Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
023/05/08/3 - https://security.netapp.com/advisory/ntap-20230703-0006/ - http://www.openwall.com/lists/oss-security/2024/04/24/3
CVE ID: CVE-2023-2599 State: PUBLISHED Published: 2023-06-09T05:33:21.361Z Last Updated: 2024-12-20T23:41:02.995Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: cyberlord92 Products: Active Directory Integration / LDAP Integration Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Active Directory Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to missing nonce verification on the get_users function and insufficient escaping on the user supplied parameter and lack of sufficient preparation on t
the get_users function and insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to cause resource exhaustion via a forged request granted they can trick an administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/74089b16-76fa-4654-9007-3f0c2e894894?source=cve - https://plugins.trac.wordpress.org/browser/ldap-login-for-intranet-sites/trunk/cla
a-4654-9007-3f0c2e894894?source=cve - https://plugins.trac.wordpress.org/browser/ldap-login-for-intranet-sites/trunk/class-mo-ldap-user-auth-reports.php?rev=2859403#L64 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2910898%40ldap-login-for-intranet-sites%2Ftrunk&old=2903294%40ldap-login-for-intranet-sites%2Ftrunk&sfp_email=&sfph_mail=#file5
CVE ID: CVE-2023-2600 State: PUBLISHED Published: 2023-06-19T10:52:47.286Z Last Updated: 2025-04-23T16:20:53.437Z Vendors: Unknown Products: Custom Base Terms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Custom Base Terms WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8e1d65c3-14e4-482f-ae9e-323e847a8613
CVE ID: CVE-2023-2601 State: PUBLISHED Published: 2023-06-27T13:17:12.040Z Last Updated: 2025-02-13T16:44:40.908Z Vendors: Unknown Products: wpbrutalai Problem Types: CWE-89 SQL Injection, CWE-352 Cross-Site Request Forgery (CSRF) Description: The wpbrutalai WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin via CSRF. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/57769468-3802-4985-bf5e-44ec1d59f5fd - http://packetstormsecurity.com/files/173732/WordPress-WP-Brutal-AI-Cross-Site-Request-Forgery-SQL-Injecti
44ec1d59f5fd - http://packetstormsecurity.com/files/173732/WordPress-WP-Brutal-AI-Cross-Site-Request-Forgery-SQL-Injection.html
CVE ID: CVE-2023-2602 State: PUBLISHED Published: 2023-06-06T00:00:00 Last Updated: 2024-08-02T06:26:09.688Z Vendors: n/a Products: libcap Problem Types: CWE-401 Description: A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2209114 - https://www.x41-dsec.de/static/reports/X41-libcap-Code-Review-2023-OSTIF-Final-Report.pdf - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPEGCFMCN5KGC
ort.pdf - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPEGCFMCN5KGCFX5Y2VTKR732TTD4ADW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZ57ICDLMVYEREXQGZWL4GWI7FRJCRQT/
CVE ID: CVE-2023-2603 State: PUBLISHED Published: 2023-06-06T00:00:00 Last Updated: 2024-08-02T06:26:09.726Z Vendors: n/a Products: libcap Problem Types: CWE-190 Description: A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4GiB. Additional Analyst Notes: - CVE Program Container: References: - https://www.x41-dsec.de/static/reports/X41-libcap-Code-Review-2023-OSTIF-Final-Report.pdf - https://bugzilla.redhat.com/show_bug.cgi?id=2209113 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPEGCFMCN5KGCFX5Y2VTKR732TTD4ADW/ - https://lists.fedor
archives/list/package-announce%40lists.fedoraproject.org/message/IPEGCFMCN5KGCFX5Y2VTKR732TTD4ADW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZ57ICDLMVYEREXQGZWL4GWI7FRJCRQT/
CVE ID: CVE-2023-2604 State: PUBLISHED Published: 2023-06-09T05:33:14.153Z Last Updated: 2025-02-05T19:43:17.592Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nik00726 Products: Team Circle Image Slider With Lightbox Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, and including, 1.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scri
nput sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2627ac2b-25a8-480d-ac83-ee0ca323b3a1?source=cve - https://plugins.trac.wordpress.org/changeset?old_path=%2Fcircle-image-slider-with-lightbox%2Ftags%2F1.0.17&old=2910236&new_path=%2Fcircle-image-slider-with-lightbox%2Ftags%2F1.0.18&new=2910236&sfp_email=&sfph_mail=
CVE ID: CVE-2023-2605 State: PUBLISHED Published: 2023-06-27T13:17:26.709Z Last Updated: 2025-02-13T16:44:45.276Z Vendors: Unknown Products: wpbrutalai Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The wpbrutalai WordPress plugin before 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/372cb940-71ba-4d19-b35a-ab15f8c2fdeb - http://packetstormsecurity.com/files/173734/WordPress-WP-Brutal-AI-Cross-Site-S
y/372cb940-71ba-4d19-b35a-ab15f8c2fdeb - http://packetstormsecurity.com/files/173734/WordPress-WP-Brutal-AI-Cross-Site-Scripting.html
CVE ID: CVE-2023-2606 State: PUBLISHED Published: 2023-08-14T19:10:23.250Z Last Updated: 2024-10-09T15:42:57.757Z Vendors: Unknown Products: WP Brutal AI Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Brutal AI WordPress plugin before 2.06 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/62deb3ed-a7e4-4cdc-a615-cad2ec2e1e8f
