Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
l-tour-builder-lite/tags/1.8.0/includes/plugin.php#L439 - https://plugins.trac.wordpress.org/changeset/2980553/ipanorama-360-virtual-tour-builder-lite#file1
CVE ID: CVE-2023-5337 State: PUBLISHED Published: 2023-10-20T07:29:27.446Z Last Updated: 2025-02-05T19:05:16.734Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: formforall Products: Contact form Form For All – Easy to use, fast, 37 languages. Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Contact form Form For All plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formforall' shortcode in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers wi
nput sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/abe2f596-b2c3-49d3-b646-0f4b64f15674?source=cve - https://plugins.trac.wordpress.org/browser/formforall/trunk/formforall_common.php#L21
CVE ID: CVE-2023-5338 State: PUBLISHED Published: 2023-11-22T15:33:30.652Z Last Updated: 2024-11-20T18:53:08.850Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeblvd Products: Theme Blvd Shortcodes Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Theme Blvd Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject a
attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/88809668-ea6b-41df-b2a7-ffe03a931c86?source=cve - https://plugins.trac.wordpress.org/browser/theme-blvd-shortcodes/tags/1.6.8/includes/class-tb-column-shortcode.php#L97
CVE ID: CVE-2023-5339 State: PUBLISHED Published: 2023-10-17T09:30:41.612Z Last Updated: 2024-09-05T19:46:10.145Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-200 Description: Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation resulting in logging all keystrokes including password entry being logged. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-5340 State: PUBLISHED Published: 2023-11-20T18:55:01.256Z Last Updated: 2024-11-21T19:11:43.377Z Vendors: Unknown Products: Five Star Restaurant Menu and Food Ordering Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Five Star Restaurant Menu and Food Ordering WordPress plugin before 2.4.11 unserializes user input via an AJAX action available to unauthenticated users, allowing them to perform PHP Object Injection when a suitable gadget is present on the blog. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/91a5847a-62e7-4b98-a554-5eecb6a06e5b
CVE ID: CVE-2023-5341 State: PUBLISHED Published: 2023-11-19T09:20:12.642Z Last Updated: 2025-11-20T17:58:36.783Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-416 Description: A heap use-after-free flaw was found in coders/bmp.c in ImageMagick. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-5341 - https://bugzilla.redhat.com/show_bug.cgi?id=2241774 - https://github.com/ImageMagick/ImageMagick/commit/aa673b2e4defc7cad5bec16c4fc8324f71e531f1
CVE ID: CVE-2023-5342 State: PUBLISHED Published: 2025-08-15T12:06:35.309Z Last Updated: 2025-08-15T12:57:37.246Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-324 Description: The Fedora Secure Boot CA certificate shipped with shim in Fedora was expired which could lead to old or invalid signed boot components being loaded. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-5342 - https://bodhi.fedoraproject.org/updates/FEDORA-2024-2aa28a4cfc - htt
ps://access.redhat.com/security/cve/CVE-2023-5342 - https://bodhi.fedoraproject.org/updates/FEDORA-2024-2aa28a4cfc - https://bugzilla.redhat.com/show_bug.cgi?id=2198977 - https://bugzilla.redhat.com/show_bug.cgi?id=2388707
CVE ID: CVE-2023-5343 State: PUBLISHED Published: 2023-11-20T18:55:12.772Z Last Updated: 2024-09-09T18:15:08.326Z Vendors: Unknown Products: Popup box Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/74613b38-48f2-43d5-bae5-25c89ba7db6e
CVE ID: CVE-2023-5344 State: PUBLISHED Published: 2023-10-02T19:20:30.352Z Last Updated: 2025-11-03T20:36:21.333Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1969. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/530cb762-899e-48d7-b50e-dad09eb775bf - https://github.com/vim/vim/commit/3bd7fa12e146c6051490d048a4acbfba974eeb04 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4W665GQBN6S6ZDMYWVF4X7KMFI7AQKJL/ - https://l
