Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
blic and may be used. The identifier of this vulnerability is VDB-234244. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.234244 - https://vuldb.com/?ctiid.234244 - https://github.com/tangyi19/Life-Insurance-Management-System/blob/main/Life%20Insurance%20Management%20System%20login.php%20has%20Sqlinjection.pdf
CVE ID: CVE-2023-3694 State: PUBLISHED Published: 2023-07-16T23:31:03.759Z Last Updated: 2025-03-04T16:44:17.978Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester, projectworlds Products: House Rental and Property Listing Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in SourceCodester/projectworlds House Rental and Property Listing 1.0. This issue affects some unknown processing of the file /index.php. The manipulation of the argument keywords/location leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - C
k may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.234245 - https://vuldb.com/?ctiid.234245 - https://vuldb.com/?submit.183316 - https://github.com/safetom6/House-Rental-and-Property-Listing-System/blob/main/House%20Rental%20and%20Property%20Listing%20System%20index.php%20has%20Sqlinjection.pdf
CVE ID: CVE-2023-3695 State: PUBLISHED Published: 2023-07-17T00:31:03.813Z Last Updated: 2024-11-21T15:53:10.271Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Beauty Salon Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in Campcodes Beauty Salon Management System 1.0. Affected is an unknown function of the file add-product.php. The manipulation of the argument category leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-234252. Additional Analyst Notes: - CVE Program Container
c and may be used. The identifier of this vulnerability is VDB-234252. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.234252 - https://vuldb.com/?ctiid.234252 - https://github.com/E1CHO/cve_hub/blob/main/Beauty%20Salon%20Management%20System%20-%20vuln%201.pdf
CVE ID: CVE-2023-3696 State: PUBLISHED Published: 2023-07-17T00:00:21.160Z Last Updated: 2024-10-30T14:16:54.986Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H) Vendors: automattic Products: automattic/mongoose Problem Types: CWE-1321 Description: Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/1eef5a72-f6ab-4f61-b31d-fc66f5b4b467 - https://github.com/automattic/mongoose/commit/305ce4ff789261df7e3f6e72363d0703e025f80d
CVE ID: CVE-2023-3697 State: PUBLISHED Published: 2023-08-17T09:33:46.822Z Last Updated: 2024-10-08T17:27:28.080Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: ASUSTOR Products: ADM Problem Types: CWE-22 Description: Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended directory structure and create files. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.asustor.com/security/security_advisory_detail?id=28
CVE ID: CVE-2023-3698 State: PUBLISHED Published: 2023-08-17T09:34:53.301Z Last Updated: 2024-10-08T17:23:46.411Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: ASUSTOR Products: ADM Problem Types: CWE-22 Description: Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.asustor.com/security/security_advisory_detail?id=28
CVE ID: CVE-2023-3699 State: PUBLISHED Published: 2023-08-22T08:57:21.718Z Last Updated: 2024-10-02T20:09:53.930Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: ASUSTOR Products: ADM Problem Types: CWE-269 Description: An Improper Privilege Management vulnerability was found in ASUSTOR Data Master (ADM) allows an unprivileged local users to modify the storage devices configuration. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.asustor.com/security/security_advisory_detail?id=29
CVE ID: CVE-2023-3700 State: PUBLISHED Published: 2023-07-17T06:16:21.610Z Last Updated: 2024-10-30T14:53:42.301Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: alextselegidis Products: alextselegidis/easyappointments Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/e8d530db-a6a7-4f79-a95d-b77654cc04f8 - https://github.com/alextselegidis/easyappointments/commit/b37b46019553089db4f22eb2fe998bca84b2cb64
CVE ID: CVE-2023-3701 State: PUBLISHED Published: 2023-10-04T10:56:36.903Z Last Updated: 2024-09-19T19:22:08.623Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Aqua eSolutions Products: Aqua Drive Problem Types: CWE-23 Description: Aqua Drive, in its 2.4 version, is vulnerable to a relative path traversal vulnerability. By exploiting this vulnerability, an authenticated non privileged user could access/modify stored resources of other users. It could also be possible to access and modify the source and configuration files of the cloud disk platform, affecting the integrity and availability of the entire platform. Additional Analyst Notes: - CVE Program C
isk platform, affecting the integrity and availability of the entire platform. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/relative-path-traversal-aqua-esolutions
CVE ID: CVE-2023-3703 State: PUBLISHED Published: 2023-09-03T14:19:26.169Z Last Updated: 2024-09-30T20:46:08.395Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Proscend Advice Products: ICR Series routers FW Problem Types: CWE-1392 Description: Proscend Advice ICR Series routers FW version 1.76 - CWE-1392: Use of Default Credentials Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2023-3704 State: PUBLISHED Published: 2023-08-24T06:42:48.928Z Last Updated: 2024-10-04T19:09:43.379Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Aditya Infotech Limited Products: CP-UVR-1601E1-HC, CP-UVR-1601E2-H, CP-UVR-1601E1-H, CP-UVR-0801F1-HC, CP-UVR-0801K1-H, CP-UVR-0801K1B-H, CP-UVR-0808K1-H, CP-UVR-0401L1-4KH, CP-UVR-0401L1B-4KH Description: The vulnerability exists in CP-Plus DVR due to an improper input validation within the web-based management interface of the affected products. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device. Successful explo
