Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-51415 State: PUBLISHED Published: 2024-02-10T08:39:12.408Z Last Updated: 2024-08-02T22:32:09.431Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: GiveWP Products: GiveWP – Donation Plugin and Fundraising Platform Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform allows Stored XSS.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 3.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerab
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-3-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-51416 State: PUBLISHED Published: 2024-03-26T07:46:42.245Z Last Updated: 2024-08-02T22:32:09.447Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: EnvialoSimple Products: EnvíaloSimple Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in EnvialoSimple EnvíaloSimple.This issue affects EnvíaloSimple: from n/a through 2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/envialosimple-email-marketing-y-newsletters-gratis/wordpress-envialosimple-plugin-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-51417 State: PUBLISHED Published: 2023-12-29T13:44:41.119Z Last Updated: 2024-08-02T22:32:09.440Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Joris van Montfort Products: JVM Gutenberg Rich Text Icons Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Joris van Montfort JVM Gutenberg Rich Text Icons.This issue affects JVM Gutenberg Rich Text Icons: from n/a through 1.2.3. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/jvm-rich-text-icons/wordpress-jvm-rich-text-icons-plugin-1-2-3-arbitrary-file-upload-vulnerability?_s_id=cv
ulnerability/jvm-rich-text-icons/wordpress-jvm-rich-text-icons-plugin-1-2-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2023-51418 State: PUBLISHED Published: 2024-04-17T10:50:23.798Z Last Updated: 2024-08-02T22:32:09.415Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: Joris van Montfort Products: JVM rich text icons Problem Types: CWE-862 Description: Missing Authorization vulnerability in Joris van Montfort JVM rich text icons.This issue affects JVM rich text icons: from n/a through 1.2.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/jvm-rich-text-icons/wordpress-jvm-rich-text-icons-plugin-1-2-6-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2023-51419 State: PUBLISHED Published: 2023-12-29T13:30:24.561Z Last Updated: 2024-08-02T22:32:09.401Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Bertha.ai Products: BERTHA AI. Your AI co-pilot for WordPress and Chrome Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Bertha.Ai BERTHA AI. Your AI co-pilot for WordPress and Chrome.This issue affects BERTHA AI. Your AI co-pilot for WordPress and Chrome: from n/a through 1.11.10.7. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/bertha-ai-free/wordpress-bertha-ai-plugin-1-11-10-7-u
ainer: References: - https://patchstack.com/database/vulnerability/bertha-ai-free/wordpress-bertha-ai-plugin-1-11-10-7-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2023-51420 State: PUBLISHED Published: 2023-12-29T09:16:33.808Z Last Updated: 2024-11-20T19:30:50.952Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Soft8Soft LLC Products: Verge3D Publishing and E-Commerce Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/verge3d/wordpress-verge3d-plugin-4-5-2-remote-code-execution-rce-vulner
- https://patchstack.com/database/vulnerability/verge3d/wordpress-verge3d-plugin-4-5-2-remote-code-execution-rce-vulnerability?_s_id=cve
CVE ID: CVE-2023-51421 State: PUBLISHED Published: 2023-12-29T13:18:02.562Z Last Updated: 2025-04-17T20:16:06.299Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Soft8Soft LLC Products: Verge3D Publishing and E-Commerce Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/verge3d/wordpress-verge3d-plugin-4-5-2-arbitrary-file-upload-vulnerability?_s_id
//patchstack.com/database/vulnerability/verge3d/wordpress-verge3d-plugin-4-5-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2023-51422 State: PUBLISHED Published: 2023-12-29T12:59:32.098Z Last Updated: 2024-08-02T22:32:10.118Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Saleswonder Team Products: Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: from n/a through 3.05.0. Addi
reate live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: from n/a through 3.05.0. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/webinar-ignition/wordpress-webinarignition-plugin-3-05-0-authenticated-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-51423 State: PUBLISHED Published: 2023-12-31T17:52:39.655Z Last Updated: 2024-08-02T22:32:09.479Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: Saleswonder Team Products: Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meeting
binarIgnition.This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: from n/a through 3.05.0. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/webinar-ignition/wordpress-webinarignition-plugin-3-05-0-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-51424 State: PUBLISHED Published: 2024-05-17T08:42:57.758Z Last Updated: 2024-08-02T22:32:09.453Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Saleswonder Team Products: WebinarIgnition Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in Saleswonder Team WebinarIgnition allows Privilege Escalation.This issue affects WebinarIgnition: from n/a through 3.05.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/webinar-ignition/wordpress-webinarignition-plugin-3-05-0-unauthenticated-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2023-51425 State: PUBLISHED Published: 2024-04-24T16:05:05.989Z Last Updated: 2024-08-02T22:32:09.400Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Jacques Malgrange Products: Rencontre – Dating Site Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in Jacques Malgrange Rencontre – Dating Site allows Privilege Escalation.This issue affects Rencontre – Dating Site: from n/a through 3.10.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/rencontre/wordpress-rencontre-plugin-3-10-1-unauthenticated-account-takeover-vulnerability?
