Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-28418 State: PUBLISHED Published: 2023-06-22T12:00:47.306Z Last Updated: 2024-10-10T17:21:54.009Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Yudlee themes Products: Mediciti Lite Problem Types: CWE-79 Description: Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Yudlee themes Mediciti Lite theme <= 1.3.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mediciti-lite/wordpress-mediciti-lite-theme-1-3-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28419 State: PUBLISHED Published: 2023-11-12T22:15:02.539Z Last Updated: 2024-08-30T14:32:11.170Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Stranger Studios Products: Force First and Last Name as Display Name Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Stranger Studios Force First and Last Name as Display Name plugin <= 1.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/force-first-last/wordpress-force-first-and-last-name-as-display-name-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s
rst-last/wordpress-force-first-and-last-name-as-display-name-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-28420 State: PUBLISHED Published: 2023-11-12T22:11:08.983Z Last Updated: 2024-08-30T14:32:40.761Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Leo Caseiro Products: Custom Options Plus Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Leo Caseiro Custom Options Plus plugin <= 1.8.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/custom-options-plus/wordpress-custom-options-plus-plugin-1-8-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-28421 State: PUBLISHED Published: 2023-12-21T14:11:31.887Z Last Updated: 2024-11-20T20:19:41.750Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Winwar Media Products: WordPress Email Marketing Plugin – WP Email Capture Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Winwar Media WordPress Email Marketing Plugin – WP Email Capture.This issue affects WordPress Email Marketing Plugin – WP Email Capture: from n/a through 3.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-email-capture/wor
ram Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-email-capture/wordpress-wp-email-capture-plugin-3-10-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2023-28422 State: PUBLISHED Published: 2023-03-23T11:45:07.840Z Last Updated: 2025-01-10T19:18:08.780Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: MagePeople Team Products: Event Manager and Tickets Selling Plugin for WooCommerce Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6. versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mage-eventpress/wordpress-event-manager-for-woocommerce-plugin-3-8-6-cross-site-scripting-
ck.com/database/vulnerability/mage-eventpress/wordpress-event-manager-for-woocommerce-plugin-3-8-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28423 State: PUBLISHED Published: 2023-06-22T08:09:08.118Z Last Updated: 2024-10-10T17:26:12.177Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Prism Tech Studios Products: Modern Footnotes Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Prism Tech Studios Modern Footnotes plugin <= 1.4.15 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/modern-footnotes/wordpress-modern-footnotes-plugin-1-4-15-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28424 State: PUBLISHED Published: 2023-03-20T12:47:13.250Z Last Updated: 2025-02-25T14:52:46.552Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: gentoo Products: soko Problem Types: CWE-89 Description: Soko if the code that powers packages.gentoo.org. Prior to version 1.0.2, the two package search handlers, `Search` and `SearchFeed`, implemented in `pkg/app/handler/packages/search.go`, are affected by a SQL injection via the `q` parameter. As a result, unauthenticated attackers can execute arbitrary SQL queries on `https://packages.gentoo.org/`. It was also demonstrated that primitive was enough to gain code execution in the context of th
://packages.gentoo.org/`. It was also demonstrated that primitive was enough to gain code execution in the context of the PostgreSQL container. The issue was addressed in commit `4fa6e4b619c0362728955b6ec56eab0e0cbf1e23y` of version 1.0.2 using prepared statements to interpolate user-controlled data in SQL queries. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gentoo/soko/security/advisories/GHSA-gc2x-86p3-mxg2 - https://gitweb.gentoo.org/sites/soko.git/commit/?id=4fa6e4b619c0362728955b6ec56eab0e0cbf1e23 - https://www.sonarsource.com/blog/why-orms-and-prepared-statements-cant-always-win
CVE ID: CVE-2023-28425 State: PUBLISHED Published: 2023-03-20T19:03:37.983Z Last Updated: 2025-02-25T14:52:01.127Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: redis Products: redis Problem Types: CWE-77 Description: Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/redis/redis/security/advisories/GHSA-mvmm-4vq6-vw8c - https
r: - CISA ADP Vulnrichment: References: - https://github.com/redis/redis/security/advisories/GHSA-mvmm-4vq6-vw8c - https://github.com/redis/redis/commit/48e0d4788434833b47892fe9f3d91be7687f25c9 - https://github.com/redis/redis/releases/tag/7.0.10 - https://security.netapp.com/advisory/ntap-20230413-0005/
CVE ID: CVE-2023-28426 State: REJECTED Published: N/A Last Updated: 2023-03-23T00:00:00 Description: No description available.