project.org/archives/list/package-announce@lists.fedoraproject.org/message/4W665GQBN6S6ZDMYWVF4X7KMFI7AQKJL/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZOXBUJLJ5VSPN3YXWN7XZA4JDYKNE7GZ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XPT7NMYJRLBPIALGSE24UWTY6F774GZW/ - https://support.apple.com/kb/HT214038 - https://support.apple.com/kb/HT214036 - https://support.apple.com/kb/HT214037 - http://seclists.org/fulldisclosure/2023/Dec/9 - http://seclists.org/fulldisclosure/2023/Dec/10 - http://seclists.org/fulldisclosure/2023/Dec/11
CVE ID: CVE-2023-5345 State: PUBLISHED Published: 2023-10-03T02:33:06.684Z Last Updated: 2025-02-27T20:48:41.186Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Kernel Problem Types: CWE-416 Description: A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation. In case of an error in smb3_fs_context_parse_param, ctx->password was freed but the field was not set to NULL which could lead to double free. We recommend upgrading past commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
f686caf0c2e11819a886d705. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e6e43b8aa7cd3c3af686caf0c2e11819a886d705 - https://kernel.dance/e6e43b8aa7cd3c3af686caf0c2e11819a886d705 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V5PDNWPKAP3WL5RQZ4RIDS6MG32OHH5R/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GISYSL3F6WIEVGHJGLC2MFNTUXHPTKQH/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GPMICQ2HVZO5UAM5KPXHAZKA2U3ZDOO6/ - http:/
oraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GPMICQ2HVZO5UAM5KPXHAZKA2U3ZDOO6/ - http://packetstormsecurity.com/files/177029/Kernel-Live-Patch-Security-Notice-LSN-0100-1.html
CVE ID: CVE-2023-5346 State: PUBLISHED Published: 2023-10-05T17:13:03.435Z Last Updated: 2025-05-01T19:57:30.432Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type confusion in V8 in Google Chrome prior to 117.0.5938.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop.html - https://crbug.com/1485829 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BMFDRMWMT6ZBLGLLWSWHHRA
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BMFDRMWMT6ZBLGLLWSWHHRAUBOSUXQDR/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RA6HMWNOYQ56R35MHW77GVW7373Z4RSN/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-5347 State: PUBLISHED Published: 2024-01-09T09:54:59.664Z Last Updated: 2025-10-08T09:10:00.840Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Korenix Products: JetNet Series Problem Types: CWE-347, CWE-327 Description: An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system including Trusted Executables. This issue affects JetNet devices older than firmware version 2024/01. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.beijerelectronics.com/en/support/Help___online?docId=69947 - htt
ner: - CISA ADP Vulnrichment: References: - https://www.beijerelectronics.com/en/support/Help___online?docId=69947 - https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetnet-series/ - http://seclists.org/fulldisclosure/2024/Jan/11 - http://packetstormsecurity.com/files/176550/Korenix-JetNet-Series-Unauthenticated-Access.html
CVE ID: CVE-2023-5348 State: PUBLISHED Published: 2023-12-18T20:07:59.959Z Last Updated: 2024-08-02T07:52:08.586Z Vendors: Unknown Products: Product Catalog Mode For WooCommerce Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b37b09c1-1b53-471c-9b10-7d2d05ae11f1
CVE ID: CVE-2023-5349 State: PUBLISHED Published: 2023-10-30T20:27:59.972Z Last Updated: 2025-11-04T19:25:47.023Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a, Red Hat, Fedora Products: rmagick, Red Hat 3scale API Management Platform 2, Fedora Problem Types: CWE-401 Description: A memory leak flaw was found in ruby-magick, an interface between Ruby and ImageMagick. This issue can lead to a denial of service (DOS) by memory exhaustion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-5349 - https://bugzilla.redhat.com/show_bug.cgi?id=2247064 - https://github.com/rm
