Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-3227 State: PUBLISHED Published: 2023-06-14T00:00:00 Last Updated: 2025-01-02T20:49:14.941Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: fossbilling Products: fossbilling/fossbilling Problem Types: CWE-1220 Description: Insufficient Granularity of Access Control in GitHub repository fossbilling/fossbilling prior to 0.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/97ecf4b8-7eeb-4e39-917c-2660262ff9ba - https://github.com/fossbilling/fossbilling/commit/b65a75fcf70feaf547d414672f78d7cbe8a98e7e
CVE ID: CVE-2023-3228 State: PUBLISHED Published: 2023-06-14T00:00:00 Last Updated: 2025-01-02T20:48:26.882Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: fossbilling Products: fossbilling/fossbilling Problem Types: CWE-840 Description: Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/fossbilling/fossbilling/commit/b65a75fcf70feaf547d414672f78d7cbe8a98e7e - https://huntr.dev/bounties/0a7ee1fb-e693-4259-abf8-a2c3218c1647
CVE ID: CVE-2023-3229 State: PUBLISHED Published: 2023-06-14T00:00:00 Last Updated: 2025-01-02T20:47:54.491Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: fossbilling Products: fossbilling/fossbilling Problem Types: CWE-840 Description: Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/31f48ca1-e5e8-436f-b779-cad597759170 - https://github.com/fossbilling/fossbilling/commit/56a64fefddf6a0b06304bdd443fdb0bb55423533
CVE ID: CVE-2023-3230 State: PUBLISHED Published: 2023-06-14T00:00:00 Last Updated: 2025-01-02T20:46:08.296Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: fossbilling Products: fossbilling/fossbilling Problem Types: CWE-862 Description: Missing Authorization in GitHub repository fossbilling/fossbilling prior to 0.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/390643f0-106b-4424-835d-52610aefa4c7 - https://github.com/fossbilling/fossbilling/commit/b95f92554e5cb38bd0710c0f4b413c5adda6f617
CVE ID: CVE-2023-3231 State: PUBLISHED Published: 2023-06-14T05:31:04.404Z Last Updated: 2024-08-02T06:48:08.263Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: UJCMS Problem Types: CWE-200 Description: A vulnerability has been found in UJCMS up to 6.0.2 and classified as problematic. This vulnerability affects unknown code of the component ZIP Package Handler. The manipulation of the argument dir leads to information disclosure. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.0 is able
ppears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-231502 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231502 - https://vuldb.com/?ctiid.231502 - https://github.com/ujcms/ujcms/issues/6
CVE ID: CVE-2023-3232 State: PUBLISHED Published: 2023-06-14T06:00:04.383Z Last Updated: 2024-08-02T06:48:08.180Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Zhong Bang Products: CRMEB Problem Types: CWE-502 Description: A vulnerability was found in Zhong Bang CRMEB up to 4.6.0 and classified as critical. This issue affects some unknown processing of the file /api/wechat/app_auth of the component Image Upload. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231503. NOTE: The vendor was contacted early about this disclosure but did not respond i
er of this vulnerability is VDB-231503. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231503 - https://vuldb.com/?ctiid.231503 - https://github.com/HuBenLab/HuBenVulList/blob/main/CRMEB%20is%20vulnerable%20to%20Broken%20Access%20Control.md
CVE ID: CVE-2023-3233 State: PUBLISHED Published: 2023-06-14T06:31:03.289Z Last Updated: 2025-01-02T20:44:36.031Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Zhong Bang Products: CRMEB Problem Types: CWE-918 Description: A vulnerability was found in Zhong Bang CRMEB up to 4.6.0. It has been classified as critical. Affected is the function get_image_base64 of the file api/controller/v1/PublicController.php. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231504. NOTE: The vendor was contacted early about this disclosure
be used. The identifier of this vulnerability is VDB-231504. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.231504 - https://vuldb.com/?ctiid.231504 - https://github.com/HuBenLab/HuBenVulList/blob/main/CRMEB%20is%20vulnerable%20to%20Server-side%20request%20forgery%20(SSRF).md
CVE ID: CVE-2023-3234 State: PUBLISHED Published: 2023-06-14T06:31:04.253Z Last Updated: 2024-08-02T06:48:08.207Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Zhong Bang Products: CRMEB Problem Types: CWE-502 Description: A vulnerability was found in Zhong Bang CRMEB up to 4.6.0. It has been declared as problematic. Affected by this vulnerability is the function put_image of the file api/controller/v1/PublicController.php. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231505 was assigned to this vulnerability. NOTE: The vendor was contacted e
e public and may be used. The identifier VDB-231505 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231505 - https://vuldb.com/?ctiid.231505 - https://github.com/HuBenLab/HuBenVulList/blob/main/CRMEB%20is%20vulnerable%20to%20deserialization.md
CVE ID: CVE-2023-3235 State: PUBLISHED Published: 2023-06-14T07:00:04.704Z Last Updated: 2024-08-02T06:48:08.197Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: mccms Problem Types: CWE-918 Description: A vulnerability was found in mccms up to 2.6.5. It has been rated as critical. Affected by this issue is the function pic_api of the file sys/apps/controllers/admin/Comic.php. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-231506 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: Referen