CVE ID: CVE-2023-28427 State: PUBLISHED Published: 2023-03-28T20:32:22.116Z Last Updated: 2025-02-18T20:03:47.555Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: matrix-org Products: matrix-js-sdk Problem Types: CWE-1321 Description: matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consum
he matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr - https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0 - https://www.debian.org/security/2023/dsa-5392 - https://lists.debian.o
atrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0 - https://www.debian.org/security/2023/dsa-5392 - https://lists.debian.org/debian-lts-announce/2023/04/msg00027.html - https://security.gentoo.org/glsa/202305-36
CVE ID: CVE-2023-28428 State: PUBLISHED Published: 2023-03-20T14:51:43.619Z Last Updated: 2025-02-25T14:52:33.971Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: michaelrsweet Products: pdfio Problem Types: CWE-770 Description: PDFio is a C library for reading and writing PDF files. In versions 1.1.0 and prior, a denial of service vulnerability exists in the pdfio parser. Crafted pdf files can cause the program to run at 100% utilization and never terminate. This is different from CVE-2023-24808. A patch for this issue is available in version 1.1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/
ion 1.1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/michaelrsweet/pdfio/security/advisories/GHSA-68x8-9phf-j7jf - https://github.com/michaelrsweet/pdfio/commit/97d4955666779dc5b0665e15dd951a5c12426a31
CVE ID: CVE-2023-28429 State: PUBLISHED Published: 2023-03-20T14:54:21.856Z Last Updated: 2025-02-25T14:52:23.103Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: pimcore Products: pimcore Problem Types: CWE-79 Description: Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 10.5.19 or, as a workaround, apply the patch manually. Additional Ana
r malicious sites. Users should upgrade to version 10.5.19 or, as a workaround, apply the patch manually. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pimcore/pimcore/security/advisories/GHSA-rcg9-hrhx-6q69 - https://github.com/pimcore/pimcore/pull/14574 - https://github.com/pimcore/pimcore/pull/14574.patch
CVE ID: CVE-2023-28430 State: PUBLISHED Published: 2023-03-27T21:11:26.243Z Last Updated: 2025-02-19T15:12:26.262Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: OneSignal Products: react-native-onesignal Problem Types: CWE-77 Description: OneSignal is an email, sms, push notification, and in-app message service for mobile apps.The Zapier.yml workflow is triggered on issues (types: [closed]) (i.e., when an Issue is closed). The workflow starts with full write-permissions GitHub repository token since the default workflow permissions on Organization/Repository level are set to read-write. This workflow runs the following step with data controlled by the commen
ization/Repository level are set to read-write. This workflow runs the following step with data controlled by the comment `(${{ github.event.issue.title }} – the full title of the Issue)`, allowing an attacker to take over the GitHub Runner and run custom commands, potentially stealing any secret (if used), or altering the repository. This issue was found with CodeQL using javascript’s Expression injection in Actions query. This issue has been addressed in the repositories github action. No actions are required by users. This issue is also tracked as `GHSL-2023-051`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advis
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2023-051_React_Native_OneSignal_SDK/ - https://github.com/OneSignal/react-native-onesignal/commit/4a66f4237fb51dcc2236889038d488cd49b0f433 - https://github.com/OneSignal/react-native-onesignal/commit/4e43bda4ce1eb395f36bb8a5640002523c051085
CVE ID: CVE-2023-28431 State: PUBLISHED Published: 2023-03-22T20:11:43.772Z Last Updated: 2025-02-25T14:51:25.647Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: paritytech Products: frontier Problem Types: CWE-682 Description: Frontier is an Ethereum compatibility layer for Substrate. Frontier's `modexp` precompile uses `num-bigint` crate under the hood. In the implementation prior to pull request 1017, the cases for modulus being even and modulus being odd are treated separately. Odd modulus uses the fast Montgomery multiplication, and even modulus uses the slow plain power algorithm. This gas cost discrepancy was not accounted for in the `modexp` precompil
