Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-2477 State: PUBLISHED Published: 2023-05-02T14:00:06.199Z Last Updated: 2024-08-02T06:26:08.914Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: Funadmin Problem Types: CWE-79 Description: A vulnerability was found in Funadmin up to 3.2.3. It has been declared as problematic. Affected by this vulnerability is the function tagLoad of the file Cx.php. The manipulation of the argument file leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227869 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vul
-227869 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227869 - https://vuldb.com/?ctiid.227869 - https://gitee.com/funadmin/funadmin/issues/I6W2YL
CVE ID: CVE-2023-2478 State: PUBLISHED Published: 2023-05-08T00:00:00.000Z Last Updated: 2025-01-29T17:16:21.653Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Incorrect permission assignment for critical resource in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.9.7, all versions starting from 15.10 before 15.10.6, all versions starting from 15.11 before 15.11.2. Under certain conditions, a malicious unauthorized GitLab user may use a GraphQL endpoint to attach a malicious runner to any project. Additional Analyst Notes: - CVE Program Container:
use a GraphQL endpoint to attach a malicious runner to any project. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/409470 - https://hackerone.com/reports/1969599 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2478.json
CVE ID: CVE-2023-2479 State: PUBLISHED Published: 2023-05-02T00:00:00.000Z Last Updated: 2025-01-30T16:28:31.038Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: appium Products: appium/appium-desktop Problem Types: CWE-78 Description: OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/fbdeec3c-d197-4a68-a547-7f93fb9594b4 - https://github.com/appium/appium-desktop/commit/12a988aa08b9822e97056a09486c9bebb3aad8fe
CVE ID: CVE-2023-2480 State: PUBLISHED Published: 2023-05-25T13:28:29.204Z Last Updated: 2024-08-28T18:21:05.801Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: M-Files Products: M-Files Client Problem Types: CWE-280 Description: Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applications Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://product.m-files.com/security-advisories/cve-2023-2480/
CVE ID: CVE-2023-2481 State: PUBLISHED Published: 2023-05-18T18:44:48.742Z Last Updated: 2025-01-21T21:38:57.929Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: silabs.com Products: Gecko Platform Problem Types: CWE-14 Description: Compiler removal of buffer clearing in sli_se_opaque_import_key in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/SiliconLabs/gecko_sdk - https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U19lGQAR?operationContext=S1
CVE ID: CVE-2023-2482 State: PUBLISHED Published: 2023-06-27T13:17:10.255Z Last Updated: 2024-11-27T19:43:12.438Z Vendors: Unknown Products: Responsive CSS EDITOR Problem Types: CWE-89 SQL Injection Description: The Responsive CSS EDITOR WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c0f73781-be7e-482e-91de-ad7991ad4bd5
CVE ID: CVE-2023-2483 State: REJECTED Published: N/A Last Updated: 2023-05-23T00:00:00 Description: No description available.
CVE ID: CVE-2023-2484 State: PUBLISHED Published: 2023-06-09T05:33:14.991Z Last Updated: 2024-12-23T16:19:46.672Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: cyberlord92 Products: Active Directory Integration / LDAP Integration Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possibl
aping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3eedc57b-79cc-4569-b6d6-676a22aa1e06?source=cve - https://plugins.trac.wordpress.org/browser/ldap-login-for-intranet-sites/trunk/class-mo-ldap-user-auth-reports.php?rev=2859403#L64 - https://plugins.trac.wordpress.org/changeset?sfp_email=&s
es/trunk/class-mo-ldap-user-auth-reports.php?rev=2859403#L64 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2910898%40ldap-login-for-intranet-sites%2Ftrunk&old=2903294%40ldap-login-for-intranet-sites%2Ftrunk&sfp_email=&sfph_mail=#file5
CVE ID: CVE-2023-2485 State: PUBLISHED Published: 2023-06-07T00:00:00 Last Updated: 2025-01-07T15:44:24.332Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-266 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refer
that those other users are Owners of. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/407830 - https://hackerone.com/reports/1934811 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2485.json
CVE ID: CVE-2023-2487 State: PUBLISHED Published: 2023-12-21T14:08:49.034Z Last Updated: 2024-08-02T06:26:09.066Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Smackcoders Products: Export All Posts, Products, Orders, Refunds & Users Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-ultimate-exporter/wordpress-export-all-posts
