Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-47768 State: PUBLISHED Published: 2023-11-22T22:02:56.739Z Last Updated: 2024-08-02T21:16:43.654Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Russell Jamieson Products: Footer Putter Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson Footer Putter plugin <= 1.17 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/footer-putter/wordpress-footer-putter-plugin-1-17-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-47769 State: PUBLISHED Published: 2024-06-04T10:06:50.700Z Last Updated: 2024-08-02T21:16:43.581Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Florent Maillefaud Products: WP Maintenance Problem Types: CWE-290 Description: Authentication Bypass by Spoofing vulnerability in WP Maintenance allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Maintenance: from n/a through 6.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-maintenance/wordpress-wp-maintenance-plugin-6-1-3-ip-filtering-bypass-vulnerability?_s_id=cve
CVE ID: CVE-2023-47770 State: PUBLISHED Published: 2024-06-19T11:12:06.746Z Last Updated: 2024-08-02T21:16:43.655Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Muffin Group Products: Betheme Problem Types: CWE-862 Description: Missing Authorization vulnerability in Muffin Group Betheme.This issue affects Betheme: from n/a through 27.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/betheme/wordpress-betheme-theme-27-1-1-contributor-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-47771 State: PUBLISHED Published: 2024-06-19T10:37:31.839Z Last Updated: 2024-08-02T21:16:43.663Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: ThemePunch OHG Products: Essential Grid Problem Types: CWE-862 Description: Missing Authorization vulnerability in ThemePunch OHG Essential Grid.This issue affects Essential Grid: from n/a through 3.0.18. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/essential-grid/wordpress-essential-grid-plugin-3-0-18-multiple-authenticated-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-47772 State: PUBLISHED Published: 2023-11-20T14:23:02.039Z Last Updated: 2024-08-02T21:16:43.586Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: ThemePunch OHG Products: Slider Revolution Problem Types: CWE-79 Description: Contributor+ Stored Cross-Site Scripting (XSS) vulnerability in Slider Revolution <= 6.6.14. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/revslider/wordpress-slider-revolution-plugin-6-6-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-47773 State: PUBLISHED Published: 2023-11-22T22:05:14.688Z Last Updated: 2024-08-02T21:16:43.551Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: YAS Global Team Products: Permalinks Customizer Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YAS Global Team Permalinks Customizer plugin <= 2.8.2 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/permalinks-customizer/wordpress-permalinks-customizer-plugin-2-8-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-47774 State: PUBLISHED Published: 2024-04-24T15:58:40.432Z Last Updated: 2024-08-02T21:16:43.660Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Automattic Products: Jetpack Problem Types: CWE-1021 Description: Improper Restriction of Rendered UI Layers or Frames vulnerability in Automattic Jetpack allows Clickjacking.This issue affects Jetpack: from n/a before 12.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/jetpack/wordpress-jetpack-plugin-12-7-contributor-iframe-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-47775 State: PUBLISHED Published: 2023-11-22T18:23:54.965Z Last Updated: 2024-08-02T21:16:43.615Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: gVectors Team Products: Comments — wpDiscuz Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team Comments — wpDiscuz plugin <= 7.6.11 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wpdiscuz/wordpress-wpdiscuz-plugin-7-6-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-47776 State: PUBLISHED Published: 2024-12-09T11:30:47.381Z Last Updated: 2024-12-09T13:49:56.848Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: miniOrange Products: miniorange otp verification Problem Types: CWE-862 Description: Missing Authorization vulnerability in miniOrange miniorange otp verification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniorange otp verification: from n/a through 4.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/miniorange-otp-verification/vulnerability/wordpress-miniorange-otp-verification-pl
chstack.com/database/wordpress/plugin/miniorange-otp-verification/vulnerability/wordpress-miniorange-otp-verification-plugin-4-2-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-47777 State: PUBLISHED Published: 2023-11-30T11:56:53.604Z Last Updated: 2024-08-02T21:16:43.678Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Automattic Products: WooCommerce, WooCommerce Blocks Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce, Automattic WooCommerce Blocks allows Stored XSS.This issue affects WooCommerce: from n/a through 8.1.1; WooCommerce Blocks: from n/a through 11.1.1. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woocommerce/wordpress-woocomm
otes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woocommerce/wordpress-woocommerce-plugin-8-1-1-contributor-cross-site-scripting-xss-vulnerability?_s_id=cve - https://patchstack.com/database/vulnerability/woo-gutenberg-products-block/wordpress-woocommerce-blocks-plugin-11-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve - https://patchstack.com/articles/authenticated-stored-xss-in-woocommerce-and-jetpack-plugin?_s_id=cve
CVE ID: CVE-2023-47778 State: PUBLISHED Published: 2025-01-02T14:18:48.879Z Last Updated: 2025-01-02T14:44:02.852Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: LuckyWP Products: LuckyWP Scripts Control Problem Types: CWE-862 Description: Missing Authorization vulnerability in LuckyWP LuckyWP Scripts Control allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LuckyWP Scripts Control: from n/a through 1.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/luckywp-scripts-control/vulnerability/wordpress-luckywp-scripts-control-plugin-1-2-1-broken-access-c