k.com/database/vulnerability/rencontre/wordpress-rencontre-plugin-3-10-1-unauthenticated-account-takeover-vulnerability?_s_id=cve
CVE ID: CVE-2023-51426 State: PUBLISHED Published: 2023-12-29T03:28:07.173Z Last Updated: 2024-08-02T22:32:09.501Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L) Vendors: Honor Products: Magic OS Problem Types: CWE-843 Description: Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak. Additional Analyst Notes: - CVE Program Container: References: - https://www.hihonor.com/global/security/cve-2023-51426/
CVE ID: CVE-2023-51427 State: PUBLISHED Published: 2023-12-29T03:30:31.955Z Last Updated: 2024-08-02T22:32:09.957Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L) Vendors: Honor Products: Magic OS Problem Types: CWE-843 Description: Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak. Additional Analyst Notes: - CVE Program Container: References: - https://www.hihonor.com/global/security/cve-2023-51427/
CVE ID: CVE-2023-51428 State: PUBLISHED Published: 2023-12-29T03:32:31.596Z Last Updated: 2024-08-02T22:32:09.425Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L) Vendors: Honor Products: Magic OS Problem Types: CWE-843 Description: Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak. Additional Analyst Notes: - CVE Program Container: References: - https://www.hihonor.com/global/security/cve-2023-51428/
CVE ID: CVE-2023-51429 State: PUBLISHED Published: 2023-12-29T03:36:16.905Z Last Updated: 2024-09-09T17:42:09.270Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Honor Products: Magic OS Description: Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hihonor.com/global/security/cve-2023-51429/
CVE ID: CVE-2023-51430 State: PUBLISHED Published: 2023-12-29T03:39:19.062Z Last Updated: 2024-11-27T15:25:26.247Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Honor Products: Magic UI Description: Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hihonor.com/global/security/cve-2023-51430/
CVE ID: CVE-2023-51431 State: PUBLISHED Published: 2023-12-29T03:43:09.979Z Last Updated: 2024-08-02T22:32:09.443Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Honor Products: com.hihonor.phoneservice Description: Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions. Additional Analyst Notes: - CVE Program Container: References: - https://www.hihonor.com/global/security/cve-2023-51431/
CVE ID: CVE-2023-51432 State: PUBLISHED Published: 2023-12-29T03:45:42.193Z Last Updated: 2024-08-02T22:32:09.424Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) Vendors: Honor Products: Magic UI Description: Some Honor products are affected by out of bounds read vulnerability, successful exploitation could cause information leak. Additional Analyst Notes: - CVE Program Container: References: - https://www.hihonor.com/global/security/cve-2023-51432/
CVE ID: CVE-2023-51433 State: PUBLISHED Published: 2023-12-29T03:47:34.013Z Last Updated: 2024-08-02T22:32:09.415Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Honor Products: Magic UI Description: Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak. Additional Analyst Notes: - CVE Program Container: References: - https://www.hihonor.com/global/security/cve-2023-51433/
CVE ID: CVE-2023-51434 State: PUBLISHED Published: 2023-12-29T03:49:46.394Z Last Updated: 2024-08-02T22:32:09.460Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Honor Products: Magic UI Description: Some Honor products are affected by buffer overflow vulnerability, successful exploitation could cause code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.hihonor.com/global/security/cve-2023-51434/
