remote authenticated attacker to execute arbitrary code or obtain and/or alter the information stored in the database by sending a specially crafted request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://oss-calendar.com/news/20231113/ - https://jvn.jp/en/jp/JVN67822421/
CVE ID: CVE-2023-47610 State: PUBLISHED Published: 2023-11-09T17:05:38.207Z Last Updated: 2025-02-27T20:34:06.677Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Telit Cinterion Products: EHS5, EHS6, EHS8 Problem Types: CWE-120 Description: A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists in Telit Cinterion EHS5/6/8 that could allow a remote unauthenticated attacker to execute arbitrary code on the targeted system by sending a specially crafted SMS message. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ics-cert.kaspersky.com/advisories/2023/11/08/klcert-23-018-telit-cinterion-thales
DP Vulnrichment: References: - https://ics-cert.kaspersky.com/advisories/2023/11/08/klcert-23-018-telit-cinterion-thales-gemalto-modules-buffer-copy-without-checking-size-of-input-vulnerability/
CVE ID: CVE-2023-47611 State: PUBLISHED Published: 2023-11-10T16:38:54.668Z Last Updated: 2024-08-02T21:09:37.384Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Telit Cinterion Products: BGS5, EHS5-E, EHS5-US, EHS5-US Rel.4, EHS6, EHS6 Rel.2, EHS6 Rel.3, EHS6 Rel.4, EHS6-A Rel.4, EHS8, EHS8 Rel.4, ELS61-AUS, ELS61-AUS Rel.1, ELS61-AUS Rel.1 MR, ELS61-E, ELS61-E Rel.1, ELS61-E Rel.1 MR, ELS61-E Rel.2, ELS61-E2 Rel.1, ELS61-E2 Rel.1 MR, ELS61-US Rel.1 MR, ELS61-US Rel.2, ELS81-E, ELS81-E Rel.1, ELS81-E Rel.1.1, ELS81-US, ELS81-US Rel.1.1, PDS5-E, PDS5-E Rel.1, PDS5-E Rel.4, PDS5-US, PDS6, PDS8, PLS62-W, PLS62-W Rel.1 Problem Types: CWE-269 Description: A CWE-2
5-E, PDS5-E Rel.1, PDS5-E Rel.4, PDS5-US, PDS6, PDS8, PLS62-W, PLS62-W Rel.1 Problem Types: CWE-269 Description: A CWE-269: Improper Privilege Management vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, low privileged attacker to elevate privileges to "manufacturer" level on the targeted system. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.kaspersky.com/advisories/2023/11/08/klcert-22-216-telit-cinterion-thales-gemalto-modules-improper-privilege-management-vulnerability/
CVE ID: CVE-2023-47612 State: PUBLISHED Published: 2023-11-09T12:07:54.815Z Last Updated: 2024-09-04T13:47:01.811Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Telit Cinterion Products: BGS5, EHS5, EHS6, EHS8, PDS5, PDS6, PDS8, ELS61, ELS81, PLS62 Problem Types: CWE-552 Description: A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow an attacker with physical access to the target system to obtain a read/write access to any files and directories on the targeted system, including hidden
to the target system to obtain a read/write access to any files and directories on the targeted system, including hidden files and directories. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ics-cert.kaspersky.com/advisories/2023/11/08/klcert-22-194-telit-cinterion-thales-gemalto-modules-files-or-directories-accessible-to-external-parties-vulnerability/
CVE ID: CVE-2023-47613 State: PUBLISHED Published: 2023-11-09T06:32:08.024Z Last Updated: 2024-09-03T19:34:58.071Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Telit Cinterion Products: BGS5, EHS5, EHS6, EHS8, PDS5, PDS6, PDS8, ELS61, ELS81, PLS62 Problem Types: CWE-23 Description: A CWE-23: Relative Path Traversal vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, low privileged attacker to escape from virtual directories and get read/write access to protected files on the targeted system. Additional Analyst Notes: - CVE Program Contai
ries and get read/write access to protected files on the targeted system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ics-cert.kaspersky.com/advisories/2023/11/08/klcert-22-211-telit-cinterion-thales-gemalto-modules-relative-path-traversal/
CVE ID: CVE-2023-47614 State: PUBLISHED Published: 2023-11-10T15:50:24.884Z Last Updated: 2024-09-03T17:37:01.547Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Telit Cinterion Products: BGS5, EHS5-E, EHS5-US, EHS5-US Rel.4, EHS6, EHS6 Rel.2, EHS6 Rel.3, EHS6 Rel.4, EHS6-A Rel.4, EHS8, EHS8 Rel.4, ELS61-AUS, ELS61-AUS Rel.1, ELS61-AUS Rel.1 MR, ELS61-E, ELS61-E Rel.1, ELS61-E Rel.1 MR, ELS61-E Rel.2, ELS61-E2 Rel.1, ELS61-E2 Rel.1 MR, ELS61-US Rel.1 MR, ELS61-US Rel.2, ELS81-E, ELS81-E Rel.1, ELS81-E Rel.1.1, ELS81-US, ELS81-US Rel.1.1, PDS5-E, PDS5-E Rel.1, PDS5-E Rel.4, PDS5-US, PDS6, PDS8, PLS62-W, PLS62-W Rel.1 Problem Types: CWE-200 Description: A CWE-20