n modulus uses the slow plain power algorithm. This gas cost discrepancy was not accounted for in the `modexp` precompile, leading to possible denial of service attacks. No fixes for `num-bigint` are currently available, and thus this issue is fixed in the short term by raising the gas costs for even modulus, and in the long term fixing it in `num-bigint` or switching to another modexp implementation. The short-term fix for Frontier is deployed at pull request 1017. There are no known workarounds aside from applying the fix. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/paritytech/frontier/security/advisories/GHSA-fcmm-54jp-7vf6
: - CISA ADP Vulnrichment: References: - https://github.com/paritytech/frontier/security/advisories/GHSA-fcmm-54jp-7vf6 - https://github.com/paritytech/frontier/pull/1017 - https://github.com/paritytech/frontier/commit/5af12e94d7dfc8a0208a290643a800f55de7b219 - https://github.com/rust-num/num-bigint/blob/6f2b8e0fc218dbd0f49bebb8db2d1a771fe6bafa/src/biguint/power.rs#L134
CVE ID: CVE-2023-28432 State: PUBLISHED Published: 2023-03-22T20:16:38.641Z Last Updated: 2025-10-21T23:15:22.503Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: minio Products: minio Problem Types: CWE-200 Description: Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z. Additional Analyst Notes: - CVE Progra
t are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q - https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z - https://twitter.com/Andrew___Morris/status/1639325397241278464 - https://viz.greynoise.io/tag/minio-information-disclosure-attempt - https://www.greynoise.io/blog/openai-minio-and-why-you-should-always-use-docker-cli-scan-to-keep-your-supply-chain-clean
CVE ID: CVE-2023-28433 State: PUBLISHED Published: 2023-03-22T20:33:43.452Z Last Updated: 2025-02-25T14:51:18.769Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: minio Products: minio Problem Types: CWE-668 Description: Minio is a Multi-Cloud Object Storage framework. All users on Windows prior to version RELEASE.2023-03-20T20-16-18Z are impacted. MinIO fails to filter the `\` character, which allows for arbitrary object placement across buckets. As a result, a user with low privileges, such as an access key, service account, or STS credential, which only has permission to `PutObject` in a specific bucket, can create an admin user. This issue is patched in RE
al, which only has permission to `PutObject` in a specific bucket, can create an admin user. This issue is patched in RELEASE.2023-03-20T20-16-18Z. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/minio/minio/security/advisories/GHSA-w23q-4hw3-2pp6 - https://github.com/minio/minio/commit/8d6558b23649f613414c8527b58973fbdfa4d1b8 - https://github.com/minio/minio/commit/b3c54ec81e0a06392abfb3a1ffcdc80c6fbf6ebc - https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z
CVE ID: CVE-2023-28434 State: PUBLISHED Published: 2023-03-22T20:44:04.216Z Last Updated: 2025-10-21T23:15:22.302Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: minio Products: minio Problem Types: CWE-269 Description: Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround,
n, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c - https://github.com/minio/minio/pull/16849 - https://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5
CVE ID: CVE-2023-28435 State: PUBLISHED Published: 2023-03-24T20:39:23.223Z Last Updated: 2025-02-19T20:45:43.293Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: dataease Products: dataease Problem Types: CWE-79 Description: Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in can upload directly to the background. The file type also goes unchecked, users could upload any type of file. These vulnerabilities has been fixed in version 1.18.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dataeas
.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-625h-q3g9-rffc - https://github.com/dataease/dataease/issues/4798