se/wordpress/plugin/luckywp-scripts-control/vulnerability/wordpress-luckywp-scripts-control-plugin-1-2-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-47779 State: PUBLISHED Published: 2023-12-07T12:11:33.370Z Last Updated: 2024-08-02T21:16:43.699Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: CRM Perks Products: Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks. Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.1.4. Additional Analyst Notes: - CVE Program Container: References: - htt
ms, Elementor, Ninja Forms: from n/a through 1.1.4. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/cf7-constant-contact/wordpress-integration-for-contact-form-7-and-constant-contact-plugin-1-1-4-open-redirection-vulnerability?_s_id=cve
CVE ID: CVE-2023-47780 State: PUBLISHED Published: 2024-12-09T11:30:46.590Z Last Updated: 2024-12-09T13:49:56.983Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: EasyAzon Products: EasyAzon Problem Types: CWE-862 Description: Missing Authorization vulnerability in EasyAzon EasyAzon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EasyAzon: from n/a through 5.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/easyazon/vulnerability/wordpress-easyazon-amazon-associates-affiliate-plugin-plugin-5-1-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-47781 State: PUBLISHED Published: 2023-11-22T18:27:29.185Z Last Updated: 2024-08-02T21:16:43.672Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Thrive Themes Products: Thrive Theme Builder Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Thrive Themes Thrive Theme Builder < 3.24.2 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/thrive-theme/wordpress-thrive-theme-builder-theme-3-20-1-cross-site-request-forgery-csrf-to-account-takeover-vulnerability?_s_id=cve
CVE ID: CVE-2023-47782 State: PUBLISHED Published: 2024-05-17T08:37:20.996Z Last Updated: 2024-08-08T17:34:36.896Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Thrive Themes Products: Thrive Theme Builder Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in Thrive Themes Thrive Theme Builder allows Privilege Escalation.This issue affects Thrive Theme Builder: from n/a before 3.24.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/thrive-theme/wordpress-thrive-theme-builder-theme-3-20-1-authenticated-privilege-escalation-vulnerability?_s_id=c
bility/thrive-theme/wordpress-thrive-theme-builder-theme-3-20-1-authenticated-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2023-47783 State: PUBLISHED Published: 2024-06-19T10:36:02.808Z Last Updated: 2024-08-02T21:16:43.662Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: Thrive Themes Products: Thrive Theme Builder Problem Types: CWE-862 Description: Missing Authorization vulnerability in Thrive Themes Thrive Theme Builder.This issue affects Thrive Theme Builder: from n/a before 3.24.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/thrive-theme/wordpress-thrive-theme-builder-theme-3-20-1-multiple-authenticated-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-47784 State: PUBLISHED Published: 2023-12-20T18:29:27.108Z Last Updated: 2024-09-12T18:51:55.982Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: ThemePunch OHG Products: Slider Revolution Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in ThemePunch OHG Slider Revolution.This issue affects Slider Revolution: from n/a through 6.6.15. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/revslider/wordpress-slider-revolution-plugin-6-6-15-author-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2023-47785 State: PUBLISHED Published: 2023-11-22T18:35:29.919Z Last Updated: 2025-06-05T14:21:13.745Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) Vendors: LayerSlider Products: LayerSlider Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in LayerSlider plugin <= 7.7.9 versions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/layerslider/wordpress-layerslider-plugin-7-7-9-multiple-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-47786 State: PUBLISHED Published: 2023-11-22T22:08:35.665Z Last Updated: 2024-08-02T21:16:43.654Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: LayerSlider Products: LayerSlider Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LayerSlider plugin <= 7.7.9 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/layerslider/wordpress-layerslider-plugin-7-7-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-47787 State: PUBLISHED Published: 2023-12-18T15:30:51.769Z Last Updated: 2024-09-30T18:56:55.632Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WooCommerce Products: WooCommerce Bookings Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 2.0.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woocommerce-bookings/wordpress-woocommerce-bookings-plugin-2-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-47788 State: PUBLISHED Published: 2024-06-19T10:33:57.434Z Last Updated: 2024-08-02T21:16:43.650Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Automattic Products: Jetpack Problem Types: CWE-862 Description: Missing Authorization vulnerability in Automattic Jetpack.This issue affects Jetpack: from n/a before 12.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/jetpack/wordpress-jetpack-plugin-12-7-contributor-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-47789 State: PUBLISHED Published: 2023-12-18T15:43:23.911Z Last Updated: 2024-08-02T21:16:43.664Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WooCommerce Products: Canada Post Shipping Method Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Canada Post Shipping Method.This issue affects Canada Post Shipping Method: from n/a through 2.8.3. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woocommerce-shipping-canada-post/wordpress-woocommerce-canada-post-shipping-plugin-2-8-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cv