CVE ID: CVE-2023-51435 State: PUBLISHED Published: 2023-12-29T03:51:46.940Z Last Updated: 2025-04-17T20:21:51.799Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Honor Products: Magic UI Description: Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hihonor.com/global/security/cve-2023-51435/
CVE ID: CVE-2023-51436 State: PUBLISHED Published: 2024-06-03T03:45:17.921Z Last Updated: 2025-03-19T20:12:15.647Z Vendors: Japan System Techniques Co., Ltd. Products: UNIVERSAL PASSPORT RX Problem Types: Cross-site scripting (XSS) Description: Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.8, which may allow a remote authenticated attacker with an administrative privilege to execute an arbitrary script on the web browser of the user who is using the product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jast-gakuen.com/products/unipa/ - https://jvn.jp/en/jp/JVN43215077/
CVE ID: CVE-2023-51437 State: PUBLISHED Published: 2024-02-07T09:18:19.080Z Last Updated: 2024-08-02T22:32:09.454Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Apache Software Foundation Products: Apache Pulsar Problem Types: CWE-203 Description: Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider updating the configured secret in the `saslJaasServerRoleTokenSignerSecretPath` file. Any component matching an above vers
dating the configured secret in the `saslJaasServerRoleTokenSignerSecretPath` file. Any component matching an above version running the SASL Authentication Provider is affected. That includes the Pulsar Broker, Proxy, Websocket Proxy, or Function Worker. 2.11 Pulsar users should upgrade to at least 2.11.3. 3.0 Pulsar users should upgrade to at least 3.0.2. 3.1 Pulsar users should upgrade to at least 3.1.1. Any users running Pulsar 2.8, 2.9, 2.10, and earlier should upgrade to one of the above patched versions. For additional details on this attack vector, please refer to https://codahale.com/a-lesson-in-timing-attacks/ . Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Contai
tps://codahale.com/a-lesson-in-timing-attacks/ . Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/5kgmvvolf5tzp5rz9xjwfg2ncwvqqgl5 - https://www.openwall.com/lists/oss-security/2024/02/07/1
CVE ID: CVE-2023-51438 State: PUBLISHED Published: 2024-01-09T10:00:13.080Z Last Updated: 2025-05-22T17:57:26.766Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC IPC1047E, SIMATIC IPC647E, SIMATIC IPC847E Problem Types: CWE-20 Description: A vulnerability has been identified in SIMATIC IPC1047E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC647E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC847E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows). In default installations of maxView Storage Manager where Redfish® server is
rage Manager < V4.14.00.26068 on Windows). In default installations of maxView Storage Manager where Redfish® server is configured for remote system management, a vulnerability has been identified that can provide unauthorized access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-702935.pdf
CVE ID: CVE-2023-51439 State: PUBLISHED Published: 2024-01-09T10:00:14.394Z Last Updated: 2025-04-17T17:54:26.450Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: JT2Go, Teamcenter Visualization V13.3, Teamcenter Visualization V14.1, Teamcenter Visualization V14.2, Teamcenter Visualization V14.3 Problem Types: CWE-125 Description: A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), Teamcenter Visualization V14.1 (All versions < V14.1.0.12), Teamcenter Visualization V14.2 (All versions < V14.2.0.9), Teamcenter Visualization V14.3 (All versions < V14.
