Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-2223 State: PUBLISHED Published: 2023-05-30T07:49:20.226Z Last Updated: 2025-02-13T16:43:48.795Z Vendors: Unknown Products: Login rebuilder Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Login rebuilder WordPress plugin before 2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7b356b82-5d03-4f70-b4ce-f1405304bb52 - http://packetstormsecurity.co
ent: References: - https://wpscan.com/vulnerability/7b356b82-5d03-4f70-b4ce-f1405304bb52 - http://packetstormsecurity.com/files/173726/WordPress-Login-Rebuilder-Cross-Site-Scripting.html
CVE ID: CVE-2023-2224 State: PUBLISHED Published: 2023-06-05T13:39:02.151Z Last Updated: 2025-02-13T16:43:49.356Z Vendors: Unknown Products: SEO by 10Web Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The SEO by 10Web WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a76b6d22-1e00-428a-8a04-12162bd0d992 - http://packetstormsecurity.com/file
eferences: - https://wpscan.com/vulnerability/a76b6d22-1e00-428a-8a04-12162bd0d992 - http://packetstormsecurity.com/files/173725/WordPress-Seo-By-10Web-Cross-Site-Scripting.html
CVE ID: CVE-2023-2225 State: PUBLISHED Published: 2023-08-16T11:03:25.318Z Last Updated: 2024-10-08T19:09:40.483Z Vendors: Unknown Products: SEO ALert Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The SEO ALert WordPress plugin through 1.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0af475ba-5c02-4f62-876d-6235a745bbd6
CVE ID: CVE-2023-2226 State: PUBLISHED Published: 2023-04-21T11:48:46.279Z Last Updated: 2025-02-04T20:33:45.232Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Rapid7 Products: Velociraptor Problem Types: CWE-125 Description: Due to insufficient validation in the PE and OLE parsers in Rapid7's Velociraptor versions earlier than 0.6.8 allows attacker to crash Velociraptor during parsing of maliciously malformed files. For this attack to succeed, the attacker needs to be able to introduce malicious files to the system at the same time that Velociraptor attempts to collect any artifacts that attempt to parse PE files, Authenticode signatures, or OLE files. After
ociraptor attempts to collect any artifacts that attempt to parse PE files, Authenticode signatures, or OLE files. After crashing, the Velociraptor service will restart and it will still be possible to collect other artifacts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Velocidex/velociraptor
CVE ID: CVE-2023-2227 State: PUBLISHED Published: 2023-04-21T00:00:00.000Z Last Updated: 2025-02-04T20:48:20.362Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: modoboa Products: modoboa/modoboa Problem Types: CWE-285 Description: Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/351f9055-2008-4af0-b820-01ff66678bf3 - https://github.com/modoboa/modoboa/commit/7bcd3f6eb264d4e3e01071c97c2bac51cdd6fe97
CVE ID: CVE-2023-2228 State: PUBLISHED Published: 2023-04-21T00:00:00.000Z Last Updated: 2025-02-04T20:47:19.668Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: modoboa Products: modoboa/modoboa Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/619fb490-69ad-4a2a-b686-4c42a62404a9 - https://github.com/modoboa/modoboa/commit/5d886f3d06373d2c3292911bac0772bcd5102343
CVE ID: CVE-2023-2229 State: PUBLISHED Published: 2023-08-31T05:33:05.292Z Last Updated: 2024-10-01T18:01:59.686Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: rahulsingh74388 Products: Quick Post Duplicator Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Quick Post Duplicator for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level privi
t preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/34e31a0f-27de-4536-9a7e-b8f68e557b3f?source=cve - https://plugins.trac.wordpress.org/browser/rduplicator/trunk/quick-post-duplicator.php?rev=2844890
CVE ID: CVE-2023-2230 State: REJECTED Published: N/A Last Updated: 2023-08-08T17:20:17.976Z Description: No description available.