CVE ID: CVE-2023-2607 State: PUBLISHED Published: 2023-06-09T05:33:10.746Z Last Updated: 2024-12-23T16:19:54.982Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: themeisle Products: Multiple Page Generator Plugin – MPG Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Multiple Page Generator Plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 3.3.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticat
supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1575f0ad-0a77-4047-844c-48db4c8b4e91?source=cve - https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/trunk/controllers/ProjectsListManage.php#L40 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=
ntrollers/ProjectsListManage.php#L40 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2910686%40multiple-pages-generator-by-porthas%2Ftrunk&old=2905353%40multiple-pages-generator-by-porthas%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-2608 State: PUBLISHED Published: 2023-05-17T01:58:49.981Z Last Updated: 2025-01-13T16:49:24.531Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: themeisle Products: Multiple Page Generator Plugin – MPG Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Multiple Page Generator Plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 3.3.17 due to missing nonce verification on the projects_list function and insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S
t function and insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries leading to resource exhaustion via a forged request granted they can trick an administrator into performing an action such as clicking on a link. Version 3.3.18 addresses the SQL Injection, which drastically reduced the severity. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d900584c-0f58-4abc-92ff-841f898d02fc?source=cve - https://plugins.trac.wordp
rdfence.com/threat-intel/vulnerabilities/id/d900584c-0f58-4abc-92ff-841f898d02fc?source=cve - https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/trunk/controllers/ProjectsListManage.php#L40 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2910686%40multiple-pages-generator-by-porthas%2Ftrunk&old=2905353%40multiple-pages-generator-by-porthas%2Ftrunk&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2912909%40multiple-pages-generator-by-porthas&new=2912909%40multiple-pages-generator-by-porthas&sfp_email=&sfph_mail=
CVE ID: CVE-2023-2609 State: PUBLISHED Published: 2023-05-09T00:00:00 Last Updated: 2024-08-02T06:26:09.713Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-476 Description: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/1679be5a-565f-4a44-a430-836412a0b622 - https://github.com/vim/vim/commit/d1ae8366aff286d41e7f5bc513cc0a1af5130aad - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PCLJN4QINITA3ZASKLEJ64C5TFNKELMO/ - https://support.apple.com/kb/HT213844 -
e-announce%40lists.fedoraproject.org/message/PCLJN4QINITA3ZASKLEJ64C5TFNKELMO/ - https://support.apple.com/kb/HT213844 - https://support.apple.com/kb/HT213845
CVE ID: CVE-2023-2610 State: PUBLISHED Published: 2023-05-09T00:00:00.000Z Last Updated: 2025-11-03T20:35:22.246Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-190 Description: Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/31e67340-935b-4f6c-a923-f7246bc29c7d - https://github.com/vim/vim/commit/ab9a2d884b3a4abe319606ea95a5a6d6b01cd73a - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PCLJN4QINITA3ZASKLEJ64C5TFNKELMO/ - https://lists.debian.org/deb
list/package-announce%40lists.fedoraproject.org/message/PCLJN4QINITA3ZASKLEJ64C5TFNKELMO/ - https://lists.debian.org/debian-lts-announce/2023/06/msg00015.html - https://support.apple.com/kb/HT213844 - https://support.apple.com/kb/HT213845
CVE ID: CVE-2023-2611 State: PUBLISHED Published: 2023-06-22T16:22:49.087Z Last Updated: 2025-01-16T21:31:15.908Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: R-SeeNet Problem Types: CWE-798 Description: Advantech R-SeeNet versions 2.4.22 is installed with a hidden root-level user that is not available in the users list. This hidden user has a password that cannot be changed by users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-173-02
CVE ID: CVE-2023-2612 State: PUBLISHED Published: 2023-05-30T23:12:29.867Z Last Updated: 2025-02-13T16:44:50.457Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Canonical Ltd. Products: ubuntu-linux Problem Types: CWE-667 Description: Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some situations. A local attacker could use this to cause a denial of service (kernel deadlock). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/kinetic/commit/?id=02b47547824
ichment: References: - https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/kinetic/commit/?id=02b47547824b1cd0d55c6744f91886f04de8947e - https://ubuntu.com/security/CVE-2023-2612 - https://ubuntu.com/security/notices/USN-6122-1 - https://ubuntu.com/security/notices/USN-6123-1 - https://ubuntu.com/security/notices/USN-6124-1 - https://ubuntu.com/security/notices/USN-6127-1 - http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html
CVE ID: CVE-2023-2614 State: PUBLISHED Published: 2023-05-10T00:00:00.000Z Last Updated: 2025-01-27T19:42:18.093Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/1a5e6c65-2c5e-4617-9411-5b47a7e743a6 - https://github.com/pimcore/pimcore/commit/c36ef54ce33f7b5e74b7b0ab9eabfed47c018fc7
