Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
a command injection vulnerability in their implementation of their binaries and handling of network requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03
CVE ID: CVE-2023-4250 State: PUBLISHED Published: 2023-10-31T13:54:46.526Z Last Updated: 2025-04-03T13:20:34.645Z Vendors: Unknown Products: EventPrime Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9c271619-f478-45c3-91d9-be0f55ee06a2
CVE ID: CVE-2023-4251 State: PUBLISHED Published: 2023-10-31T13:54:45.856Z Last Updated: 2025-04-22T20:01:32.493Z Vendors: Unknown Products: EventPrime Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ce564628-3d15-4bc5-8b8e-60b71786ac19
CVE ID: CVE-2023-4252 State: PUBLISHED Published: 2023-11-27T16:21:59.747Z Last Updated: 2024-11-21T19:16:17.965Z Vendors: Unknown Products: EventPrime Problem Types: CWE-1284 Improper Validation of Specified Quantity in Input Description: The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase bookings without payment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d2019e59-db6c-4014-8057-0644c9a00665
CVE ID: CVE-2023-4253 State: PUBLISHED Published: 2023-09-04T11:26:57.652Z Last Updated: 2025-04-23T16:18:10.867Z Vendors: Unknown Products: AI ChatBot Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1cbbab9e-be3d-4081-bc0e-c52d500d9871
CVE ID: CVE-2023-4254 State: PUBLISHED Published: 2023-09-04T11:26:56.873Z Last Updated: 2025-04-23T16:18:18.059Z Vendors: Unknown Products: AI ChatBot Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0dfffe48-e60d-4bab-b194-8a63554246c3
CVE ID: CVE-2023-4255 State: PUBLISHED Published: 2023-12-21T16:08:39.691Z Last Updated: 2025-02-13T17:09:26.229Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: n/a, Fedora Products: w3m, Fedora, Extra Packages for Enterprise Linux Problem Types: CWE-787 Description: An out-of-bounds write issue has been discovered in the backspace handling of the checkType() function in etc.c within the W3M application. This vulnerability is triggered by supplying a specially crafted HTML file to the w3m binary. Exploitation of this flaw could lead to application crashes, resulting in a denial of service condition. Additional Analyst Notes: - CVE Program Container: Referen
lication crashes, resulting in a denial of service condition. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2255207 - https://github.com/tats/w3m/commit/edc602651c506aeeb60544b55534dd1722a340d3 - https://github.com/tats/w3m/issues/268 - https://github.com/tats/w3m/pull/273 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AULOBQJLXE2KCT5UVQMKGEFL4GFIAOED/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TODROGVCWZ435HQIZE6ARQC5LPQLIA5C/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKFZ
IZE6ARQC5LPQLIA5C/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKFZQUK7FPWWJQYICDZZ4YWIPUPQ2D3R/
CVE ID: CVE-2023-4256 State: PUBLISHED Published: 2023-12-21T16:03:21.837Z Last Updated: 2025-02-13T17:09:26.781Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: n/a, Fedora Products: tcpreplay, Extra Packages for Enterprise Linux, Fedora Problem Types: CWE-415 Description: Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the tcpedit_dlt_cleanup() function within plugins/dlt_plugins.c. This vulnerability can be exploited by supplying a specifically crafted file to the tcprewrite binary. This flaw enables a local attacker to initiate a Denial of Service (DoS) attack. Additional Analyst Notes: - CVE Program Container: Reference
ocal attacker to initiate a Denial of Service (DoS) attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2255212 - https://github.com/appneta/tcpreplay/issues/813 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V3GYCHPVJ2VFN3D7FI4IRMDVMILLWBRF/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TMW5CIODKRHUUH7NTAYIRWGSJ56DTGXM/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EHUILQV2YJI5TXXXJA5FQ2HJQGFT7NTN/
CVE ID: CVE-2023-4257 State: PUBLISHED Published: 2023-10-13T21:09:51.733Z Last Updated: 2025-02-13T17:09:27.372Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-120, CWE-131 Description: Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-853q-q69w-gf5j - http://www.openwall.com/lists/oss-security/2023/11/07/1 - http://seclists.org/fulldisclosure/2023/Nov/1 - http://packetstormsecurity.com/files/175657/Zephyr
curity/2023/11/07/1 - http://seclists.org/fulldisclosure/2023/Nov/1 - http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html
CVE ID: CVE-2023-4258 State: PUBLISHED Published: 2023-09-25T21:46:37.430Z Last Updated: 2024-09-24T19:47:10.591Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-684 Description: In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-m34c-cp63-rwh7
CVE ID: CVE-2023-4259 State: PUBLISHED Published: 2023-09-25T23:05:40.753Z Last Updated: 2025-02-13T17:09:28.288Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-120, CWE-193 Description: Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gghm-c696-f4j4 - http://www.openwall.com/lists/oss-security/2023/11/07/1 - http://seclists.org/fulldisclosure/2023/Nov/1 - http://packetstormsecurity.