m Container: References: - https://patchstack.com/database/vulnerability/wp-ultimate-exporter/wordpress-export-all-posts-products-orders-refunds-users-plugin-2-2-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2023-2488 State: PUBLISHED Published: 2023-06-05T13:38:59.394Z Last Updated: 2025-01-08T17:00:43.842Z Vendors: Unknown Products: Stop Spammers Security | Block Spam Users, Comments, Forms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before outputting them back in admin dashboard pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/60226669-0b7b-
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/60226669-0b7b-441f-93d4-b5933e69478f
CVE ID: CVE-2023-2489 State: PUBLISHED Published: 2023-06-05T13:38:59.037Z Last Updated: 2025-01-08T17:03:38.216Z Vendors: Unknown Products: Stop Spammers Security | Block Spam Users, Comments, Forms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.co
isite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/dcbe3334-357a-4744-b50c-309d10cca30d
CVE ID: CVE-2023-2490 State: PUBLISHED Published: 2023-05-11T09:46:03.191Z Last Updated: 2025-01-09T15:17:35.259Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Fernando Briano Products: UserAgent-Spy Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fernando Briano UserAgent-Spy plugin <= 1.3.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/useragent-spy/wordpress-useragent-spy-plugin-1-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-2491 State: PUBLISHED Published: 2023-05-17T00:00:00.000Z Last Updated: 2025-01-22T18:23:43.462Z Vendors: n/a Products: emacs Problem Types: CWE-77 Description: A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2192873 - https://access.redhat.com/security/c
P Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2192873 - https://access.redhat.com/security/cve/CVE-2023-2491 - https://access.redhat.com/errata/RHSA-2023:3104 - https://access.redhat.com/errata/RHSA-2023:2626
CVE ID: CVE-2023-2492 State: PUBLISHED Published: 2023-06-19T10:52:44.610Z Last Updated: 2024-12-12T16:55:58.887Z Vendors: Unknown Products: QueryWall: Plug'n Play Firewall Problem Types: CWE-89 SQL Injection Description: The QueryWall: Plug'n Play Firewall WordPress plugin through 1.1.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fa7c54c2-5653-4d3d-8163-f3d63272c050
CVE ID: CVE-2023-2493 State: PUBLISHED Published: 2023-07-10T12:40:10.450Z Last Updated: 2024-11-12T14:08:07.018Z Vendors: Unknown Products: All In One Redirection Problem Types: CWE-89 SQL Injection Description: The All In One Redirection WordPress plugin before 2.2.0 does not properly sanitise and escape multiple parameters before using them in an SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a9a205a4-eef9-4f30-877a-4c562930650c
CVE ID: CVE-2023-2494 State: PUBLISHED Published: 2023-05-23T23:36:47.546Z Last Updated: 2025-01-13T16:47:39.714Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Granth Products: Go Pricing - WordPress Responsive Pricing Tables Problem Types: CWE-862 Missing Authorization Description: The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_postdata' function in versions up to, and including, 3.3.19. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin to modify access t
or authenticated attackers with a role that the administrator previously granted access to the plugin to modify access to the plugin when it should only be the administrator's privilege. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5779914a-a168-4835-8aea-e0ab2b3be4f6?source=cve - https://codecanyon.net/item/go-pricing-wordpress-responsive-pricing-tables/3725820
CVE ID: CVE-2023-2495 State: PUBLISHED Published: 2023-07-10T12:40:36.457Z Last Updated: 2024-11-12T14:03:06.737Z Vendors: Unknown Products: Greeklish-permalink Problem Types: CWE-269 Improper Privilege Management, CWE-352 Cross-Site Request Forgery (CSRF) Description: The Greeklish-permalink WordPress plugin through 3.3 does not implement correct authorization or nonce checks in the cyrtrans_ajax_old AJAX action, allowing unauthenticated and low-privilege users to trigger the plugin's functionality to change Post slugs either directly or through CSRF. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/45878983-7e9b-49c2
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/45878983-7e9b-49c2-8f99-4c28aab24f09
CVE ID: CVE-2023-2496 State: PUBLISHED Published: 2023-05-23T23:36:47.080Z Last Updated: 2025-01-13T16:47:49.734Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Granth Products: Go Pricing - WordPress Responsive Pricing Tables Problem Types: CWE-285 Improper Authorization Description: The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability check on the 'validate_upload' function in versions up to, and including, 3.3.19. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin to upload arbitr
for authenticated attackers with a role that the administrator previously granted access to the plugin to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/477c6fa2-16a8-4461-b4d4-d087e13e3ca7?source=cve - https://codecanyon.net/item/go-pricing-wordpress-responsive-pricing-tables/3725820