CVE ID: CVE-2023-28436 State: PUBLISHED Published: 2023-03-23T19:27:48.051Z Last Updated: 2025-02-25T14:50:44.790Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: tailscale Products: tailscale Problem Types: CWE-269 Description: Tailscale is software for using Wireguard and multi-factor authentication (MFA). A vulnerability identified in the implementation of Tailscale SSH starting in version 1.34.0 and prior to prior to 1.38.2 in FreeBSD allows commands to be run with a higher privilege group ID than that specified in Tailscale SSH access rules. A difference in the behavior of the FreeBSD `setgroups` system call from POSIX meant that the Tailscale client ru
rules. A difference in the behavior of the FreeBSD `setgroups` system call from POSIX meant that the Tailscale client running on a FreeBSD-based operating system did not appropriately restrict groups on the host when using Tailscale SSH. When accessing a FreeBSD host over Tailscale SSH, the egid of the tailscaled process was used instead of that of the user specified in Tailscale SSH access rules. Tailscale SSH commands may have been run with a higher privilege group ID than that specified in Tailscale SSH access rules if they met all of the following criteria: the destination node was a FreeBSD device with Tailscale SSH enabled; Tailscale SSH access rules permitted access for non-root users
ion node was a FreeBSD device with Tailscale SSH enabled; Tailscale SSH access rules permitted access for non-root users; and a non-interactive SSH session was used. Affected users should upgrade to version 1.38.2 to remediate the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tailscale/tailscale/security/advisories/GHSA-vfgq-g5x8-g595 - https://github.com/tailscale/tailscale/commit/d00c046b723dff6e3775d7d35f891403ac21a47d - https://github.com/tailscale/tailscale/releases/tag/v1.38.2 - https://tailscale.com/security-bulletins/#ts-2023-003
CVE ID: CVE-2023-28437 State: PUBLISHED Published: 2023-03-24T23:43:15.992Z Last Updated: 2025-02-19T20:36:49.277Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: dataease Products: dataease Problem Types: CWE-89 Description: Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. This vulnerability has been fixed in version 1.18.5. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-7j7j-9rw6-3r56 - https://github.com/dataease/dataease/issues/4795 - https
com/dataease/dataease/security/advisories/GHSA-7j7j-9rw6-3r56 - https://github.com/dataease/dataease/issues/4795 - https://github.com/dataease/dataease/releases/tag/v1.18.5
CVE ID: CVE-2023-28438 State: PUBLISHED Published: 2023-03-22T20:46:33.646Z Last Updated: 2025-02-25T14:51:11.306Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: pimcore Products: pimcore Problem Types: CWE-89 Description: Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch ma
click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pimcore/pimcore/security/advisories/GHSA-vf7q-g2pv-jxvx - https://github.com/pimcore/pimcore/pull/14526 - https://github.com/pimcore/pimcore/commit/d1abadb181c88ebaa4bce1916f9077469d4ea2bc.patch
CVE ID: CVE-2023-28439 State: PUBLISHED Published: 2023-03-22T20:55:00.208Z Last Updated: 2025-02-13T16:48:42.069Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ckeditor Products: ckeditor4 Problem Types: CWE-79 Description: CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages on a web page with missing proper Content Security Policy configuration; initializing the editor on an element and using an element other than
sing proper Content Security Policy configuration; initializing the editor on an element and using an element other than `<textarea>` as a base; and destroying the editor instance. This vulnerability might affect a small percentage of integrators that depend on dynamic editor initialization/destroy mechanism. A fix is available in CKEditor4 version 4.21.0. In some rare cases, a security fix may be considered a breaking change. Starting from version 4.21.0, the Iframe Dialog plugin applies the `sandbox` attribute by default, which restricts JavaScript code execution in the iframe element. To change this behavior, configure the `config.iframe_attributes` option. Also starting from version 4.21