VDB-231506 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231506 - https://vuldb.com/?ctiid.231506 - https://github.com/HuBenLab/HuBenVulList/blob/main/MCCMS%20is%20vulnerable%20to%20Server-side%20request%20forgery%20(SSRF)%201.md
CVE ID: CVE-2023-3236 State: PUBLISHED Published: 2023-06-14T07:00:06.331Z Last Updated: 2024-08-02T06:48:08.195Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: mccms Problem Types: CWE-918 Description: A vulnerability classified as critical has been found in mccms up to 2.6.5. This affects the function pic_save of the file sys/apps/controllers/admin/Comic.php. The manipulation of the argument pic leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231507. Additional Analyst Notes: - CVE Program Container: Reference
associated identifier of this vulnerability is VDB-231507. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231507 - https://vuldb.com/?ctiid.231507 - https://github.com/HuBenLab/HuBenVulList/blob/main/MCCMS%20is%20vulnerable%20to%20Server-side%20request%20forgery%20(SSRF)%202.md
CVE ID: CVE-2023-3237 State: PUBLISHED Published: 2023-06-14T07:31:03.348Z Last Updated: 2024-08-02T06:48:08.227Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: OTCMS Problem Types: CWE-259 Description: A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/password with the input admin leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231508. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.23
1508. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.231508 - https://vuldb.com/?ctiid.231508 - https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20contains%20a%20weak%20default%20password%20which%20gives%20attackers%20to%20access%20backstage%20management%20system.md
CVE ID: CVE-2023-3238 State: PUBLISHED Published: 2023-06-14T08:00:04.536Z Last Updated: 2025-01-02T20:40:18.187Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: OTCMS Problem Types: CWE-918 Description: A vulnerability, which was classified as critical, has been found in OTCMS up to 6.62. This issue affects some unknown processing of the file /admin/read.php?mudi=getSignal. The manipulation of the argument signalUrl leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231509 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: -
used. The identifier VDB-231509 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.231509 - https://vuldb.com/?ctiid.231509 - https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20is%20vulnerable%20to%20Server-side%20request%20forgery%20(SSRF).md
CVE ID: CVE-2023-3239 State: PUBLISHED Published: 2023-06-14T08:31:03.407Z Last Updated: 2024-08-02T06:48:08.286Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: OTCMS Problem Types: CWE-24 Description: A vulnerability, which was classified as problematic, was found in OTCMS up to 6.62. Affected is an unknown function of the file admin/readDeal.php?mudi=readQrCode. The manipulation of the argument img leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. VDB-231510 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.2
assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231510 - https://vuldb.com/?ctiid.231510 - https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20obtain%20the%20web%20directory%20path%20and%20other%20information%20leaked%20.md
CVE ID: CVE-2023-3240 State: PUBLISHED Published: 2023-06-14T08:31:04.377Z Last Updated: 2024-11-21T16:06:53.483Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: OTCMS Problem Types: CWE-24 Description: A vulnerability has been found in OTCMS up to 6.62 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file usersNews_deal.php. The manipulation of the argument file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231511. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
ifier of this vulnerability is VDB-231511. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.231511 - https://vuldb.com/?ctiid.231511 - https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20download%20vulenrability%20via%20the%20filename.md
CVE ID: CVE-2023-3241 State: PUBLISHED Published: 2023-06-14T09:00:03.857Z Last Updated: 2024-08-02T06:48:08.520Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: OTCMS Problem Types: CWE-22 Description: A vulnerability was found in OTCMS up to 6.62 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/read.php?mudi=announContent. The manipulation of the argument url leads to path traversal. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231512. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231512 - ht
bility is VDB-231512. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231512 - https://vuldb.com/?ctiid.231512 - https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20read%20vulenrability%20via%20the%20filename.md
CVE ID: CVE-2023-3242 State: PUBLISHED Published: 2023-07-26T17:36:18.417Z Last Updated: 2024-10-23T15:31:51.096Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: B&R Industrial Automation Products: B&R Automation Runtime Problem Types: CWE-770, CWE-665 Description: Improper initialization implementation in Portmapper used in B&R Industrial Automation Automation Runtime <G4.93 allows unauthenticated network-based attackers to cause permanent denial-of-service conditions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/downloads_br_productcatalogue/assets/1689787619746-en-original-1.0.pdf
CVE ID: CVE-2023-3243 State: PUBLISHED Published: 2023-06-28T20:23:21.810Z Last Updated: 2024-08-02T06:48:08.512Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Alerton Products: BCM-WEB Problem Types: CWE-290, CWE-326 Description: ** UNSUPPORTED WHEN ASSIGNED ** [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 hash, which could result in a successful brute force password attack. Impacted product is BCM-WEB version 3.3.X. Recommended fix: Upgrade to a supported product such as Alerton ACM.] Out of an abundance of caution, this CVE ID is being assigned to better serve our customers and