CVE ID: CVE-2023-2497 State: PUBLISHED Published: 2023-11-22T15:33:39.114Z Last Updated: 2024-08-02T06:26:09.468Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: UserPro - Community and User Profile WordPress Plugin Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce validation on the 'import_settings' function. This makes it possible for unauthenticated attackers to exploit PHP Object Injection due to the use of unserialize() on the user supplied parameter via a forged r
attackers to exploit PHP Object Injection due to the use of unserialize() on the user supplied parameter via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fbb601ce-a884-4894-af13-dab14885c7eb?source=cve - https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681
CVE ID: CVE-2023-2498 State: PUBLISHED Published: 2023-05-23T23:36:46.492Z Last Updated: 2025-01-13T16:47:59.205Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Granth Products: Go Pricing - WordPress Responsive Pricing Tables Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.19 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scri
ut sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1c3d4c96-63a7-4f3b-a9ac-095be241f840?source=cve - https://codecanyon.net/item/go-pricing-wordpress-responsive-pricing-tables/3725820
CVE ID: CVE-2023-2499 State: PUBLISHED Published: 2023-05-16T08:40:01.163Z Last Updated: 2025-01-13T16:50:04.183Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: metagauss Products: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.1.0. This is due to insufficient verification on the user being supplied during a Google social login through the plugin. This makes it possible for unauthenticated attackers to l
eing supplied during a Google social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/87ec5542-b6e7-4b18-a3ec-c258e749d32e?source=cve - https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/5.2.0.4/services/class_rm_user_services.php#L791 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2912481%40custom-registration-form-builder-wi
//plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2912481%40custom-registration-form-builder-with-submission-manager&new=2912481%40custom-registration-form-builder-with-submission-manager&sfp_email=&sfph_mail=
CVE ID: CVE-2023-2500 State: PUBLISHED Published: 2023-05-24T23:38:16.209Z Last Updated: 2025-01-13T16:47:23.907Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Granth Products: Go Pricing - WordPress Responsive Pricing Tables Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.3.19 via deserialization of untrusted input from the 'go_pricing' shortcode 'data' parameter. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is presen
ows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f7686b11-97a8-4f09-bbfa-d77120cc35b7?source=cve - https://codecanyon.net/item/go-pricing-wordpress-responsive-pricing-tables/3725820
CVE ID: CVE-2023-2501 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2023-2502 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2023-2503 State: PUBLISHED Published: 2023-06-05T13:38:58.202Z Last Updated: 2025-01-08T17:07:14.045Z Vendors: Unknown Products: 10Web Social Post Feed Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The 10Web Social Post Feed WordPress plugin before 1.2.9 does not sanitise and escape some parameter before outputting it back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/07b1caf1-d00b-4075-b71a-0516d5604286
CVE ID: CVE-2023-2504 State: PUBLISHED Published: 2023-05-22T21:10:48.553Z Last Updated: 2025-01-16T21:32:55.179Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: BirdDog Products: STUDIO R3, 4K QUAD, MINI, A300 EYES Problem Types: CWE-798 Description: Files present on firmware images could allow an attacker to gain unauthorized access as a root user using hard-coded credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-11 - https://birddog.tv/downloads/
CVE ID: CVE-2023-2505 State: PUBLISHED Published: 2023-05-22T21:01:56.372Z Last Updated: 2025-01-16T21:33:05.853Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: BirdDog Products: STUDIO R3, 4K QUAD, MINI, A300 EYES Problem Types: CWE-352 Description: The affected products have a CSRF vulnerability that could allow an attacker to execute code and upload malicious files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-11 - https://birddog.tv/downloads/
CVE ID: CVE-2023-2507 State: PUBLISHED Published: 2023-07-15T18:45:18.866Z Last Updated: 2025-09-24T14:10:13.526Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: CleverTap Products: Cordova Plugin Problem Types: CWE-79 Description: CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker. This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/maiden/ -
st Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/maiden/ - https://github.com/CleverTap/clevertap-cordova - https://github.com/CleverTap/clevertap-cordova/releases/tag/2.7.0