rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-0811 

Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE command to a specific memory region, they could overwrite the password. This may lead to disabling UM protections or setting a non-ASCII password (non-keyboard characters) and preventing an engineer from viewing or modifying the user program. 


Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control 
Affected products: vendor: Omron 
product: CJ1M SYSMAC CJ-series
default_status: unaffected
vendor: Omron
product: CJ1M SYSMAC CJ-series
default_status: unaffected
vendor: Omron
product: CJ1M SYSMAC CJ-series
default_status: unaffected
vendor: Omron
product: CJ1M SYSMAC CJ-series
default_status: unaffected
vendor: Omron 
product: CJ1M SYSMAC CS-series 
default_status: unaffected
vendor: Omron 
product: CJ1M SYSMAC CS-series 
default_status: unaffected
vendor: Omron 
product: CJ1M SYSMAC CS-series 
default_status: unaffected
vendor: Omron 
product: CJ1M SYSMAC CS-series 
default_status: unaffected
vendor: Omron
product: CJ1M SYSMAC CS-series 
default_status: unaffected
vendor: Omron 
product: CJ1M SYSMAC CS-series 
default_status: unaffected
vendor: Omron 
product: CJ1M SYSMAC CS-series 
default_status: unaffected
vendor: Omron
product: CJ1M SYSMAC CP-series
default_status: unaffected
vendor: Omron
product: CJ1M SYSMAC CP-series
default_status: unaffected
vendor: Omron
product: CJ1M SYSMAC CP-series
default_status: unaffected
vendor: Omron
product: CJ1M SYSMAC CP-series
default_status: unaffected
vendor: Omron
product: CJ1M SYSMAC CP-series
default_status: unaffected
vendor: Omron
product: CJ1M SYSMAC CP-series
default_status: unaffected
vendor: Omron
product: CJ1M SYSMAC CP-series
default_status: unaffected
vendor: Omron
product: CJ1M SYSMAC CP-series
default_status: unaffected
vendor: Omron
product: CJ1M SYSMAC CP-series
default_status: unaffected
vendor: Omron
product: CJ1M SYSMAC CP-series
default_status: unaffected
vendor: Omron
product: CJ1M SYSMAC CP-series
default_status: unaffected
vendor: Omron
product: CJ1M SYSMAC CP-series
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Sam Hanson of Dragos reported these vulnerabilities to CISA. 
Published: 2023-03-16T17:41:25.525Z
CVE-2023-0812 Active Directory Integration / LDAP Integration < 4.1.1 - Unauthenticated Data Disclosure
The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.1 does not have proper authorization or nonce values for some POST requests, leading to unauthenticated data disclosure.
Problem types: description: CWE-200 Information Exposure
Affected products: vendor: Unknown
product: Active Directory Integration / LDAP Integration
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-05-15T12:15:39.193Z
CVE-2023-0813 Network-observability-console-plugin-container: setting loki authtoken configuration to disable or host mode leads to authentication longer being enforced
A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without authentication.
Problem types: cwe_id: CWE-285
description: Improper Authorization
Affected products: vendor: Red Hat
product: NETWORK-OBSERVABILITY-1.1.0-RHEL-8
cpes: cpe:/a:redhat:network_observ_optr:1.1.0::el8
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-09-15T20:17:41.914Z
CVE-2023-0814 Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Sensitive Information Disclosure via Shortcode
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortcode in versions up to, and including 3.9.0. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account. This does require the Usermeta shortcode be enabled to be exploited.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: cozmoslabs
product: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-02-14T01:13:13.326Z
CVE-2023-0815 Plaintext Password Present in the Web logs
Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosure of usernames and passwords if the logging level is set to debug. Users
should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and
Horizon installation instructions state that they are intended for installation
within an organization's private networks and should not be directly accessible
from the Internet.







Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
Affected products: vendor: The OpenNMS Group 
product: Meridian
default_status: unaffected
vendor: The OpenNMS Group
product: Horizon
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2023-02-23T14:52:05.792Z
CVE-2023-0816 Formidable Forms < 6.1 - IP Spoofing
The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of anti-spam protections.
Problem types: description: CWE-290 Authentication Bypass by Spoofing
Affected products: vendor: Unknown
product: Formidable Forms
default_status: unaffected
Credits: lang: en
value: Daniel Ruf
lang: en
value: WPScan
Published: 2023-03-27T15:37:17.374Z
CVE-2023-0817 Buffer Over-read in gpac/gpac
Buffer Over-read in GitHub repository gpac/gpac prior to v2.3.0-DEV.
Problem types: cwe_id: CWE-126
description: CWE-126 Buffer Over-read
Affected products: vendor: gpac
product: gpac/gpac
Published: 2023-02-13T00:00:00.000Z
CVE-2023-0818 Off-by-one Error in gpac/gpac
Off-by-one Error in GitHub repository gpac/gpac prior to v2.3.0-DEV.
Problem types: cwe_id: CWE-193
description: CWE-193 Off-by-one Error
Affected products: vendor: gpac
product: gpac/gpac
Published: 2023-02-13T00:00:00.000Z
CVE-2023-0819 Heap-based Buffer Overflow in gpac/gpac
Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to v2.3.0-DEV.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: gpac
product: gpac/gpac
Published: 2023-02-13T00:00:00.000Z
CVE-2023-0820 User Role by BestWebSoft  < 1.6.7 - Privilege Escalation via CSRF
The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role.
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: User Role by BestWebSoft
default_status: unaffected
Credits: lang: en
value: dc11
lang: en
value: WPScan
Published: 2023-04-03T14:38:25.817Z
CVE-2023-0821 Nomad Client Vulnerable to Decompression Bombs in Artifact Block
HashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza source can cause excessive disk usage. Fixed in 1.2.16, 1.3.9, and 1.4.4.
Problem types: cwe_id: CWE-409
description: CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
Affected products: vendor: HashiCorp
product: Nomad
default_status: unaffected
vendor: HashiCorp
product: Nomad Enterprise
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published: 2023-02-16T21:23:24.500Z
CVE-2023-0822 Improper Authorization

The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality. 


Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: Delta Electronics 
product: DIAEnergie 
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2023-02-17T16:46:21.643Z
CVE-2023-0823 Cookie Notice & Compliance for GDPR / CCPA < 2.4.7 - Contributor+ Stored XSS
The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.4.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Cookie Notice & Compliance for GDPR / CCPA
default_status: unaffected
Credits: lang: en
value: Erwan LR (WPScan)
lang: en
value: WPScan
Published: 2023-03-27T15:37:40.612Z
CVE-2023-0824 UserPlus <= 2.0 - Stored XSS via CSRF
The User registration & user profile WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged-in admin add Stored XSS payloads via a CSRF attack.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: User registration & user profile
default_status: affected
Credits: lang: en
value: Shreya Pohekar
lang: en
value: WPScan
Published: 2024-01-16T15:56:28.126Z
CVE-2023-0827 Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 1.5.17.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2023-02-14T00:00:00.000Z
CVE-2023-0828 Stored Cross Site Scripting in syslog section
Cross-site Scripting (XSS) vulnerability in Syslog Section of Pandora FMS allows attacker to cause that users cookie value will be transferred to the attackers users server. This issue affects Pandora FMS v767 version and prior versions on all platforms.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Artica PFMS
product: Pandora FMS
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L
version: 3.1
Published: 2023-10-03T10:44:18.682Z
CVE-2023-0829 Cross-Site Scripting (XSS) vulnerability in Plesk
Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner (either a customer or an additional user), can fully compromise the server if an administrator visits a certain page in Plesk related to the malicious subscription.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Plesk
product: Plesk
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Tarek Bouali (@iambouali)
Published: 2023-09-20T12:38:54.973Z
CVE-2023-0830 EasyNAS backup.pl system os command injection
A vulnerability classified as critical has been found in EasyNAS 1.1.0. Affected is the function system of the file /backup.pl. The manipulation leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: n/a
product: EasyNAS
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: xbz0n (VulDB User)
lang: en
value: xbz0n (VulDB User)
Published: 2023-02-14T16:13:43.586Z
CVE-2023-0831 Under Construction <= 3.96 - Cross-Site Request Forgery via admin_action_ucp_dismiss_notice
The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incorrect nonce validation on the dismiss_notice function called via the admin_action_ucp_dismiss_notice action. This makes it possible for unauthenticated attackers to dismiss plugin notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: webfactory
product: Under Construction
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Ramuel Gall
lang: en
value: Alex Thomas
Published: 2023-06-09T05:33:09.916Z
CVE-2023-0832 Under Construction <= 3.96 - Cross-Site Request Forgery via admin_action_install_weglot
The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incorrect nonce validation on the install_weglot function called via the admin_action_install_weglot action. This makes it possible for unauthenticated attackers to perform an unauthorized install of the Weglot Translate plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: webfactory
product: Under Construction
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Ramuel Gall
lang: en
value: Alex Thomas
Published: 2023-06-09T05:33:17.341Z
CVE-2023-0833 Red hat a-mq streams: component version with information disclosure flaw
A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular permissions.
Problem types: cwe_id: CWE-209
description: Generation of Error Message Containing Sensitive Information
Affected products: vendor: Red Hat
product: Red Hat AMQ Streams 2.2.1
cpes: cpe:/a:redhat:amq_streams:2
default_status: unaffected
vendor: Red Hat
product: Red Hat AMQ Streams 2.4.0
cpes: cpe:/a:redhat:amq_streams:2
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-09-27T13:41:12.626Z
CVE-2023-0834 
Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on MacOS allows Privilege Escalation.This issue affects Workforce Access: from 6.12 before 8.1.


Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: HYPR
product: Workforce Access
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-04-28T14:54:53.201Z
CVE-2023-0835 markdown-pdf 11.0.0 - Local File Read via Server Side XSS
markdown-pdf version 11.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the Markdown content entered by the user.
Problem types: description: Server Side XSS
Affected products: vendor: n/a
product: markdown-pdf
default_status: unaffected
Published: 2023-04-04T00:00:00.000Z
CVE-2023-0836 
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: HAProxy
Published: 2023-03-29T00:00:00.000Z
CVE-2023-0837 
An improper  authorization check of local device settings in TeamViewer Remote between version 15.41 and 15.42.7 for Windows and macOS allows an unprivileged user to change basic local device settings even though the options were locked. This can result in unwanted changes to the configuration.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: TeamViewer
product: Remote
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
version: 3.1
Published: 2023-06-14T07:01:10.595Z
CVE-2023-0838 
An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342.
Problem types: description: Information exposure in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [0xn3va](https://hackerone.com/0xn3va) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2023-04-05T00:00:00.000Z
CVE-2023-0839 Improper Error Handling in inSCADA
Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ProMIS Process Co. InSCADA allows Account Footprinting.

This issue affects inSCADA: before 20230115-1.
Problem types: cwe_id: CWE-1320
description: CWE-1320 Improper Protection for Outbound Error Messages and Alert Signals
Affected products: vendor: ProMIS Process Co.
product: inSCADA
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Omer Fatih YEGIN
Published: 2023-03-06T07:07:20.075Z
CVE-2023-0840 PHPCrazy cross site scripting
A vulnerability classified as problematic was found in PHPCrazy 1.1.1. This vulnerability affects unknown code of the file admin/admin.php?action=users&mode=info&user=2. The manipulation of the argument username leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-221086 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: n/a
product: PHPCrazy
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: s7eyd7 (VulDB User)
Published: 2023-02-15T13:28:06.062Z
CVE-2023-0841 GPAC reframe_mp3.c mp3_dmx_process heap-based overflow
A vulnerability, which was classified as critical, has been found in GPAC 2.3-DEV-rev40-g3602a5ded. This issue affects the function mp3_dmx_process of the file filters/reframe_mp3.c. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221087.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: n/a
product: GPAC
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: qianshuidewajueji (VulDB User)
Published: 2023-02-15T13:33:53.115Z
CVE-2023-0842 xml2js 0.4.23 - Prototype Pollution
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: xml2js
default_status: unaffected
Published: 2023-04-05T00:00:00.000Z
CVE-2023-0844 Namaste! LMS < 2.6 - Admin+ Stored XSS
The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Namaste! LMS
default_status: unaffected
Credits: lang: en
value: Alex Sanford
lang: en
value: WPScan
Published: 2023-03-13T16:03:35.583Z