rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-4947 WooCommerce EAN Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) EAN Update
The WooCommerce EAN Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_order_ean_data AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above, to update EAN numbers for orders.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Yan&Co
product: WooCommerce EAN Payment Gateway
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
lang: en
value: Yan&Co ApS
Published: 2023-10-20T06:35:12.814Z
CVE-2023-4948 WooCommerce CVR Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) CVR Update
The WooCommerce CVR Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_order_cvr_data AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above, to update CVR numbers for orders.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Yan&Co
product: WooCommerce CVR Payment Gateway
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
lang: en
value: Yan&Co ApS
Published: 2023-09-14T03:24:07.870Z
CVE-2023-4949 Memory Corruption Vulnerability in Grub-Legacy's XFS Implementation
An attacker with local access to a system (either through a disk or external drive) can present a modified XFS partition to grub-legacy in such a way to exploit a memory corruption in grub’s XFS file system implementation.

Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: Free Software Foundation
product: Grub-Legacy
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H
version: 3.1
Published: 2023-11-10T16:57:03.311Z
CVE-2023-4950 Funnelforms Free < 3.4 Unauthenticated Stored Cross-Site Scripting
The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor
default_status: unaffected
Credits: lang: en
value: Malek Althubiany
lang: en
value: WPScan
Published: 2023-10-16T19:38:58.080Z
CVE-2023-4951 Cross Site Scripting (XSS) Issue on "Client Based Authentication Policy Configuration" Screen
A cross site scripting issue was discovered with the pagination function on the "Client-based Authentication Policy Configuration" screen of the GreenRADIUS web admin interface. This issue is found in GreenRADIUS v5.1.1.1 and prior. A fix was included in v5.1.2.2.



Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Green Rocket Security
product: GreenRADIUS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Jay Sharma, Application Security Analyst, Qualys, Inc.
Published: 2023-09-14T16:43:40.721Z
CVE-2023-4956 Quay: clickjacking on config-editor page severity
A flaw was found in Quay. Clickjacking is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they intend to click on the top-level page. During the pentest, it has been detected that the config-editor page is vulnerable to clickjacking. This flaw allows an attacker to trick an administrator user into clicking on buttons on the config-editor panel, possibly reconfiguring some parts of the Quay instance.
Problem types: cwe_id: CWE-1021
description: Improper Restriction of Rendered UI Layers or Frames
Affected products: vendor: Red Hat
product: Red Hat Quay 3
cpes: cpe:/a:redhat:quay:3
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: This issue was discovered by Oleg Sushchenko (Red Hat).
Published: 2023-11-07T19:12:00.777Z
CVE-2023-4957 Authentication Bypass on Zebra ZTC
A vulnerability of authentication bypass has been found on a Zebra Technologies ZTC ZT410-203dpi ZPL printer. This vulnerability allows an attacker that is in the same network as the printer, to change the username and password for the Web Page by sending a specially crafted POST request to the setvarsResults.cgi file. For this vulnerability to be exploitable, the printers protected mode must be disabled.
Problem types: cwe_id: CWE-288
description: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Zebra Technologies
product: ZTC ZT410
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: David Cámara Galindo
Published: 2023-10-11T13:21:32.613Z
CVE-2023-4958 Stackrox: missing http security headers allows for clickjacking in web ui
In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptively points to valid RHACS endpoints, hijacking the user's account permissions to perform other actions.
Problem types: cwe_id: CWE-1021
description: Improper Restriction of Rendered UI Layers or Frames
Affected products: vendor: Red Hat
product: Red Hat Advanced Cluster Security 4.2
cpes: cpe:/a:redhat:advanced_cluster_security:4.2::el8
default_status: affected
vendor: Red Hat
product: Red Hat Advanced Cluster Security 3
cpes: cpe:/a:redhat:advanced_cluster_security:3
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: This issue was discovered by Jeremy Choi (Red Hat Product Security).
Published: 2023-12-12T10:02:33.672Z
CVE-2023-4959 Quay: cross-site request forgery (csrf) on config-editor page
A flaw was found in Quay. Cross-site request forgery (CSRF) attacks force a user to perform unwanted actions in an application. During the pentest, it was detected that the config-editor page is vulnerable to CSRF. The config-editor page is used to configure the Quay instance. By coercing the victim’s browser into sending an attacker-controlled request from another domain, it is possible to reconfigure the Quay instance (including adding users with admin privileges).
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Red Hat
product: Red Hat Quay 3
cpes: cpe:/a:redhat:quay:3
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: This issue was discovered by Oleg Sushchenko (Red Hat).
Published: 2023-09-15T09:51:26.867Z
CVE-2023-4960 WCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcfm_stores' shortcode in versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: wclovers
product: WCFM Marketplace – Multivendor Marketplace for WooCommerce
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2024-01-11T08:33:09.984Z
CVE-2023-4961 Poptin <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Poptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'poptin-form' shortcode in versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: poptin
product: Poptin – Exit Pop Ups & Email Popups
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-10-20T07:29:21.548Z
CVE-2023-4962 Video PopUp <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Video PopUp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'video_popup' shortcode in versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: alobaidi
product: Video PopUp
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2024-01-11T08:32:36.644Z
CVE-2023-4963 WS Facebook Like Box Widget <= 5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The WS Facebook Like Box Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ws-facebook-likebox' shortcode in versions up to, and including, 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: webshouter
product: WS Facebook Like Box Widget
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-09-15T02:44:54.273Z
CVE-2023-4964 Potential open redirect vulnerability in opentext SMAX and AMX product. 
Potential open redirect vulnerability
in opentext Service Management Automation X
(SMAX)  versions 2020.05, 2020.08,
2020.11, 2021.02, 2021.05, 2021.08, 2021.11, 2022.05, 2022.11 and opentext Asset
Management X (AMX) versions 2021.08, 2021.11, 2022.05, 2022.11. The
vulnerability could allow attackers to redirect a user to
malicious websites.








Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: opentext 
product: Service Management Automation X (SMAX)
default_status: unaffected
vendor: opentext
product: Asset Management X (AMX)
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Abel Iglesias Iglesias (a.k.a. Hurd4n0) 
Published: 2023-10-30T14:18:59.394Z
CVE-2023-4965 phpipam Header redirect
A vulnerability was found in phpipam 1.5.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Header Handler. The manipulation of the argument X-Forwarded-Host leads to open redirect. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239732.
Problem types: cwe_id: CWE-601
description: CWE-601 Open Redirect
Affected products: vendor: n/a
product: phpipam
CVSS v3.1: version: 3.1
baseScore: 2.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: Affan (VulDB User)
Published: 2023-09-14T20:00:07.601Z
CVE-2023-4966 Unauthenticated sensitive information disclosure
Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Citrix
product: NetScaler ADC
default_status: unaffected
vendor: Citrix
product: NetScaler Gateway
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Published: 2023-10-10T13:12:17.644Z
CVE-2023-4967 Denial of service
Denial of Service in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA Virtual Server
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Cloud Software Group
product: NetScaler ADC
default_status: unaffected
vendor: Cloud Software Group
product: NetScaler Gateway
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
version: 3.1
Published: 2023-10-27T18:01:59.707Z
CVE-2023-4968 WPLegalPages <= 2.9.2 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode
The WPLegalPages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wplegalpage' shortcode in versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with author-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: wplegalpages
product: Privacy Policy Generator – WPLP Legal Pages
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
baseScore: 5.5
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-10-20T06:35:30.907Z
CVE-2023-4969 GPU kernel implementations susceptible to memory leak
A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _local memory_ on various architectures.
Problem types: description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Khronos Group
product: OpenCL
vendor: Khronos Group
product: Vulkan
Credits: lang: en
value: Trail of Bits
Published: 2024-01-16T17:01:29.598Z
CVE-2023-4970 PubyDoc <= 2.0.6 - Admin+ Stored XSS
The PubyDoc WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: PubyDoc
default_status: affected
Credits: lang: en
value: Vaishnav Rajeevan
lang: en
value: WPScan
Published: 2023-11-20T18:55:02.071Z
CVE-2023-4971 Weaver Xtreme Theme Support < 6.3.1 - Admin+ PHP Object Injection
The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import  a malicious file and a suitable gadget chain is present on the blog.
Problem types: description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Unknown
product: Weaver Xtreme Theme Support
default_status: unaffected
Credits: lang: en
value: Do Xuan Trung
lang: en
value: WPScan
Published: 2023-10-16T19:38:52.844Z
CVE-2023-4972 Information Disclosure in Digital Yepas
Incorrect Use of Privileged APIs vulnerability in Yepas Digital Yepas allows Collect Data as Provided by Users.

This issue affects Digital Yepas: before 1.0.1.
Problem types: cwe_id: CWE-648
description: CWE-648 Incorrect Use of Privileged APIs
Affected products: vendor: Yepas
product: Digital Yepas
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Mustafa Anil YILDIRIM
Published: 2023-09-14T19:03:37.291Z
CVE-2023-4973 Academy LMS GET Parameter filter cross site scripting
A vulnerability was found in Academy LMS 6.2 on Windows. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument searched_word/searched_tution_class_type[]/searched_price_type[]/searched_duration[] leads to cross site scripting. The attack can be launched remotely. The identifier VDB-239749 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: Academy
product: LMS
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: skalvin (VulDB User)
Published: 2023-09-15T02:00:09.840Z
CVE-2023-4974 Academy LMS GET Parameter filter sql injection
A vulnerability was found in Academy LMS 6.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument price_min/price_max leads to sql injection. The attack may be launched remotely. VDB-239750 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Academy
product: LMS
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: skalvin (VulDB User)
Published: 2023-09-15T02:00:11.177Z
CVE-2023-4975 Website Builder by SeedProd <= 6.15.13.1 - Cross-Site Request Forgery to Settings Update
The Website Builder by SeedProd plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.15.13.1. This is due to missing or incorrect nonce validation on functionality in the builder.php file. This makes it possible for unauthenticated attackers to change the stripe connect token via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: seedprod
product: Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Marco Wotschka
Published: 2023-10-20T06:35:13.296Z
CVE-2023-4976 FlashBlade Authentication Mechanism Vulnerability
A flaw exists in FlashBlade whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker to gain privileged access to the array.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: PureStorage
product: FlashBlade
default_status: unaffected
Published: 2024-07-17T15:25:58.472Z
CVE-2023-4977 Code Injection in librenms/librenms
 Code Injection in GitHub repository librenms/librenms prior to 23.9.0.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code
Affected products: vendor: librenms
product: librenms/librenms
Published: 2023-09-15T00:00:19.430Z
CVE-2023-4978 Cross-site Scripting (XSS) - DOM in librenms/librenms
Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: librenms
product: librenms/librenms
Published: 2023-09-15T00:00:19.517Z
CVE-2023-4979 Cross-site Scripting (XSS) - Reflected in librenms/librenms
Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.9.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: librenms
product: librenms/librenms
Published: 2023-09-15T00:00:19.484Z