-E, PDS5-E Rel.1, PDS5-E Rel.4, PDS5-US, PDS6, PDS8, PLS62-W, PLS62-W Rel.1 Problem Types: CWE-200 Description: A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, low privileged attacker to disclose hidden virtual paths and file names on the targeted system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ics-cert.kaspersky.com/advisories/2023/11/08/klcert-22-210-telit-cinterion-thales-gemalto-modules-exposure-of-sensitive-information-to-an-unauthorized-a
s/2023/11/08/klcert-22-210-telit-cinterion-thales-gemalto-modules-exposure-of-sensitive-information-to-an-unauthorized-actor-vulnerability/
CVE ID: CVE-2023-47615 State: PUBLISHED Published: 2023-11-09T12:47:43.253Z Last Updated: 2024-09-03T19:34:27.651Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Telit Cinterion Products: BGS5, EHS5, EHS6, EHS8, PDS5, PDS6, PDS8, ELS61, ELS81, PLS62 Problem Types: CWE-526 Description: A CWE-526: Exposure of Sensitive Information Through Environmental Variables vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, low privileged attacker to get access to a sensitive data on the targeted system. Additional Analyst Notes: - CVE Program Container:
d attacker to get access to a sensitive data on the targeted system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ics-cert.kaspersky.com/advisories/2023/11/09/klcert-22-212-telit-cinterion-thales-gemalto-modules-exposure-of-sensitive-information-through-environmental-variables/
CVE ID: CVE-2023-47616 State: PUBLISHED Published: 2023-11-09T12:24:33.382Z Last Updated: 2024-09-03T19:34:41.779Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Telit Cinterion Products: BGS5, EHS5, EHS6, EHS8, PDS5, PDS6, PDS8, ELS61, ELS81, PLS62 Problem Types: CWE-200 Description: A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow an attacker with physical access to the target system to get access to a sensitive data on the targeted system. Additional Analyst Notes: - CVE Progr
ess to the target system to get access to a sensitive data on the targeted system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ics-cert.kaspersky.com/advisories/2023/11/09/klcert-22-193-telit-cinterion-thales-gemalto-modules-exposure-of-sensitive-information-to-an-unauthorized-actor/
CVE ID: CVE-2023-47617 State: PUBLISHED Published: 2024-02-06T16:20:13.079Z Last Updated: 2025-11-04T18:19:05.029Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Tp-Link Products: ER7206 Omada Gigabit VPN Router Problem Types: CWE-78 Description: A post authentication command injection vulnerability exists when configuring the web group member of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
o trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1858
CVE ID: CVE-2023-47618 State: PUBLISHED Published: 2024-02-06T16:20:12.604Z Last Updated: 2025-11-04T18:19:06.288Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Tp-Link Products: ER7206 Omada Gigabit VPN Router Problem Types: CWE-78 Description: A post authentication command execution vulnerability exists in the web filtering functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
rigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1859
CVE ID: CVE-2023-47619 State: PUBLISHED Published: 2023-12-13T21:02:34.389Z Last Updated: 2025-05-22T18:04:00.226Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: advplyr Products: audiobookshelf Problem Types: CWE-918, CWE-200 Description: Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, users with the update permission are able to read arbitrary files, delete arbitrary files and send a GET request to arbitrary URLs and read the response. This issue may lead to Information Disclosure. As of time of publication, no patches are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
ublication, no patches are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2023-203_GHSL-2023-204_audiobookshelf/ - https://github.com/advplyr/audiobookshelf/blob/d7b2476473ef1934eedec41425837cddf2d4b13e/server/controllers/AuthorController.js#L66
CVE ID: CVE-2023-47620 State: PUBLISHED Published: 2023-12-13T21:49:41.624Z Last Updated: 2024-08-02T21:09:37.378Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: koush Products: scrypted Problem Types: CWE-79 Description: Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the plugin-http.ts file via the `owner' and 'pkg` parameters. An attacker can run arbitrary JavaScript code. Additional Analyst Notes: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2023-218_GHSL-2023-219_scrypted/ - https://github.com/koush/scrypted/blob
