Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-44484 State: PUBLISHED Published: 2023-10-31T21:09:22.667Z Last Updated: 2024-09-06T04:28:15.594Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Projectworlds Pvt. Limited Products: Online Blood Donation Management System Problem Types: CWE-79 Description: Online Blood Donation Management System v1.0 is vulnerable to a Stored Cross-Site Scripting vulnerability. The 'firstName' parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php response. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks
in the users/member.php response. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/carpenter/ - https://projectworlds.in/
CVE ID: CVE-2023-44485 State: REJECTED Published: 2023-10-31T21:14:37.563Z Last Updated: 2024-01-02T15:07:42.804Z Description: No description available.
CVE ID: CVE-2023-44486 State: REJECTED Published: 2023-10-31T21:19:44.848Z Last Updated: 2024-01-02T15:08:14.822Z Description: No description available.
CVE ID: CVE-2023-44487 State: PUBLISHED Published: 2023-10-10T00:00:00.000Z Last Updated: 2025-11-04T21:08:27.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73 - https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ - https://aws.amazon.com/security/se
73 - https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ - https://aws.amazon.com/security/security-bulletins/AWS-2023-011/ - https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack - https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ - https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/ - https://news.ycombinator.com/item?id=37831062 - https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/ - https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack - https://github.com/envoypro
ttp2-record-breaking-ddos-attack/ - https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack - https://github.com/envoyproxy/envoy/pull/30055 - https://github.com/haproxy/haproxy/issues/2312 - https://github.com/eclipse/jetty.project/issues/10679 - https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764 - https://github.com/nghttp2/nghttp2/pull/1961 - https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61 - https://github.com/alibaba/tengine/issues/1872 - https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2 - https://news.ycombinator.com/item?id=37830987 - https://news.ycombinator.com/item?id=37830998 - https://githu
te/http2 - https://news.ycombinator.com/item?id=37830987 - https://news.ycombinator.com/item?id=37830998 - https://github.com/caddyserver/caddy/issues/5877 - https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/ - https://github.com/bcdannyboy/CVE-2023-44487 - https://github.com/grpc/grpc-go/pull/6703 - https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244 - https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0 - https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html - https://my.f5.com/manage/s/article/K000137106 - https://msrc.micr
l/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html - https://my.f5.com/manage/s/article/K000137106 - https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/ - https://bugzilla.proxmox.com/show_bug.cgi?id=4988 - https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9 - http://www.openwall.com/lists/oss-security/2023/10/10/7 - http://www.openwall.com/lists/oss-security/2023/10/10/6 - https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected - https://github.com/microsoft/CBL-Mariner/pull/6381 - https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo - https://github.com/face
om/microsoft/CBL-Mariner/pull/6381 - https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo - https://github.com/facebook/proxygen/pull/466 - https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088 - https://github.com/micrictor/http2-rst-stream - https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve - https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/ - https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf - https://github.com/h2o/h2o/pull/3291 - https://github.com/nodejs/node/pull/50121 - https://github.com/dotnet/announcements/issues/277 - https://github.com/golang/go/issues/63417 - https://githu
l/50121 - https://github.com/dotnet/announcements/issues/277 - https://github.com/golang/go/issues/63417 - https://github.com/advisories/GHSA-vx74-f528-fxqg - https://github.com/apache/trafficserver/pull/10564 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487 - https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14 - https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q - https://www.openwall.com/lists/oss-security/2023/10/10/6 - https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 - https://github.com/opensearch-project/data-prepper/issues/3474 - https://github.com/kubernetes/kubernetes/pull/1
44487 - https://github.com/opensearch-project/data-prepper/issues/3474 - https://github.com/kubernetes/kubernetes/pull/121120 - https://github.com/oqtane/oqtane.framework/discussions/3367 - https://github.com/advisories/GHSA-xpw8-rcwv-8f8p - https://netty.io/news/2023/10/10/4-1-100-Final.html - https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487 - https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/ - https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack - https://news.ycombinator.com/item?id=37837043 - https://github.com/kazu-yamamoto/http2/issues/93 - https://martinthomson.githu
//news.ycombinator.com/item?id=37837043 - https://github.com/kazu-yamamoto/http2/issues/93 - https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html - https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1 - https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113 - https://www.debian.org/security/2023/dsa-5522 - https://www.debian.org/security/2023/dsa-5521 - https://access.redhat.com/security/cve/cve-2023-44487 - https://github.com/ninenines/cowboy/issues/1615 - https://github.com/varnishcache/varnish-cache/issues/3996 - https://github.com/tempesta-tech/tempesta/iss