CVE ID: CVE-2023-2231 State: PUBLISHED Published: 2023-04-21T14:31:03.678Z Last Updated: 2024-08-02T06:12:20.680Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C) Vendors: MAXTECH Products: MAX-G866ac Problem Types: CWE-306 Description: A vulnerability, which was classified as critical, was found in MAXTECH MAX-G866ac 0.4.1_TBRO_20160314. This affects an unknown part of the component Remote Management. The manipulation leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227001 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not
er VDB-227001 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227001 - https://vuldb.com/?ctiid.227001 - https://youtu.be/fikdcK_xlS8
CVE ID: CVE-2023-2232 State: PUBLISHED Published: 2023-06-28T00:00:00 Last Updated: 2024-11-27T18:57:25.059Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 15.10 before 16.1, leading to a ReDoS vulnerability in the Jira prefix Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/408352 - https://hackerone.com/reports/1934802 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2232.json
CVE ID: CVE-2023-2233 State: PUBLISHED Published: 2023-09-29T06:30:51.179Z Last Updated: 2025-11-20T04:06:48.254Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-862 Description: An improper authorization issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.2.8, all versions starting from 16.3 before 16.3.5 and all versions starting from 16.4 before 16.4.1. It allows a project reporter to leak the owner's Sentry instance projects. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/408359 - https
E Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/408359 - https://hackerone.com/reports/1947211
CVE ID: CVE-2023-2234 State: PUBLISHED Published: 2023-07-10T04:33:35.254Z Last Updated: 2024-11-07T15:20:13.942Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-843 Description: Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fx9g-8fr2-q899
CVE ID: CVE-2023-2235 State: PUBLISHED Published: 2023-05-01T12:51:25.433Z Last Updated: 2025-03-05T19:03:27.818Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Linux Kernel Problem Types: CWE-416 Description: A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation. The perf_group_detach function did not check the event's siblings' attach_state before calling add_event_to_groups(), but remove_on_exec made it possible to call list_del_event() on before detaching from their group, making it possible to use a dangling pointer causing a use-after-free vulnerability. We rec
detaching from their group, making it possible to use a dangling pointer causing a use-after-free vulnerability. We recommend upgrading past commit fd0815f632c24878e325821943edccc7fde947a2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fd0815f632c24878e325821943edccc7fde947a2 - https://kernel.dance/fd0815f632c24878e325821943edccc7fde947a2
CVE ID: CVE-2023-2236 State: PUBLISHED Published: 2023-05-01T12:50:47.742Z Last Updated: 2025-03-05T19:03:34.822Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Linux Kernel Problem Types: CWE-416 Description: A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Both io_install_fixed_file and its callers call fput in a file in case of an error, causing a reference underflow which leads to a use-after-free vulnerability. We recommend upgrading past commit 9d94c04c0db024922e886c9fd429659f22f48ea4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
9d94c04c0db024922e886c9fd429659f22f48ea4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9d94c04c0db024922e886c9fd429659f22f48ea4 - https://kernel.dance/9d94c04c0db024922e886c9fd429659f22f48ea4 - https://security.netapp.com/advisory/ntap-20230601-0010/
CVE ID: CVE-2023-2237 State: PUBLISHED Published: 2023-06-09T05:33:24.370Z Last Updated: 2024-12-23T16:19:17.788Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: yudiz Products: WP Replicate Post Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The WP Replicate Post plugin for WordPress is vulnerable to SQL Injection via the post_id parameter in versions up to, and including, 4.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for contributor-level attackers or higher to append additional SQL
on on the existing SQL query. This makes it possible for contributor-level attackers or higher to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/916e6f8b-cb29-4062-9a05-0337cfdb382a?source=cve - https://plugins.trac.wordpress.org/browser/wp-replicate-post/trunk/init/functions.php#L81 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2910474%40wp-replicate-post%2Ftrunk&old=2896518%40wp-replicate-post%2Ftrunk&sfp_email=&sfph_mail=#file
il=&reponame=&new=2910474%40wp-replicate-post%2Ftrunk&old=2896518%40wp-replicate-post%2Ftrunk&sfp_email=&sfph_mail=#file3
CVE ID: CVE-2023-2238 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:06.493Z Description: No description available.
CVE ID: CVE-2023-2239 State: PUBLISHED Published: 2023-04-22T00:00:00.000Z Last Updated: 2025-02-04T19:35:15.980Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: microweber Products: microweber/microweber Problem Types: CWE-359 Description: Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/edeff16b-fc71-4e26-8d2d-dfe7bb5e7868 - https://github.com/microweber/microweber/commit/b0644cb3411b36b6ccc2ff7cdf7af3fa49525baa
CVE ID: CVE-2023-2240 State: PUBLISHED Published: 2023-04-22T00:00:00.000Z Last Updated: 2025-02-04T19:34:15.790Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: microweber Products: microweber/microweber Problem Types: CWE-269 Description: Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/8f595559-7b4b-4b00-954c-7a627766e203 - https://github.com/microweber/microweber/commit/f43d5b767ad5814fc5f84bbaf0b77996262f3a4b
CVE ID: CVE-2023-2241 State: PUBLISHED Published: 2023-04-22T16:00:04.467Z Last Updated: 2025-02-04T16:31:38.051Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: PoDoFo Problem Types: CWE-122 Description: A vulnerability, which was classified as critical, was found in PoDoFo 0.10.0. Affected is the function readXRefStreamEntry of the file PdfXRefStreamParserObject.cpp. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 535a786f124b739e3c857529cecc29e4eeb79778. It is recommended to apply a patch to fix this issue. V