t such as Alerton ACM.] Out of an abundance of caution, this CVE ID is being assigned to better serve our customers and ensure all who are still running this product understand that the product is end of life and should be removed or upgraded. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.honeywell.com/us/en/product-security
CVE ID: CVE-2023-3244 State: PUBLISHED Published: 2023-08-17T06:43:42.770Z Last Updated: 2024-10-07T20:06:08.094Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: happy-coders Products: Comments Like Dislike Problem Types: CWE-862 Missing Authorization Description: The Comments Like Dislike plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the restore_settings function called via an AJAX action in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to reset the plugin's settings. NOTE: After attempting to contact the
s with minimal permissions, such as a subscriber, to reset the plugin's settings. NOTE: After attempting to contact the developer with no response, and reporting this to the WordPress plugin's team 30 days ago we are disclosing this issue as it still is not updated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/66019297-a8a8-4bbc-99db-4b47066f3e50?source=cve - https://plugins.trac.wordpress.org/browser/comments-like-dislike/trunk/inc/classes/cld-admin.php#L99
CVE ID: CVE-2023-3245 State: PUBLISHED Published: 2023-07-17T13:29:56.180Z Last Updated: 2025-04-23T16:20:07.676Z Vendors: Unknown Products: Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://
e in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f9f8ae7e-6621-4e29-9257-b8306dbe8811
CVE ID: CVE-2023-3246 State: PUBLISHED Published: 2023-11-06T12:01:43.918Z Last Updated: 2025-11-20T04:07:13.254Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue has been discovered in GitLab EE/CE affecting all versions starting before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1 which allows an attackers to block Sidekiq job processor. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/415371 - https://hackerone.com/reports/2014157
CVE ID: CVE-2023-3247 State: PUBLISHED Published: 2023-07-22T04:17:09.896Z Last Updated: 2024-10-15T20:34:03.327Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: PHP Group Products: PHP Problem Types: CWE-252, CWE-330 Description: In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonc
itialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/php/php-src/security/advisories/GHSA-76gg-c692-v2mw
CVE ID: CVE-2023-3248 State: PUBLISHED Published: 2023-07-24T10:20:25.254Z Last Updated: 2025-04-23T16:19:54.763Z Vendors: Unknown Products: All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The All-in-one Floating Contact Form WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerabili
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/90c7496b-552f-4566-b7ae-8c953c965352
CVE ID: CVE-2023-3249 State: PUBLISHED Published: 2023-06-30T01:56:18.057Z Last Updated: 2024-12-03T16:21:55.851Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: cyberlord92 Products: Web3 – Crypto wallet Login & NFT token gating Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hidden_form_data' function. This makes it possible for authenticated attackers to log in as any existing user on the site, such as an
ata' function. This makes it possible for authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e30b62de-7280-4c29-b882-dfa83e65966b?source=cve - https://plugins.trac.wordpress.org/browser/web3-authentication/tags/2.6.0/classes/common/Web3/controller/class-moweb3flowhandler.php#L198
CVE ID: CVE-2023-3251 State: PUBLISHED Published: 2023-08-29T18:38:11.935Z Last Updated: 2024-09-30T15:49:08.054Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) Vendors: Tenable Products: Nessus Problem Types: CWE-522 Description: A pass-back vulnerability exists where an authenticated, remote attacker with administrator privileges could uncover stored SMTP credentials within the Nessus application.This issue affects Nessus: before 10.6.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/tns-2023-29
CVE ID: CVE-2023-3252 State: PUBLISHED Published: 2023-08-29T18:55:09.869Z Last Updated: 2024-10-28T18:46:39.141Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: Tenable Products: Nessus Description: An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges could alter logging variables to overwrite arbitrary files on the remote host with log data, which could lead to a denial of service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/tns-2023-29
CVE ID: CVE-2023-3253 State: PUBLISHED Published: 2023-08-29T19:08:29.434Z Last Updated: 2024-10-28T18:59:10.910Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Tenable Products: Nessus Description: An improper authorization vulnerability exists where an authenticated, low privileged remote attacker could view a list of all the users available in the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/tns-2023-29
CVE ID: CVE-2023-3254 State: PUBLISHED Published: 2023-10-18T04:32:21.078Z Last Updated: 2025-02-05T19:15:52.601Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: trustindex Products: Widgets for Google Reviews Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setup_no_reg_header.php. This makes it possible for unauthenticated attackers to reset plugin settings and remove reviews via a forged request granted they can trick a site administrator int