/issues/1615 - https://github.com/varnishcache/varnish-cache/issues/3996 - https://github.com/tempesta-tech/tempesta/issues/1986 - https://blog.vespa.ai/cve-2023-44487/ - https://github.com/etcd-io/etcd/issues/16740 - https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event - https://istio.io/latest/news/security/istio-security-2023-004/ - https://github.com/junkurihara/rust-rpxy/issues/97 - https://bugzilla.suse.com/show_bug.cgi?id=1216123 - https://bugzilla.redhat.com/show_bug.cgi?id=2242803 - https://ubuntu.com/security/CVE-2023-44487 - https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125 - https://github.com/advisories/GHSA-qppj-f
https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125 - https://github.com/advisories/GHSA-qppj-fm5r-hxr3 - https://github.com/apache/httpd-site/pull/10 - https://github.com/projectcontour/contour/pull/5826 - https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632 - https://github.com/line/armeria/pull/5232 - https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/ - https://security.paloaltonetworks.com/CVE-2023-44487 - https://github.com/akka/akka-http/issues/4323 - https://github.com/openresty/openresty/issues/930 - https://github.com/apache/apisix/issues/10320 - https://github.com/Azure/AKS/issues/3947 - http
y/openresty/issues/930 - https://github.com/apache/apisix/issues/10320 - https://github.com/Azure/AKS/issues/3947 - https://github.com/Kong/kong/discussions/11741 - https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487 - https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/ - https://github.com/caddyserver/caddy/releases/tag/v2.7.5 - https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html - http://www.openwall.com/lists/oss-security/2023/10/13/4 - http://www.openwall.com/lists/oss-security/2023/10/13/9 - https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/ - https://lists.w3.org/Archives/Publ
3/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/ - https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/ - https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/ - https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html - https://security.netapp.com/advisory/ntap-20231016-0001/ - https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html - http://www.openwall.com/lists/oss-security/2023/10/18/4 - http://www.openwall.com/lists/oss-security/2023/10/18/8 - http://www.openwall.com/lists/oss-securit
urity/2023/10/18/4 - http://www.openwall.com/lists/oss-security/2023/10/18/8 - http://www.openwall.com/lists/oss-security/2023/10/19/6 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/ - http://www.openwall.com/lists/oss-security/2023/10/20/8 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3
KIUH/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/ - https://lists.fedoraproject.org/archi
ckage-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/ - https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html - https://www.debian.org/s
LB3EEQWNWCN7OUIWWVWWCG2/ - https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html - https://www.debian.org/security/2023/dsa-5540 - https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html - https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/ - https://lists.fedoraproject.org/archives/list/package-announce@list
ject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/ - https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html - https://www.debian.org/security/2023/dsa-5549 - https:
ps://lists.debian.org/debian-lts-announce/2023/11/msg00001.html - https://www.debian.org/security/2023/dsa-5549 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/ - https://www.debian.org/security/2023/dsa-5558 - https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html - https://security.gentoo.org/glsa/202311-09 - https://www.debian.org/security/2023/dsa-5570 - https://security.netapp.com/advisory/ntap-20240426-0007/ - https://security.netapp.com/advisory/ntap-20240621-0006
570 - https://security.netapp.com/advisory/ntap-20240426-0007/ - https://security.netapp.com/advisory/ntap-20240621-0006/ - https://security.netapp.com/advisory/ntap-20240621-0007/ - https://github.com/grpc/grpc/releases/tag/v1.59.2 - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ
CVE ID: CVE-2023-44488 State: PUBLISHED Published: 2023-09-30T00:00:00 Last Updated: 2024-09-23T16:15:31.069Z Vendors: n/a Products: n/a Problem Types: n/a Description: VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/webmproject/libvpx/commit/df9fd9d5b7325060b2b921558a1eb20ca7880937 - https://github.com/webmproject/libvpx/commit/263682c9a29395055f3b3afe2d97be1828a6223f - https://github.com/webmproject/libvpx/compare/v1.13.0...v1.13.1 - https://github.com/webmproject/libvpx/releases/tag/v1.13.1 - http://www.openwall.com/lists/oss-security/2023/09/
.13.1 - https://github.com/webmproject/libvpx/releases/tag/v1.13.1 - http://www.openwall.com/lists/oss-security/2023/09/30/4 - https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html - https://bugzilla.redhat.com/show_bug.cgi?id=2241806 - https://security.gentoo.org/glsa/202310-04 - https://www.debian.org/security/2023/dsa-5518 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/
CVE ID: CVE-2023-44689 State: PUBLISHED Published: 2023-10-11T00:06:37.575Z Last Updated: 2024-09-18T16:03:05.350Z Vendors: Digital Agency Products: e-Gov Client Application (Windows version), e-Gov Client Application (macOS version) Problem Types: Improper authorization in handler for custom URL scheme Description: e-Gov Client Application (Windows version) versions prior to 2.1.1.0 and e-Gov Client Application (macOS version) versions prior to 1.1.1.0 are vulnerable to improper authorization in handler for custom URL scheme. A crafted URL may direct the product to access an arbitrary website. As a result, the user may become a victim of a phishing attack. Additional Analyst Notes: - CVE Pr
