Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6778 State: PUBLISHED Published: 2023-12-18T14:54:28.968Z Last Updated: 2024-08-02T08:42:07.300Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: allegroai Products: allegroai/clearml-server Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository allegroai/clearml-server prior to 1.13.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/5f3fffac-0358-48e6-a500-81bac13e0e2b - https://github.com/allegroai/clearml-server/commit/4684fd5b74af582c894b67a0a06e865c948b763a
CVE ID: CVE-2023-6779 State: PUBLISHED Published: 2024-01-31T14:07:41.967Z Last Updated: 2025-06-13T16:08:42.227Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: n/a, Red Hat, Fedora Products: glibc, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Fedora Problem Types: CWE-122 Description: An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a message bigger than INT_MAX bytes, leading to an incorrect calculation of the buffer si
hese functions are called with a message bigger than INT_MAX bytes, leading to an incorrect calculation of the buffer size to store the message, resulting in an application crash. This issue affects glibc 2.37 and newer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html - http://seclists.org/fulldisclosure/2024/Feb/3 - https://access.redhat.com/security/cve/CVE-2023-6779 - https://bugzilla.redhat.com/show_bug.cgi?id=2254395 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2FIH77VHY3KCRROCXOT6L27WMZXSJ2G/ - https://li
roject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2FIH77VHY3KCRROCXOT6L27WMZXSJ2G/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWQ6BZJ6CV5UAW4VZSKJ6TO4KIW2KWAQ/ - https://security.gentoo.org/glsa/202402-01 - https://www.openwall.com/lists/oss-security/2024/01/30/6 - https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt - https://security.netapp.com/advisory/ntap-20240223-0006/
CVE ID: CVE-2023-6780 State: PUBLISHED Published: 2024-01-31T14:08:02.610Z Last Updated: 2025-06-17T21:29:19.534Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a, Red Hat, Fedora Products: glibc, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Fedora Problem Types: CWE-131 Description: An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message, resulting
called with a very long message, leading to an incorrect calculation of the buffer size to store the message, resulting in undefined behavior. This issue affects glibc 2.37 and newer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html - http://seclists.org/fulldisclosure/2024/Feb/3 - https://access.redhat.com/security/cve/CVE-2023-6780 - https://bugzilla.redhat.com/show_bug.cgi?id=2254396 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2FIH77VHY3KCRROCXOT6L27WMZXSJ2G/ - https://lists.fedoraproject.org/archives/list/p
unce@lists.fedoraproject.org/message/D2FIH77VHY3KCRROCXOT6L27WMZXSJ2G/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWQ6BZJ6CV5UAW4VZSKJ6TO4KIW2KWAQ/ - https://security.gentoo.org/glsa/202402-01 - https://www.openwall.com/lists/oss-security/2024/01/30/6 - https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt
CVE ID: CVE-2023-6781 State: PUBLISHED Published: 2024-01-11T08:32:29.532Z Last Updated: 2025-06-17T21:09:14.192Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeisle Products: Orbit Fox by ThemeIsle Problem Types: CWE-20 Improper Input Validation Description: The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom fields in all versions up to, and including, 2.10.26 due to insufficient input sanitization and output escaping on user supplied values. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will
authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/23e39019-c322-4027-84f2-faabd9ca4983?source=cve - https://plugins.trac.wordpress.org/browser/themeisle-companion/trunk/obfx_modules/header-footer-scripts/init.php#L315 - https://plugins.trac.wordpress.org/browser/themeisle-companion/trunk/obfx_modules/header-footer-scripts/init.php#L34 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3011567%40
ooter-scripts/init.php#L34 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3011567%40themeisle-companion%2Ftrunk&old=2991564%40themeisle-companion%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6782 State: PUBLISHED Published: 2024-01-11T08:32:55.986Z Last Updated: 2025-06-17T21:09:14.450Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mohammed_kaludi Products: AMP for WP – Accelerated Mobile Pages Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.0.92 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker
nt input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c1cae64e-caed-43c0-9a75-9aa4234946a0?source=cve - https://plugins.svn.wordpress.org/accelerated-mobile-pages/trunk/templates/features.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3010797%40accelerated-mobile-pages%2Ftrunk&old=2998126%40accel
rdpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3010797%40accelerated-mobile-pages%2Ftrunk&old=2998126%40accelerated-mobile-pages%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6783 State: PUBLISHED Published: 2025-05-15T20:09:19.115Z Last Updated: 2025-05-19T21:23:45.304Z Vendors: Unknown Products: WolfNet IDX for WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WolfNet IDX for WordPress plugin through 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5acd231b-4072-4ee1-9497-023465318608/