https://securitylab.github.com/advisories/GHSL-2023-218_GHSL-2023-219_scrypted/ - https://github.com/koush/scrypted/blob/71cbe83a2a20f743342df695ca7b98482b73e60f/server/src/plugin/plugin-http.ts#L45
CVE ID: CVE-2023-47621 State: PUBLISHED Published: 2023-11-13T20:02:22.652Z Last Updated: 2024-09-03T20:12:20.885Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: duncanmcclean Products: guest-entries Problem Types: CWE-434 Description: Guest Entries is a php library which allows users to create, update & delete entries from the front-end of a site. In affected versions the file uploads feature did not prevent the upload of PHP files. This may lead to code execution on the server by authenticated users. This vulnerability is fixed in v3.1.2. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Pro
Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/duncanmcclean/guest-entries/security/advisories/GHSA-rw82-mhmx-grmj - https://github.com/duncanmcclean/guest-entries/commit/a8e17b4413bfbbc337a887761a6c858ef1ddb4da
CVE ID: CVE-2023-47622 State: PUBLISHED Published: 2024-04-15T17:34:01.226Z Last Updated: 2024-08-02T21:16:42.196Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Combodo Products: iTop Problem Types: CWE-79 Description: iTop is an IT service management platform. When dashlet are refreshed, XSS attacks are possible. This vulnerability is fixed in 3.0.4 and 3.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-q9cm-q7fc-frxh - https://github.com/Combodo/iTop/commit/09be84f69da0fe44221f63b8c2db041bdf7dd7f9
CVE ID: CVE-2023-47623 State: PUBLISHED Published: 2023-12-13T21:38:14.451Z Last Updated: 2024-08-02T21:16:42.274Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: koush Products: scrypted Problem Types: CWE-79 Description: Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the login page via the `redirect_uri` parameter. By specifying a url with the javascript scheme (`javascript:`), an attacker can run arbitrary JavaScript code after the login. Additional Analyst Notes: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2023-2
. Additional Analyst Notes: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2023-218_GHSL-2023-219_scrypted/ - https://github.com/koush/scrypted/blob/v0.55.0/plugins/core/ui/src/Login.vue#L79
CVE ID: CVE-2023-47624 State: PUBLISHED Published: 2023-12-13T21:09:00.688Z Last Updated: 2024-08-02T21:16:42.103Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: advplyr Products: audiobookshelf Problem Types: CWE-22 Description: Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, any user (regardless of their permissions) may be able to read files from the local file system due to a path traversal in the `/hls` endpoint. This issue may lead to Information Disclosure. As of time of publication, no patches are available. Additional Analyst Notes: - CVE Program Container: References: - https://securitylab.github.com/adviso
es are available. Additional Analyst Notes: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2023-203_GHSL-2023-204_audiobookshelf/ - https://github.com/advplyr/audiobookshelf/blob/d7b2476473ef1934eedec41425837cddf2d4b13e/server/routers/HlsRouter.js#L32
CVE ID: CVE-2023-47625 State: PUBLISHED Published: 2023-11-13T20:40:56.752Z Last Updated: 2024-09-03T17:29:10.974Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: PX4 Products: PX4-Autopilot Problem Types: CWE-120 Description: PX4 autopilot is a flight control solution for drones. In affected versions a global buffer overflow vulnerability exists in the CrsfParser_TryParseCrsfPacket function in /src/drivers/rc/crsf_rc/CrsfParser.cpp:298 due to the invalid size check. A malicious user may create an RC packet remotely and that packet goes into the device where the _rcs_buf reads. The global buffer overflow vulnerability will be triggered and the drone can behave
he device where the _rcs_buf reads. The global buffer overflow vulnerability will be triggered and the drone can behave unexpectedly. This issue has been addressed in version 1.14.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-qpw7-65ww-wj82 - https://github.com/PX4/PX4-Autopilot/commit/d1fcd39a44e6312582c6ab02b0d5ee2599fb55aa
CVE ID: CVE-2023-47626 State: PUBLISHED Published: 2024-04-15T17:36:08.437Z Last Updated: 2024-08-02T21:16:42.094Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Combodo Products: iTop Problem Types: CWE-79 Description: iTop is an IT service management platform. When displaying/editing the user's personal tokens, XSS attacks are possible. This vulnerability is fixed in 3.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-vv3v-9vrv-h95h