an arbitrary website. As a result, the user may become a victim of a phishing attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://shinsei.e-gov.go.jp/contents/news/2023-03-12t1022040900_1318.html - https://jvn.jp/en/jp/JVN15808274/
CVE ID: CVE-2023-44690 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-09-13T14:34:59.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: Inadequate encryption strength in mycli 1.27.0 allows attackers to view sensitive information via /mycli/config.py Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dbcli/mycli/issues/1131
CVE ID: CVE-2023-44693 State: PUBLISHED Published: 2023-10-17T00:00:00 Last Updated: 2024-09-16T17:55:23.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /importexport.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/llixixi/cve/blob/main/D-LINK-DAR-7000_sql_%20importexport.md
CVE ID: CVE-2023-44694 State: PUBLISHED Published: 2023-10-17T00:00:00 Last Updated: 2024-09-16T17:52:14.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /log/mailrecvview.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/llixixi/cve/blob/main/D-LINK-DAR-7000_rce_%20mailrecvview.md
CVE ID: CVE-2023-44709 State: PUBLISHED Published: 2023-12-14T00:00:00 Last Updated: 2024-10-08T14:24:14.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: PlutoSVG commit 336c02997277a1888e6ccbbbe674551a0582e5c4 and before was discovered to contain an integer overflow via the component plutosvg_load_from_memory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sammycage/plutosvg/issues/7 - https://gist.github.com/sunwithmoon/3f810c27d2e553f9d31bd7c50566f15b#file-cve-2023-44709
CVE ID: CVE-2023-44752 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-23T13:32:11.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Student Study Center Desk Management System v1.0 allows attackers to bypass authentication via a crafted GET request to /php-sscdms/admin/login.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://flashy-lemonade-192.notion.site/Login-Bypass-in-Student-Study-Center-Desk-Management-System-v1-0-fe410cff4fc3441ea4c5aa663225e445?pvs=4 - https://flashy-lemonade-192.notion.site/Login-Bypass-in-Student-Study-Center-Desk-Management-System-v1-0-fe410cff4fc3441ea4c5aa663225e445
CVE ID: CVE-2023-44753 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-23T14:46:28.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability fin Student Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter on the profile.php page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://flashy-lemonade-192.notion.site/Multiple-Cross-site-scripting-in-Edu-Authorities-Student-Management-System-f55752a1027f43eb91a5a489785e6d45?pvs=4 - https://flashy-lemonade-192.notion.site/Multiple-Cross-site-scripting-in-Edu-Auth
5752a1027f43eb91a5a489785e6d45?pvs=4 - https://flashy-lemonade-192.notion.site/Multiple-Cross-site-scripting-in-Edu-Authorities-Student-Management-System-f55752a1027f43eb91a5a489785e6d45
CVE ID: CVE-2023-44755 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-23T13:28:48.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sacco Management system v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /sacco/ajax.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://flashy-lemonade-192.notion.site/SQL-injection-in-Sacco-Management-system-via-password-and-id-parameter-1d85fc432de24db896446002f91acfd1?pvs=4 - https://flashy-lemonade-192.notion.site/SQL-injection-in-Sacco-Management-system-via-password-and-id-parameter-1d85fc432de24db896446002f91acfd1
CVE ID: CVE-2023-44758 State: PUBLISHED Published: 2023-10-06T00:00:00 Last Updated: 2024-09-19T17:13:04.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: GDidees CMS 3.0 is affected by a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Page Title. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/GDidees-CMS-Stored-XSS---Title/tree/main
CVE ID: CVE-2023-44760 State: PUBLISHED Published: 2023-10-23T00:00:00 Last Updated: 2024-08-02T20:07:33.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted script to the Header and Footer Tracking Codes of the SEO & Statistics. NOTE: the vendor disputes this because these header/footer changes can only be made by an admin, and allowing an admin to place JavaScript there is an intentional customization feature. Also, the exploitation method claimed by "sromanhu" does not provide any access to a Concrete CMS session, because the Concrete CMS session
ion method claimed by "sromanhu" does not provide any access to a Concrete CMS session, because the Concrete CMS session cookie is configured as HttpOnly. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sromanhu/ConcreteCMS-Stored-XSS---TrackingCodes - https://www.concretecms.org/about/project-news/security/security-advisory-2023-10-31-concrete-cms-rejects-cve-2023-44760-and-cve-2023-44766 - https://github.com/sromanhu/CVE-2023-44760_ConcreteCMS-Stored-XSS---TrackingCodes/issues/1
CVE ID: CVE-2023-44761 State: PUBLISHED Published: 2023-10-06T00:00:00 Last Updated: 2024-08-02T20:07:33.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS versions affected to 8.5.13 and below, and 9.0.0 through 9.2.1 allow a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sromanhu/ConcreteCMS-Stored-XSS---Forms - https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release
CVE ID: CVE-2023-44762 State: PUBLISHED Published: 2023-10-06T00:00:00 Last Updated: 2024-09-19T16:30:19.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2 allows an attacker to execute arbitrary code via a crafted script to the Tags from Settings - Tags. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/ConcreteCMS-Reflected-XSS---Tags