cess.redhat.com/security/cve/CVE-2023-5349 - https://bugzilla.redhat.com/show_bug.cgi?id=2247064 - https://github.com/rmagick/rmagick/issues/1401 - https://github.com/rmagick/rmagick/pull/1406 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S3XMQ2KWPYGT447EKPENGXXHKAQ5NUWF/
CVE ID: CVE-2023-5350 State: PUBLISHED Published: 2023-10-03T11:45:41.765Z Last Updated: 2024-09-19T20:17:01.376Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: salesagility Products: salesagility/suitecrm Problem Types: CWE-89 Description: SQL Injection in GitHub repository salesagility/suitecrm prior to 7.14.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/c56563cb-b74e-4174-a09a-cd07689d6736 - https://github.com/salesagility/suitecrm/commit/c43eaa311fb010b7928983e6afc6f9075c3996aa
CVE ID: CVE-2023-5351 State: PUBLISHED Published: 2023-10-03T11:58:01.156Z Last Updated: 2024-09-19T20:16:27.783Z Severity: HIGH (CVSS 8.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: salesagility Products: salesagility/suitecrm Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm prior to 7.14.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/f7c7fcbc-5421-4a29-9385-346a1caa485b - https://github.com/salesagility/suitecrm/commit/c43eaa311fb010b7928983e6afc6f9075c3996aa
CVE ID: CVE-2023-5352 State: PUBLISHED Published: 2023-11-06T20:40:54.117Z Last Updated: 2025-02-26T21:20:28.800Z Vendors: Unknown Products: Awesome Support Problem Types: CWE-284 Improper Access Control Description: The Awesome Support WordPress plugin before 6.1.5 does not correctly authorize the wpas_edit_reply function, allowing users to edit posts for which they do not have permission. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d32b2136-d923-4f36-bd76-af4578deb23b
CVE ID: CVE-2023-5353 State: PUBLISHED Published: 2023-10-03T12:15:20.097Z Last Updated: 2024-09-12T14:36:28.122Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: salesagility Products: salesagility/suitecrm Problem Types: CWE-284 Description: Improper Access Control in GitHub repository salesagility/suitecrm prior to 7.14.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/3b3bb4f1-1aea-4134-99eb-157f245fa752 - https://github.com/salesagility/suitecrm/commit/c43eaa311fb010b7928983e6afc6f9075c3996aa
CVE ID: CVE-2023-5354 State: PUBLISHED Published: 2023-11-06T20:40:28.644Z Last Updated: 2025-02-26T21:18:23.274Z Vendors: Unknown Products: Awesome Support Problem Types: CWE-284 Improper Access Control, CWE-79 Cross-Site Scripting (XSS) Description: The Awesome Support WordPress plugin before 6.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/aa380524-031d-4e49-9d0b-96e62d54557f
CVE ID: CVE-2023-5355 State: PUBLISHED Published: 2023-11-06T20:41:57.821Z Last Updated: 2025-03-24T18:01:12.971Z Vendors: Unknown Products: Awesome Support Problem Types: CWE-284 Improper Access Control Description: The Awesome Support WordPress plugin before 6.1.5 does not sanitize file paths when deleting temporary attachment files, allowing a ticket submitter to delete arbitrary files on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d6f7faca-dacf-4455-a837-0404803d0f25
CVE ID: CVE-2023-5356 State: PUBLISHED Published: 2024-01-12T13:56:51.714Z Last Updated: 2025-11-20T04:10:38.291Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/427154 - https://hack
am Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/427154 - https://hackerone.com/reports/2188868
CVE ID: CVE-2023-5357 State: PUBLISHED Published: 2023-10-04T01:52:38.787Z Last Updated: 2025-02-05T19:17:21.937Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: esemono Products: Instagram for WordPress Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Instagram for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject
ed attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3991d8d0-57a8-42e7-a53c-97508f7e137f?source=cve - https://plugins.trac.wordpress.org/browser/instagram-for-wordpress/tags/2.1.6/templates/instagramPost.php#L12