enwall.com/lists/oss-security/2023/11/07/1 - http://seclists.org/fulldisclosure/2023/Nov/1 - http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html
CVE ID: CVE-2023-4260 State: PUBLISHED Published: 2023-09-26T19:23:48.078Z Last Updated: 2025-02-13T17:09:28.800Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-120, CWE-193 Description: Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gj27-862r-55wh - http://www.openwall.com/lists/oss-security/2023/11/07/1 - http://seclists.org/fulldisclosure/2023/Nov/1 - http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.htm
lists.org/fulldisclosure/2023/Nov/1 - http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html
CVE ID: CVE-2023-4261 State: REJECTED Published: N/A Last Updated: 2025-02-22T02:45:35.654Z Description: No description available.
CVE ID: CVE-2023-4262 State: REJECTED Published: 2023-09-26T18:19:46.177Z Last Updated: 2024-07-31T23:16:28.166Z Description: No description available.
CVE ID: CVE-2023-4263 State: PUBLISHED Published: 2023-10-13T20:42:11.942Z Last Updated: 2025-02-13T17:09:29.359Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-120, CWE-121 Description: Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-rf6q-rhhp-pqhf - http://www.openwall.com/lists/oss-security/2023/11/07/1 - http://seclists.org/fulldisclosure/2023/Nov/1 - http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html
CVE ID: CVE-2023-4264 State: PUBLISHED Published: 2023-09-26T18:34:52.817Z Last Updated: 2025-06-18T14:13:45.830Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-120, CWE-121, CWE-122 Description: Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-rgx6-3w4j-gf5j - http://www.openwall.com/lists/oss-security/2023/11/07/1 - http://seclists.org/fulldisclosure/2023/Nov/1 - http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3
2023/11/07/1 - http://seclists.org/fulldisclosure/2023/Nov/1 - http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html
CVE ID: CVE-2023-4265 State: PUBLISHED Published: 2023-08-12T22:09:20.701Z Last Updated: 2025-02-13T17:09:30.925Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-120 Description: Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/usb/device/class/netusb/function_rndis... https://github.com/zephyrproject-rtos/zephyr/blob/main/s
phyr/blob/main/subsys/usb/device/class/netusb/function_rndis... https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/usb/device/class/netusb/function_rndis.c#L841 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4vgv-5r6q-r6xh - http://www.openwall.com/lists/oss-security/2023/11/07/1 - http://seclists.org/fulldisclosure/2023/Nov/1 - http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html
CVE ID: CVE-2023-4269 State: PUBLISHED Published: 2023-09-04T11:26:56.095Z Last Updated: 2025-04-23T16:18:24.845Z Vendors: Unknown Products: User Activity Log Problem Types: CWE-863 Incorrect Authorization Description: The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated users, such as subscriber to perform such action and retrieve PII such as email addresses. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/db3e4336-117c-47f2-9b43-2ca115525297
CVE ID: CVE-2023-4270 State: PUBLISHED Published: 2023-09-11T19:46:05.206Z Last Updated: 2025-05-02T16:52:53.525Z Vendors: Unknown Products: Min Max Control Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Min Max Control WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/04560bf1-676b-46fb-9344-4150862f2686
CVE ID: CVE-2023-4271 State: PUBLISHED Published: 2023-10-20T06:35:18.698Z Last Updated: 2025-02-05T19:08:03.681Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: deanoakley Products: Photospace Responsive Gallery Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Photospace Responsive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘psres_button_size’ parameter in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to
output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3bc98896-6ff9-40de-ace2-2ca331c2a44a?source=cve - https://plugins.trac.wordpress.org/changeset/2831424/photospace-responsive/trunk/includes/class-photospace-responsive-gallery.php?contextall=1&old=2544748&old_path=%2Fphotospace-res
ce-responsive/trunk/includes/class-photospace-responsive-gallery.php?contextall=1&old=2544748&old_path=%2Fphotospace-responsive%2Ftrunk%2Fincludes%2Fclass-photospace-responsive-gallery.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2966110%40photospace-responsive%2Ftrunk&old=2875667%40photospace-responsive%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-4272 State: PUBLISHED Published: 2023-11-07T15:18:59.203Z Last Updated: 2024-09-04T19:35:16.534Z Vendors: Arm Ltd Products: Midgard GPU Kernel Driver, Bifrost GPU Kernel Driver, Valhall GPU Kernel Driver, Arm 5th Gen GPU Architecture Kernel Driver Problem Types: CWE-1251, CWE-200 Description: A local non-privileged user can make GPU processing operations that expose sensitive data from previously freed memory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE ID: CVE-2023-4273 State: PUBLISHED Published: 2023-08-09T14:53:44.835Z Last Updated: 2025-11-14T14:21:07.854Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Problem Types: CWE-121 Description: A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copie
and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2023:6583 - https://access.redhat.com/security/cve/CVE-2023-4273 - https://bugzilla.redhat.com/show_bug.cgi?id=2221609 - https://dfir.ru/2023/08/23/cve-2023-4273-a-vulnerability-in-the-linux-exfat-driver/
CVE ID: CVE-2023-4274 State: PUBLISHED Published: 2023-10-20T06:35:26.385Z Last Updated: 2025-02-05T19:07:13.050Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H) Vendors: wpvividplugins Products: Migration, Backup, Staging – WPvivid Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 0.9.89. This allows authenticated attackers with administrative privileges to delete the contents of arbitrary directories on the server, which can be a critical issue in a shared environments. Add
delete the contents of arbitrary directories on the server, which can be a critical issue in a shared environments. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5d94f38f-4b52-4b0d-800c-a6fca40bda3c?source=cve - https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.89/includes/class-wpvivid-setting.php#L200 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2956458%40wpvivid-backuprestore%2Ftrunk&old=2948265%40wpvivid-backuprestore%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-4275 State: REJECTED Published: N/A Last Updated: 2023-08-10T21:45:00.000Z Description: No description available.