CVE ID: CVE-2023-6784 State: PUBLISHED Published: 2023-12-20T14:00:55.962Z Last Updated: 2024-11-27T20:02:36.832Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: Progress Software Corporation Products: Sitefinity Problem Types: CWE-20 Description: A malicious user could potentially use the Sitefinity system for the distribution of phishing emails. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.progress.com/sitefinity-cms - https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerability-CVE-2023-6784-December-2023
CVE ID: CVE-2023-6785 State: PUBLISHED Published: 2024-03-13T15:26:58.832Z Last Updated: 2024-08-02T08:42:07.513Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: codename065 Products: Download Manager Problem Types: CWE-284 Improper Access Control Description: The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, and including, 3.2.84. This makes it possible for unauthenticated attackers to download files added with the plugin (even when privately published). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/t
). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7b3608ca-8ed6-46ff-8e57-d8b68f91b9f2?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3038209%40download-manager%2Ftrunk&old=3022104%40download-manager%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6786 State: PUBLISHED Published: 2025-05-15T20:09:19.335Z Last Updated: 2025-05-17T02:51:30.687Z Vendors: Unknown Products: Payment Gateway for Telcell Problem Types: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') Description: The Payment Gateway for Telcell WordPress plugin through 2.0.1 does not validate the api_url parameter before redirecting the user to its value, leading to an Open Redirect issue Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f3e64947-3138-4ec4-86c4-27b5d6a5c9c2/
CVE ID: CVE-2023-6787 State: PUBLISHED Published: 2024-04-25T16:02:32.916Z Last Updated: 2025-11-11T15:57:32.291Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Red Hat Products: Red Hat build of Keycloak 22, Red Hat build of Keycloak 22.0.10, Red Hat Single Sign-On 7 Problem Types: CWE-287 Description: A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an active Keycloak session by triggering a new authentication process with the query parameter "prompt=login," prompting the user to re-enter their credentials. If the user cancels this re-authentication by
rameter "prompt=login," prompting the user to re-enter their credentials. If the user cancels this re-authentication by selecting "Restart login," an account takeover may occur, as the new session, with a different SUB, will possess the same SID as the previous session. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:1867 - https://access.redhat.com/errata/RHSA-2024:1868 - https://access.redhat.com/security/cve/CVE-2023-6787 - https://bugzilla.redhat.com/show_bug.cgi?id=2254375 - https://github.com/keycloak/keycloak/security/advisories/GHSA-c9h6-v78w-52wj
CVE ID: CVE-2023-6788 State: PUBLISHED Published: 2024-01-09T03:31:31.315Z Last Updated: 2025-06-17T20:39:18.083Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: xpeedstudio Products: Metform Elementor Contact Form Builder Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.1. This is due to missing or incorrect nonce validation on the contents function. This makes it possible for unauthenticated attackers to update the options "mf_hubsopt_token", "mf_hubsopt_refresh_token", "mf_hubsopt_token_
e for unauthenticated attackers to update the options "mf_hubsopt_token", "mf_hubsopt_refresh_token", "mf_hubsopt_token_type", and "mf_hubsopt_expires_in" via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This would allow an attacker to connect their own Hubspot account to a victim site's metform to obtain leads and contacts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/30fd2425-ee48-4777-91c1-03906d63793a?source=cve - https://plugins.trac.wordpress.org/browser/metform/trunk/core/integrations/crm/hubspot/loader.php#L87 - h
a?source=cve - https://plugins.trac.wordpress.org/browser/metform/trunk/core/integrations/crm/hubspot/loader.php#L87 - https://plugins.trac.wordpress.org/changeset/3011284/metform/trunk/core/integrations/crm/hubspot/loader.php
CVE ID: CVE-2023-6789 State: PUBLISHED Published: 2023-12-13T18:26:30.524Z Last Updated: 2024-08-02T08:42:07.423Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: Palo Alto Networks Products: PAN-OS, Prisma Access, Cloud NGFW Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface. Then, when viewed by a properly authenticated administrator, the JavaScript payload executes and disguises all associated actions as performed by that unsuspecting authenticated administrator. Additional Analyst
s and disguises all associated actions as performed by that unsuspecting authenticated administrator. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2023-6789
CVE ID: CVE-2023-6790 State: PUBLISHED Published: 2023-12-13T18:15:48.142Z Last Updated: 2024-08-02T08:42:07.444Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS, Prisma Access, Cloud NGFW Problem Types: CWE-79 Description: A DOM-Based cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to execute a JavaScript payload in the context of an administrator’s browser when they view a specifically crafted link to the PAN-OS web interface. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2023-6790
CVE ID: CVE-2023-6791 State: PUBLISHED Published: 2023-12-13T18:30:17.115Z Last Updated: 2024-08-02T08:42:07.408Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Palo Alto Networks Products: PAN-OS, Prisma Access, Cloud NGFW Problem Types: CWE-701 Description: A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext credentials of stored external system integrations such as LDAP, SCP, RADIUS, TACACS+, and SNMP from the web interface. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2023-6791