nada-post/wordpress-woocommerce-canada-post-shipping-plugin-2-8-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-47790 State: PUBLISHED Published: 2023-11-22T23:27:39.693Z Last Updated: 2024-08-02T21:16:43.663Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Poporon Products: Pz-LinkCard Problem Types: CWE-352, CWE-79 Description: Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in Poporon Pz-LinkCard plugin <= 2.4.8 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/pz-linkcard/wordpress-pz-linkcard-plugin-2-4-8-cross-site-request-forgery-csrf-to-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-47791 State: PUBLISHED Published: 2023-11-22T18:38:51.468Z Last Updated: 2024-11-20T21:10:45.588Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Leadster Products: Leadster Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Leadster plugin <= 1.1.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/leadster-marketing-conversaciona/wordpress-leadster-plugin-1-1-2-cross-site-request-forgery-csrf-vulnerability-2?_s_id=cve
CVE ID: CVE-2023-47792 State: PUBLISHED Published: 2023-11-22T18:41:25.234Z Last Updated: 2024-08-02T21:16:44.024Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Infinite Uploads Products: Big File Uploads – Increase Maximum File Upload Size Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Infinite Uploads Big File Uploads – Increase Maximum File Upload Size plugin <= 2.1.1 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/tuxedo-big-file-uploads/wordpress-big-file-uploads-plugin-2-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-47793 State: PUBLISHED Published: 2024-12-09T11:30:45.610Z Last Updated: 2024-12-09T13:49:57.246Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: acmethemes Products: Acme Fix Images Problem Types: CWE-862 Description: Missing Authorization vulnerability in acmethemes Acme Fix Images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acme Fix Images: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/acme-fix-images/vulnerability/wordpress-acme-fix-images-plugin-1-0-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-47795 State: PUBLISHED Published: 2024-02-21T14:01:00.773Z Last Updated: 2024-08-02T21:16:43.666Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 18 through 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a document's “Title” text field. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://li
“Title” text field. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47795
CVE ID: CVE-2023-47797 State: PUBLISHED Published: 2023-11-17T06:03:00.299Z Last Updated: 2024-08-29T14:15:06.460Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Liferay Products: Portal Problem Types: CWE-79 Description: Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject arbitrary web script or HTML via the `p_l_back_url_title` parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47797
CVE ID: CVE-2023-47798 State: PUBLISHED Published: 2024-02-08T02:55:43.923Z Last Updated: 2025-05-15T19:41:01.043Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-384 Description: Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulner
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47798
CVE ID: CVE-2023-47799 State: PUBLISHED Published: 2025-08-25T00:00:00.000Z Last Updated: 2025-08-25T20:39:28.708Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara before 22.10.4 and 23.x before 23.04.4 allows information disclosure if the experimental HTML bulk export is used via the administration interface or via the CLI, and the resulting export files are given to the account holders. They may contain images of other account holders because the cache is not cleared after the files of one account are exported. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.mahara.org/catalyst-security/mahara-security/-/issues/2 - https://mahara.org/interactio
hment: References: - https://git.mahara.org/catalyst-security/mahara-security/-/issues/2 - https://mahara.org/interaction/forum/topic.php?id=9353
CVE ID: CVE-2023-47800 State: PUBLISHED Published: 2023-11-10T00:00:00 Last Updated: 2024-08-02T21:16:43.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: Natus NeuroWorks and SleepWorks before 8.4 GMA3 utilize a default password of xltek for the Microsoft SQL Server service sa account, allowing a threat actor to perform remote code execution, data exfiltration, or other nefarious actions such as tampering with data or destroying/disrupting MSSQL services. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/hubfs/Web/Library/Advisories_txt/TWSL2023-006.txt - https://partner.natus.com/m/7cd3bcca88e446d4/original/NeuroWorks-SleepWorks-Produc
ary/Advisories_txt/TWSL2023-006.txt - https://partner.natus.com/m/7cd3bcca88e446d4/original/NeuroWorks-SleepWorks-Product-Security-Bulletin.pdf
CVE ID: CVE-2023-47801 State: PUBLISHED Published: 2023-11-13T00:00:00 Last Updated: 2024-09-03T18:03:32.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Click Studios Passwordstate before 9811. Existing users (Security Administrators) could use the System Wide API Key to read or delete private password records when specifically used with the PasswordHistory API endpoint. It is also possible to use the Copy/Move Password Record API Key to Copy/Move private password records. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.clickstudios.com.au/security/advisories/
CVE ID: CVE-2023-47802 State: PUBLISHED Published: 2024-06-28T06:01:58.733Z Last Updated: 2024-08-02T21:16:43.691Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Synology Products: Camera Firmware Problem Types: CWE-78 Description: A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the IP block functionality. This allows remote authenticated users with administrator privileges to execute arbitrary commands via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500. Additional Analyst Notes: - CISA ADP Vulnr
Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_23_15