r could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device. Successful exploitation of this vulnerability could allow the remote attacker to change system time of the targeted device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0240
CVE ID: CVE-2023-3705 State: PUBLISHED Published: 2023-08-24T07:03:12.395Z Last Updated: 2024-10-02T20:33:29.083Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Aditya Infotech Limited Products: CP-VNR-3104, CP-VNR-3108, CP-VNR-3208 Problem Types: CWE-200 Description: The vulnerability exists in CP-Plus NVR due to an improper input handling at the web-based management interface of the affected product. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device. Successful exploitation of this vulnerability could allow the remote attacker to obtain sensitive information on the targete
essful exploitation of this vulnerability could allow the remote attacker to obtain sensitive information on the targeted device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0239
CVE ID: CVE-2023-3706 State: PUBLISHED Published: 2023-10-16T19:39:15.786Z Last Updated: 2025-04-23T16:11:55.074Z Vendors: Unknown Products: ActivityPub Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the title of arbitrary post (such as draft and private) via an IDOR vector Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/daa4d93a-f8b1-4809-a18e-8ab63a05de5a
CVE ID: CVE-2023-3707 State: PUBLISHED Published: 2023-10-16T19:39:12.296Z Last Updated: 2025-04-23T16:12:12.691Z Vendors: Unknown Products: ActivityPub Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the content of arbitrary post (such as draft and private) via an IDOR vector. Password protected posts are not affected by this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/541bbe
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/541bbe4c-3295-4073-901d-763556269f48
CVE ID: CVE-2023-3708 State: PUBLISHED Published: 2023-07-18T02:01:06.298Z Last Updated: 2025-02-05T19:39:34.773Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: deothemes, Deothemes Products: Everse, Nokke, MedikAid | Medical Health Care RTL WordPress Theme, Arendelle, Amela Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip
put sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1b8b0f14-f31a-45cd-bb98-0b717059aa80?source=cve - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=196757%40amela&new=196757%40amela&sfp_email=&sfph_mail= - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=196756%40arendelle&new=196756%40arendelle&sfp_e
/themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=196756%40arendelle&new=196756%40arendelle&sfp_email=&sfph_mail= - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=196755%40nokke&new=196755%40nokke&sfp_email=&sfph_mail= - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=196758%40everse&new=196758%40everse&sfp_email=&sfph_mail= - https://deothemes.com/changelog/medikaid-changelog/
CVE ID: CVE-2023-3709 State: PUBLISHED Published: 2023-07-18T02:01:08.770Z Last Updated: 2025-02-05T19:39:28.123Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: wproyal Products: Royal Elementor Addons and Templates Problem Types: CWE-200 Information Exposure Description: The Royal Elementor Addons plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 1.3.70 due to the plugin adding the API key to the source code of any page running the MailChimp block. This makes it possible for unauthenticated attackers to obtain a site's MailChimp API key. We recommend resetting any MailChimp API keys if running a vuln
nticated attackers to obtain a site's MailChimp API key. We recommend resetting any MailChimp API keys if running a vulnerable version of this plugin with the MailChimp block enabled as the API key may have been compromised. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/86c9bcf1-c69e-47ca-b74b-8ce6157f520b?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2938619%40royal-elementor-addons&new=2936984%40royal-elementor-addons&sfp_email=&sfph_mail=
CVE ID: CVE-2023-3710 State: PUBLISHED Published: 2023-09-12T19:55:41.805Z Last Updated: 2025-09-12T19:31:57.851Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H) Vendors: Honeywell Products: PM23/43, PC23/43, PD43, PM42, PX4ie/6ie, PX45/65, PD45, PX240, PX940, PM45, RP2f/RP4f Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vu
ective printers to version MR19.5 (e.g. P10.19.050006). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.honeywell.com/us/en/product-security - https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwaresignedP1019050004 - https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwarexasignedP1019050004A
CVE ID: CVE-2023-3711 State: PUBLISHED Published: 2023-09-12T19:57:50.393Z Last Updated: 2025-09-12T19:32:41.660Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L) Vendors: Honeywell Products: PM23/43, PC23/43, PD43, PM42, PX4ie/6ie, PX45/65, PD45, PX240, PX940, PM45, RP2f/RP4f Problem Types: CWE-384 Description: Session Fixation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Session Credential Falsification through Prediction.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006). Additional Analyst Notes: - CVE Program
ware version of the respective printers to version MR19.5 (e.g. P10.19.050006). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.honeywell.com/us/en/product-security - https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwaresignedP1019050004 - https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwarexasignedP1019050004A