CVE ID: CVE-2023-4276 State: PUBLISHED Published: 2023-08-10T06:53:58.090Z Last Updated: 2025-02-05T19:36:34.236Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: johnkolbert Products: Absolute Privacy Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to missing nonce validation on the 'abpr_profileShortcode' function. This makes it possible for unauthenticated attackers to change user email and password via a forged request granted they can trick a site administrator into performing an action such as click
il and password via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f3855e84-b97e-4729-8a48-55f2a2444e2c?source=cve - https://plugins.trac.wordpress.org/browser/absolute-privacy/trunk/profile_page.php
CVE ID: CVE-2023-4277 State: PUBLISHED Published: 2023-08-10T06:53:57.359Z Last Updated: 2025-02-05T19:36:41.980Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: pragmaticmates Products: Realia Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Realia plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.0. This is due to missing nonce validation on the 'process_change_profile_form' function. This makes it possible for unauthenticated attackers to change user email via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additio
forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/06f33e18-0bdd-4c56-a8df-fc1969b9ecf8?source=cve - https://plugins.trac.wordpress.org/browser/realia/tags/1.4.0/includes/post-types/class-realia-post-type-user.php#L112
CVE ID: CVE-2023-4278 State: PUBLISHED Published: 2023-09-11T19:46:08.650Z Last Updated: 2025-04-23T16:16:35.829Z Vendors: Unknown Products: MasterStudy LMS WordPress Plugin Problem Types: CWE-269 Improper Privilege Management Description: The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/cb3173ec-9891-4bd8-9d05-24fe805b5235 - http://packetstormsecurity.com/files/175007/WordPress-Masterstudy-LMS-3.0.1
ility/cb3173ec-9891-4bd8-9d05-24fe805b5235 - http://packetstormsecurity.com/files/175007/WordPress-Masterstudy-LMS-3.0.17-Account-Creation.html
CVE ID: CVE-2023-4279 State: PUBLISHED Published: 2023-09-04T11:27:04.063Z Last Updated: 2025-04-23T16:17:42.783Z Vendors: Unknown Products: User Activity Log Problem Types: CWE-290 Authentication Bypass by Spoofing Description: This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2bd2579e-b383-4d12-b207-6fc32cfb82bc
CVE ID: CVE-2023-4280 State: PUBLISHED Published: 2024-01-02T16:52:06.959Z Last Updated: 2025-06-13T19:03:26.975Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: silabs.com Products: GSDK Problem Types: CWE-125, CWE-787 Description: An unvalidated input in Silicon Labs TrustZone implementation in v4.3.x and earlier of the Gecko SDK allows an attacker to access the trusted region of memory from the untrusted region. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/SiliconLabs/gecko_sdk - https://community.silabs.com/069Vm0000004NinIAE
CVE ID: CVE-2023-4281 State: PUBLISHED Published: 2023-09-25T15:56:53.286Z Last Updated: 2025-04-23T16:15:54.587Z Vendors: Unknown Products: Activity Log Problem Types: CWE-290 Authentication Bypass by Spoofing Description: This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f5ea6c8a-6b07-4263-a1be-dd033f078d49
CVE ID: CVE-2023-4282 State: PUBLISHED Published: 2023-08-10T11:05:42.912Z Last Updated: 2025-02-05T19:36:25.225Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: wpdevteam Products: EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor Problem Types: CWE-862 Missing Authorization Description: The EmbedPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'admin_post_remove' and 'remove_private_data' functions in versions up to, and including, 3.8.2. This makes it possible for authenticated attackers with subscriber privileges or above,