CVE ID: CVE-2023-5358 State: PUBLISHED Published: 2023-11-01T17:17:31.501Z Last Updated: 2024-09-06T18:40:19.905Z Vendors: Devolutions Products: Devolutions Server Description: Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0 and earlier allows attackers to retrieve logs from vaults or entries they are not allowed to access via the report request url query parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2023-0019/
CVE ID: CVE-2023-5359 State: PUBLISHED Published: 2024-09-24T07:30:45.348Z Last Updated: 2024-09-24T13:37:04.524Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: boldgrid Products: W3 Total Cache Problem Types: CWE-200 Description: The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google OAuth API secrets stored in plaintext in the publicly visible plugin source. This can allow unauthenticated attackers to impersonate W3 Total Cache and gain access to user account information in successful conditions. This would not impact the WordPress users site in any way. Additional Analyst No
t information in successful conditions. This would not impact the WordPress users site in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2d89a534-978e-4fd8-be3a-5137bdc22dc9?source=cve - https://plugins.trac.wordpress.org/browser/w3-total-cache/trunk/PageSpeed_Api.php#L39 - https://plugins.trac.wordpress.org/changeset/3156426/w3-total-cache/tags/2.7.6/PageSpeed_Api.php
CVE ID: CVE-2023-5360 State: PUBLISHED Published: 2023-10-31T13:54:42.111Z Last Updated: 2025-02-13T17:20:09.225Z Vendors: Unknown Products: Royal Elementor Addons and Templates Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/281518ff-7816-4007-b712-63aed7828b34 - http://packetstormsecurity.com/files/175992/WordPress-Royal-Elementor-Addons-And-Templates
7816-4007-b712-63aed7828b34 - http://packetstormsecurity.com/files/175992/WordPress-Royal-Elementor-Addons-And-Templates-Remote-Shell-Upload.html
CVE ID: CVE-2023-5361 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:31.776Z Description: No description available.
CVE ID: CVE-2023-5362 State: PUBLISHED Published: 2023-10-30T13:49:01.699Z Last Updated: 2025-02-05T18:54:47.364Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: spicethemes Products: Carousel, Recent Post Slider and Banner Slider Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Carousel, Recent Post Slider and Banner Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'spice_post_slider' shortcode in versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat
insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c0dd70b9-6f8a-41fc-ab4f-f6cdfee8dfb8?source=cve - https://plugins.trac.wordpress.org/browser/spice-post-slider/tags/1.9/include/view/shortcode.php#L102 - https://plugins.trac.wordpress.org/changeset/2981654/spice-post-slider - https://plugins.trac.wordpress.org/browser/sp
- https://plugins.trac.wordpress.org/changeset/2981654/spice-post-slider - https://plugins.trac.wordpress.org/browser/spice-post-slider/tags/2.0.1/include/view/shortcode.php?rev=2981648#L102
CVE ID: CVE-2023-5363 State: PUBLISHED Published: 2023-10-24T15:31:40.890Z Last Updated: 2025-11-03T21:50:37.158Z Vendors: OpenSSL Products: OpenSSL Problem Types: CWE-684 Description: Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result in non-uniqueness, which could result in loss of confidentiality for some cipher modes. When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after the key and IV have been established.
nit_ex2() or EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after the key and IV have been established. Any alterations to the key length, via the "keylen" parameter or the IV length, via the "ivlen" parameter, within the OSSL_PARAM array will not take effect as intended, potentially causing truncation or overreading of these values. The following ciphers and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB. For the CCM, GCM and OCB cipher modes, truncation of the IV can result in loss of confidentiality. For example, when following NIST's SP 800-38D section 8.2.1 guidance for constructing a deterministic IV for AES in GCM mode, truncation of the counter portion co