CVE ID: CVE-2023-3712 State: PUBLISHED Published: 2023-09-12T19:59:00.396Z Last Updated: 2025-09-12T19:33:38.362Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Honeywell Products: PM23/43, PC23/43, PD43, PM42, PX4ie/6ie, PX45/65, PD45, PX240, PX940, PM45, RP2f/RP4f Problem Types: CWE-552 Description: Files or Directories Accessible to External Parties vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Privilege Escalation.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006). Additional Analyst Notes: - CVE Prog
firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.honeywell.com/us/en/product-security - https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwaresignedP1019050004 - https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwarexasignedP1019050004A
CVE ID: CVE-2023-3713 State: PUBLISHED Published: 2023-07-18T02:39:25.094Z Last Updated: 2025-02-05T19:39:22.073Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: metagauss Products: ProfileGrid – User Profiles, Memberships, Groups and Communities Problem Types: CWE-862 Missing Authorization Description: The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'profile_magic_check_smtp_connection' function in versions up to, and including, 5.5.1. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update the site options arbitrarily. This can be
authenticated attackers, with subscriber-level permissions or above to update the site options arbitrarily. This can be used by attackers to achieve privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/473ba791-af99-4aae-99cb-ccf220e443e7?source=cve - https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.4.8/admin/class-profile-magic-admin.php#L599 - https://plugins.trac.wordpress.org/changeset/2938904/profilegrid-user-profiles-groups-and-communities#file0
CVE ID: CVE-2023-3714 State: PUBLISHED Published: 2023-07-18T02:39:25.531Z Last Updated: 2025-02-05T19:39:14.483Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: metagauss Products: ProfileGrid – User Profiles, Memberships, Groups and Communities Problem Types: CWE-862 Missing Authorization Description: The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'edit_group' handler in versions up to, and including, 5.5.2. This makes it possible for authenticated attackers, with group ownership, to update group options, including the 'associate_role' parameter, which defines the member's role
with group ownership, to update group options, including the 'associate_role' parameter, which defines the member's role. This issue was partially patched in version 5.5.2 preventing privilege escalation, however, it was fully patched in 5.5.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a4766651-92a6-42c9-81bc-7ea25350f561?source=cve - https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.4.8/public/partials/profile-magic-group.php#L80 - https://plugins.trac.wordpress.org/changeset/2938904/profilegrid-user-profiles-groups-and-communities#file4
p.php#L80 - https://plugins.trac.wordpress.org/changeset/2938904/profilegrid-user-profiles-groups-and-communities#file4 - https://plugins.trac.wordpress.org/changeset/2939344/profilegrid-user-profiles-groups-and-communities/trunk/public/partials/profile-magic-group.php
CVE ID: CVE-2023-3716 State: PUBLISHED Published: 2023-08-08T11:02:50.114Z Last Updated: 2024-10-10T16:25:14.799Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Oduyo Products: Online Collection Software Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oduyo Online Collection Software allows SQL Injection.This issue affects Online Collection Software: before 1.0.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0442
CVE ID: CVE-2023-3717 State: PUBLISHED Published: 2023-08-08T10:46:36.651Z Last Updated: 2024-10-10T16:26:19.977Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Farmakom Products: Remote Administration Console Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Farmakom Remote Administration Console allows SQL Injection.This issue affects Remote Administration Console: before 1.02. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0441
CVE ID: CVE-2023-3718 State: PUBLISHED Published: 2023-08-01T18:25:10.262Z Last Updated: 2024-10-22T20:29:41.391Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba CX Switches Description: An authenticated command injection vulnerability exists in the AOS-CX command line interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands on the underlying operating system as a privileged user on the affected switch. This allows an attacker to fully compromise the underlying operating system on the device running AOS-CX. Additional Analyst Notes: - CVE Program Container: -
mise the underlying operating system on the device running AOS-CX. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-010.txt
CVE ID: CVE-2023-3720 State: PUBLISHED Published: 2023-08-30T14:22:00.303Z Last Updated: 2025-05-05T12:38:18.941Z Vendors: Unknown Products: Upload Media By URL Problem Types: CWE-352 Cross-Site Request Forgery (CSRF), CWE-79 Cross-Site Scripting (XSS) Description: The Upload Media By URL WordPress plugin before 1.0.8 does not have CSRF check when uploading files, which could allow attackers to make logged in admins upload files (including HTML containing JS code for users with the unfiltered_html capability) on their behalf. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/16375a7f-0a9f-4961-8510-d047ffbf3954
CVE ID: CVE-2023-3721 State: PUBLISHED Published: 2023-08-14T19:10:15.596Z Last Updated: 2025-05-05T15:53:57.682Z Vendors: Unknown Products: WP-EMail Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP-EMail WordPress plugin before 2.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3f90347a-6586-4648-9f2c-d4f321bf801a