CVE ID: CVE-2023-6792 State: PUBLISHED Published: 2023-12-13T18:16:18.893Z Last Updated: 2024-10-08T14:26:00.308Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: Palo Alto Networks Products: PAN-OS, Prisma Access, Cloud NGFW Problem Types: CWE-88 Description: An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2023-6792
CVE ID: CVE-2023-6793 State: PUBLISHED Published: 2023-12-13T18:40:54.955Z Last Updated: 2024-12-02T14:27:51.212Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: Palo Alto Networks Products: PAN-OS, Prisma Access, Cloud NGFW Problem Types: CWE-269 Description: An improper privilege management vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to revoke active XML API keys from the firewall and disrupt XML API usage. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2023-6793
CVE ID: CVE-2023-6794 State: PUBLISHED Published: 2023-12-13T18:16:39.175Z Last Updated: 2024-08-02T08:42:07.397Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: Palo Alto Networks Products: PAN-OS, Prisma Access, Cloud NGFW Problem Types: CWE-434 Description: An arbitrary file upload vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2023-6794
CVE ID: CVE-2023-6795 State: PUBLISHED Published: 2023-12-13T18:17:43.368Z Last Updated: 2024-08-02T08:42:08.431Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: Palo Alto Networks Products: PAN-OS, Prisma Access, Cloud NGFW Problem Types: CWE-78 Description: An OS command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2023-6795
CVE ID: CVE-2023-6798 State: PUBLISHED Published: 2024-01-06T09:38:36.799Z Last Updated: 2025-06-17T20:29:14.248Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: themeisle Products: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Problem Types: CWE-257 Storing Passwords in a Recoverable Format Description: The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check when updating settings in all versions up to, and including, 4.3.2. This makes it possible for authenticated attack
heck when updating settings in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with author-level access or above to change the plugin's settings including proxy settings, which are also exposed to authors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c2cdf4e5-0a40-42ca-b5ac-78511fdd2b77?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3012392%40feedzy-rss-feeds%2Ftrunk&old=2991547%40feedzy-rss-feeds%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6799 State: PUBLISHED Published: 2024-04-09T18:58:53.008Z Last Updated: 2025-02-26T18:23:53.102Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: webfactory Products: WP Reset – Most Advanced WordPress Reset Tool Problem Types: CWE-330 Use of Insufficiently Random Values Description: The WP Reset – Most Advanced WordPress Reset Tool plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0 via the use of insufficiently random snapshot names. This makes it possible for unauthenticated attackers to extract sensitive data including site backups by brute-forcing the snapshot filenames. Please n
thenticated attackers to extract sensitive data including site backups by brute-forcing the snapshot filenames. Please note that the vendor does not plan to do any further hardening on this functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/68f41e88-ed36-4361-bddd-41495a540cd9?source=cve - https://plugins.trac.wordpress.org/changeset?old_path=/wp-reset/tags/1.99&old=3059287&new_path=/wp-reset/tags/2.0&new=3059287&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3071811%40wp-reset&new=3071811%40wp-reset&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6801 State: PUBLISHED Published: 2024-01-06T09:38:25.778Z Last Updated: 2024-11-14T18:10:25.522Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeisle Products: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output es
ting via admin settings in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a713d897-c549-4e0d-9cb3-7002ef2b127f?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3012392%40feedzy-rss-feeds%2Ftrunk&old=2991547%40feedzy-rss-feeds%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6802 State: PUBLISHED Published: 2023-12-21T20:45:24.749Z Last Updated: 2024-09-13T14:55:25.219Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: GitHub Products: Enterprise Server Problem Types: CWE-532 Description: An insertion of sensitive information into the log file in the audit log in GitHub Enterprise Server was identified that could allow an attacker to gain access to the management console. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server appliance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs. This vulnerability affec
ated with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 - https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 - https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 - https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1
CVE ID: CVE-2023-6803 State: PUBLISHED Published: 2023-12-21T20:45:27.233Z Last Updated: 2024-08-02T08:42:07.752Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L) Vendors: GitHub Products: Enterprise Server Problem Types: CWE-367 Description: A race condition in GitHub Enterprise Server allows an outside collaborator to be added while a repository is being transferred. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1. Additional Analyst Notes: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 - https://docs.github.co