CVE ID: CVE-2023-2615 State: PUBLISHED Published: 2023-05-10T00:00:00.000Z Last Updated: 2025-01-27T19:41:38.994Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/af9c360a-87f8-4e97-a24b-6db675ee942a - https://github.com/pimcore/pimcore/commit/7a799399e6843cd049e85da27ceb75b78505317f
CVE ID: CVE-2023-2616 State: PUBLISHED Published: 2023-05-10T00:00:00.000Z Last Updated: 2025-01-27T19:40:58.922Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/564cb512-2bcc-4458-8c20-88110ab45801 - https://github.com/pimcore/pimcore/commit/07a2c95be524c7e20105cef58c5767d4ebb06091
CVE ID: CVE-2023-2617 State: PUBLISHED Published: 2023-05-10T05:31:03.420Z Last Updated: 2025-01-27T18:37:31.782Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenCV Products: wechat_qrcode Module Problem Types: CWE-476 Description: A vulnerability classified as problematic was found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this vulnerability is the function DecodedBitStreamParser::decodeByteSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch t
be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-228547. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.228547 - https://vuldb.com/?ctiid.228547 - https://github.com/opencv/opencv_contrib/pull/3480 - https://gist.github.com/GZTimeWalker/3ca70a8af2f5830711e9cccc73fb5270
CVE ID: CVE-2023-2618 State: PUBLISHED Published: 2023-05-10T05:31:04.406Z Last Updated: 2024-08-02T06:26:10.033Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenCV Products: wechat_qrcode Module Problem Types: CWE-401 Description: A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this issue is the function DecodedBitStreamParser::decodeHanziSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to memory leak. The attack may be launched remotely. The name of the patch is 2b62ff6181163eea029ed1cab11363b4996e9cd6. It is recommended to apply a patch
launched remotely. The name of the patch is 2b62ff6181163eea029ed1cab11363b4996e9cd6. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-228548. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.228548 - https://vuldb.com/?ctiid.228548 - https://github.com/opencv/opencv_contrib/pull/3484 - https://github.com/opencv/opencv_contrib/pull/3484/commits/2b62ff6181163eea029ed1cab11363b4996e9cd6
CVE ID: CVE-2023-2619 State: PUBLISHED Published: 2023-05-10T06:00:05.934Z Last Updated: 2024-08-02T06:26:09.786Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Tours & Travels Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects the function exec of the file disapprove_delete.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228549 was assigned to this vulnerability. A
xploit has been disclosed to the public and may be used. The identifier VDB-228549 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.228549 - https://vuldb.com/?ctiid.228549 - https://blog.csdn.net/weixin_43864034/article/details/130596916
CVE ID: CVE-2023-2620 State: PUBLISHED Published: 2023-07-13T02:11:05.008Z Last Updated: 2024-11-06T14:22:24.167Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-201 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1. A maintainer could modify a webhook URL to leak masked webhook secrets by manipulating other masked portions. This addresses an incomplete fix for CVE-2023-0838. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
fix for CVE-2023-0838. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/410433 - https://hackerone.com/reports/1976206
CVE ID: CVE-2023-2621 State: PUBLISHED Published: 2023-11-01T02:10:56.475Z Last Updated: 2025-02-27T20:37:05.734Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Hitachi Energy Products: MACH System Software Problem Types: CWE-22 Description: The McFeeder server (distributed as part of SSW package), is susceptible to an arbitrary file write vulnerability on the MAIN computer system. This vulnerability stems from the use of an outdated version of a third-party library, which is used to extract archives uploaded to McFeeder server. An authenticated malicious client can exploit this vulnerability by uploading a crafted ZIP archive via the network to McFeeder’s
icated malicious client can exploit this vulnerability by uploading a crafted ZIP archive via the network to McFeeder’s service endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000177&languageCode=en&Preview=true
CVE ID: CVE-2023-2622 State: PUBLISHED Published: 2023-11-01T02:24:51.988Z Last Updated: 2025-02-27T20:36:59.986Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Hitachi Energy Products: MACH System Software Problem Types: CWE-668 Description: Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call (RPC) of the InspectSetup service endpoint. The low privilege client is then allowed to read arbitrary files that they do not have authorization to read. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000177&language
ainer: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000177&languageCode=en&Preview=true
CVE ID: CVE-2023-2623 State: PUBLISHED Published: 2023-06-27T13:17:20.907Z Last Updated: 2024-11-27T19:18:07.869Z Vendors: Unknown Products: KiviCare Problem Types: CWE-200 Information Exposure Description: The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users such as subscriber to retrieve sensitive information such as the user email and hashed password of other users Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/85cc39b1-416f-4d23-84c1-fdcbffb0dda0