patch is identified as 535a786f124b739e3c857529cecc29e4eeb79778. It is recommended to apply a patch to fix this issue. VDB-227226 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.227226 - https://vuldb.com/?ctiid.227226 - https://github.com/podofo/podofo/issues/69 - https://github.com/podofo/podofo/files/11260976/poc-file.zip - https://github.com/podofo/podofo/commit/535a786f124b739e3c857529cecc29e4eeb79778
CVE ID: CVE-2023-2242 State: PUBLISHED Published: 2023-04-22T16:00:05.901Z Last Updated: 2024-08-02T06:19:14.283Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Computer and Laptop Store Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component GET Parameter Handler. The manipulation of the argument c/s leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-2272
he exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227227. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227227 - https://vuldb.com/?ctiid.227227 - https://docs.google.com/document/d/1GZt9MKB2K-nDrg0cnrnU6_z9wDd9xPE-YJbPV2Qgqg4/edit
CVE ID: CVE-2023-2243 State: PUBLISHED Published: 2023-04-22T16:31:03.733Z Last Updated: 2024-08-02T06:19:13.594Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Complaint Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file users/registration.php of the component POST Parameter Handler. The manipulation of the argument fullname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is
launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227228. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227228 - https://vuldb.com/?ctiid.227228 - https://github.com/HibuMk/bug_report/blob/main/SQLi.md
CVE ID: CVE-2023-2244 State: PUBLISHED Published: 2023-04-22T16:31:04.904Z Last Updated: 2024-08-02T06:19:14.083Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Eyewear Shop Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. This affects an unknown part of the file /admin/orders/update_status.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227229 was assigned to this vulnerabil
The exploit has been disclosed to the public and may be used. The identifier VDB-227229 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227229 - https://vuldb.com/?ctiid.227229 - https://github.com/T4y1oR/bug_report/blob/main/SQLi-1.md
CVE ID: CVE-2023-2245 State: PUBLISHED Published: 2023-04-22T17:00:04.635Z Last Updated: 2025-02-04T16:28:34.433Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: hansunCMS Problem Types: CWE-434 Description: A vulnerability was found in hansunCMS 1.4.3. It has been declared as critical. This vulnerability affects unknown code of the file /ueditor/net/controller.ashx?action=catchimage. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-227230 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.227230 - https://vuldb.com/?ctiid.227230 - https://github.com/MorStardust/hansuncmswebshell/blob/main/README.md
CVE ID: CVE-2023-2246 State: PUBLISHED Published: 2023-04-23T15:31:04.034Z Last Updated: 2024-11-22T19:54:02.542Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Pizza Ordering System Problem Types: CWE-434 Description: A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/ajax.php?action=save_settings. The manipulation of the argument img leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227236. Additional Analys
has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227236. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.227236 - https://vuldb.com/?ctiid.227236 - https://docs.google.com/document/d/1Bzt1UOXHJYyNFvTUsMO4zfbiDd_cKxuEygjAww2GcZQ/edit
CVE ID: CVE-2023-2247 State: PUBLISHED Published: 2023-05-02T00:00:00 Last Updated: 2024-12-03T15:16:16.476Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Variable preview can unmask secrets Description: In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/post/2023/sa2023-07/
CVE ID: CVE-2023-2248 State: REJECTED Published: 2023-05-01T12:49:59.123Z Last Updated: 2023-05-08T11:25:42.511Z Description: No description available.
CVE ID: CVE-2023-2249 State: PUBLISHED Published: 2023-06-09T05:33:21.777Z Last Updated: 2024-12-23T16:19:33.213Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: tomdever Products: wpForo Forum Problem Types: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Description: The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions up to, and including, 2.1.7. This is due to the insecure use of file_get_contents without appropriate verification of the data being supplied to the function. This makes it possible for authenti
ontents without appropriate verification of the data being supplied to the function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to retrieve the contents of files like wp-config.php hosted on the system, perform a deserialization attack and possibly achieve remote code execution, and make requests to internal services. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/800fa098-b29f-4979-b7bd-b1186a4dafcb?source=cve - https://plugins.trac.wordpress.org/browser/wpforo/tags/2.1.7/classes/Actions.php#L444 - https://plugins.trac.wordpress.org/bro
//plugins.trac.wordpress.org/browser/wpforo/tags/2.1.7/classes/Actions.php#L444 - https://plugins.trac.wordpress.org/browser/wpforo/tags/2.1.8/classes/Actions.php#L437
CVE ID: CVE-2023-2250 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-02-04T16:30:30.884Z Vendors: n/a Products: MCE Problem Types: CWE-268 Description: A flaw was found in the Open Cluster Management (OCM) when a user have access to the worker nodes which has the cluster-manager-registration-controller or cluster-manager deployments. A malicious user can take advantage of this and bind the cluster-admin to any service account or using the service account to list all secrets for all kubernetes namespaces, leading into a cluster-level privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/open-
tion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/open-cluster-management-io/registration-operator/pull/344
CVE ID: CVE-2023-2251 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-02-04T17:12:26.377Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: eemeli Products: eemeli/yaml Problem Types: CWE-248 Description: Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/4b494e99-5a3e-40d9-8678-277f3060e96c - https://github.com/eemeli/yaml/commit/984f5781ffd807e58cad3b5c8da1f940dab75fba