.1.0.12), Teamcenter Visualization V14.2 (All versions < V14.2.0.9), Teamcenter Visualization V14.3 (All versions < V14.3.0.6). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted CGM files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-794653.pdf
CVE ID: CVE-2023-51440 State: PUBLISHED Published: 2024-02-13T09:00:04.702Z Last Updated: 2024-08-02T22:32:10.181Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:T/RC:C) Vendors: Siemens Products: SIMATIC CP 343-1, SIMATIC CP 343-1 Lean, SIPLUS NET CP 343-1, SIPLUS NET CP 343-1 Lean Problem Types: CWE-940 Description: A vulnerability has been identified in SIMATIC CP 343-1 (6GK7343-1EX30-0XE0) (All versions), SIMATIC CP 343-1 Lean (6GK7343-1CX10-0XE0) (All versions), SIPLUS NET CP 343-1 (6AG1343-1EX30-7XE0) (All versions), SIPLUS NET CP 343-1 Lean (6AG1343-1CX10-2XE0) (All versions). Affected products incorrectly validate TCP sequence numbers. This could allow a
ean (6AG1343-1CX10-2XE0) (All versions). Affected products incorrectly validate TCP sequence numbers. This could allow an unauthenticated remote attacker to create a denial of service condition by injecting spoofed TCP RST packets. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-516818.html
CVE ID: CVE-2023-51441 State: PUBLISHED Published: 2024-01-06T11:59:37.769Z Last Updated: 2025-06-18T15:50:11.058Z Vendors: Apache Software Foundation Products: Apache Axis Problem Types: CWE-918 Description: ** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF This issue affects Apache Axis: through 1.3. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06 applied. The Apache Axis proj
https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06 applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06 - https://lists.apache.org/thread/8nrm5thop8f82pglx4o0jg8wmvy6d9yd
CVE ID: CVE-2023-51442 State: PUBLISHED Published: 2023-12-21T14:54:56.848Z Last Updated: 2024-08-02T22:32:10.031Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: navidrome Products: navidrome Problem Types: CWE-287 Description: Navidrome is an open source web-based music collection server and streamer. A security vulnerability has been identified in navidrome's subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web Token (JWT) signed with the key "not so secret". The vulnerability can only be exploited on instances that have never been restarted. Navidrome supports an extens
cret". The vulnerability can only be exploited on instances that have never been restarted. Navidrome supports an extension to the subsonic authentication scheme, where a JWT can be provided using a `jwt` query parameter instead of the traditional password or token and salt (corresponding to resp. the `p` or `t` and `s` query parameters). This authentication bypass vulnerability potentially affects all instances that don't protect the subsonic endpoint `/rest/`, which is expected to be most instances in a standard deployment, and most instances in the reverse proxy setup too (as the documentation mentions to leave that endpoint unprotected). This issue has been patched in version 0.50.2. Add
o (as the documentation mentions to leave that endpoint unprotected). This issue has been patched in version 0.50.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/navidrome/navidrome/security/advisories/GHSA-wq59-4q6r-635r - https://github.com/navidrome/navidrome/commit/1132abb0135d1ecaebc41ed97a1e908a4ae02f7c
CVE ID: CVE-2023-51443 State: PUBLISHED Published: 2023-12-27T16:30:48.425Z Last Updated: 2025-11-04T18:21:32.334Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: signalwire Products: freeswitch Problem Types: CWE-703 Description: FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.11, when handling DTLS-SRTP for media setup, FreeSWITCH is susceptible to Denial of Service due to a race condition in the hello handshake phase of the DTLS protocol. This attack can be done continuously, thus denying new DTLS-SRTP
ion in the hello handshake phase of the DTLS protocol. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during the attack. If an attacker manages to send a ClientHello DTLS message with an invalid CipherSuite (such as `TLS_NULL_WITH_NULL_NULL`) to the port on the FreeSWITCH server that is expecting packets from the caller, a DTLS error is generated. This results in the media session being torn down, which is followed by teardown at signaling (SIP) level too. Abuse of this vulnerability may lead to a massive Denial of Service on vulnerable FreeSWITCH servers for calls that rely on DTLS-SRTP. To address this vulnerability, upgrade FreeSWITCH to 1.10.11 which inc