rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-45690 Information leak via default file permissions on Titan MFT and Titan SFTP servers
Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the OS to read sensitive files on the filesystem
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: South River Technologies
product: Titan MFT
default_status: unaffected
vendor: South River Technologies
product: Titan SFTP
default_status: unaffected
Published: 2023-10-16T16:20:52.656Z
CVE-2023-45696 HCL Sametime is impacted by an autocomplete enabled vulnerability
Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the browser.

Affected products: vendor: HCL Software
product: HCL Sametime
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-02-10T03:10:30.423Z
CVE-2023-45698 HCL Sametime is impacted by clickjacking
Sametime is impacted by lack of clickjacking protection in Outlook add-in. The application is not implementing appropriate protections in order to protect users from clickjacking attacks.

Affected products: vendor: HCL Software
product: HCL Sametime
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-02-10T03:24:40.127Z
CVE-2023-45700 HCL Launch is susceptible to an HTML injection vulnerability
HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.

Affected products: vendor: HCL Software
product: HCL Launch
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-12-21T00:10:11.246Z
CVE-2023-45701 HCL Launch is susceptible to sensitive information disclosure
HCL Launch could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

Affected products: vendor: HCL Software
product: HCL Launch
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-12-28T07:03:01.753Z
CVE-2023-45702 HCL Launch Agent as a Windows service is vulnerable to a Denial of Service
An HCL UrbanCode Deploy Agent installed as a Windows service in a non-standard location could be subject to a denial of service attack by local accounts..

Affected products: vendor: HCL Software
product: HCL Launch
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-12-28T07:29:22.062Z
CVE-2023-45703 HCL Launch is susceptible to a Denial of Service vulnerability
HCL Launch may mishandle input validation of an uploaded archive file leading to a denial of service due to resource exhaustion.

Affected products: vendor: HCL Software
product: HCL Launch
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-12-20T23:33:08.651Z
CVE-2023-45705 HCL BigFix Platform is susceptible to Server Side Request Forgery (SSRF)
An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options.

Affected products: vendor: HCL Software
product: BigFix Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2024-03-28T14:11:57.835Z
CVE-2023-45706 HCL BigFix Platform is susceptible to Cross Site Scripting (XSS) and/or Man in the Middle (MITM) attack
An administrative user of WebReports may perform a Cross Site Scripting (XSS) and/or Man in the Middle (MITM) exploit through SAML configuration.

Affected products: vendor: HCL Software
product: BigFix Platform
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2024-03-28T14:19:40.914Z
CVE-2023-45707 HCL Connections Docs is vulnerable to Cross-Site Scripting (XSS)
HCL Connections Docs is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary code. This may lead to credentials disclosure and possibly launch additional attacks.
Affected products: vendor: HCL Software
product: Connections Docs
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2024-06-08T15:10:32.739Z
CVE-2023-45715 HCL BigFix Platform is susceptible to a Denial of Service attack
The console may experience a service interruption when processing file names with invalid characters.

Affected products: vendor: HCL Software
product: BigFix Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Published: 2024-03-28T14:26:32.839Z
CVE-2023-45716 HCL Sametime is impacted by a sensitive information disclosure
Sametime is impacted by sensitive information passed in URL. 

Affected products: vendor: HCL Software
product: HCL Sametime
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 1.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2024-02-09T21:17:50.900Z
CVE-2023-45718 HCL Sametime is impacted by a failure to invalidate sessions
Sametime is impacted by a failure to invalidate sessions.  The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session.  

Affected products: vendor: HCL Software
product: HCL Sametime
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 3.9
baseSeverity: LOW
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-02-09T21:22:09.163Z
CVE-2023-45720 HCL Leap is affected by a disclosure of private personal information vulnerability
Insufficient default configuration in HCL Leap
allows anonymous access to directory information.
Problem types: cwe_id: CWE-359
description: CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
Affected products: vendor: HCL Software
product: HCL Leap
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-04-24T16:25:16.979Z
CVE-2023-45721 HCL Domino Volt and Domino Leap are affected by a disclosure of private personal information vulnerability
Insufficient default configuration in HCL Leap
allows anonymous access to directory information.
Problem types: cwe_id: CWE-359
description: CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
Affected products: vendor: HCL Software
product: HCL Domino Leap
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-04-30T21:13:30.911Z
CVE-2023-45722 Path Traversal Arbitrary File Read affects DRYiCE MyXalytics
HCL DRYiCE MyXalytics is impacted by path traversal arbitrary file read vulnerability because it uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory.  The product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Potential exploits can completely disrupt or take over the application.

Affected products: vendor: HCL Software
product: DRYiCE MyXalytics
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-01-03T02:59:05.745Z
CVE-2023-45723 Path Traversal which allows file upload capability affects DRYiCE MyXalytics
HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability.  Certain endpoints permit users to manipulate the path (including the file name) where these files are stored on the server.

Affected products: vendor: HCL Software
product: DRYiCE MyXalytics
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
version: 3.1
Published: 2024-01-03T02:50:02.258Z
CVE-2023-45724 Unauthenticated File Upload affects DRYiCE MyXalytics
HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability. The web application permits the upload of a certain file without requiring user authentication.

Affected products: vendor: HCL Software
product: DRYiCE MyXalytics
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2024-01-03T02:53:23.847Z
CVE-2023-45725 Apache CouchDB, IBM Cloudant: Privilege Escalation Using _design Documents
Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document.

These design document functions are:
  *    list
  *    show
  *    rewrite
  *    update

An attacker can leak the session component using an HTML-like output, insert the session as an external resource (such as an image), or store the credential in a _local document with an "update" function.

For the attack to succeed the attacker has to be able to insert the design documents into the database, then manipulate a user to access a function from that design document.

Workaround: Avoid using design documents from untrusted sources which may attempt to access or manipulate request object's headers

Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Apache Software Foundation
product: Apache CouchDB
default_status: affected
vendor: Apache Software Foundation
product: IBM Cloudant
default_status: unaffected
Credits: lang: en
value: Natan Nehorai from the JFrog Vulnerability Research Team
lang: en
value: Or Peles from the JFrog Vulnerability Research Team
lang: en
value: Richard Ellis from IBM/Cloudant Team
lang: en
value: Mike Rhodes from IBM/Cloudant Team
Published: 2023-12-13T08:02:17.326Z
CVE-2023-45727 
Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.
Problem types: description: XML external entities (XXE)
Affected products: vendor: North Grid Corporation
product: Proself Enterprise/Standard Edition
vendor: North Grid Corporation
product: Proself Gateway Edition
vendor: North Grid Corporation
product: Proself Mail Sanitize Edition
Published: 2023-10-18T09:01:12.285Z
CVE-2023-45733 
Hardware logic contains race conditions in some Intel(R) Processors may allow an authenticated user to potentially enable partial information disclosure via local access.
Problem types: description: information disclosure
cwe_id: CWE-1298
description: Hardware logic contains race conditions
Affected products: vendor: n/a
product: Intel(R) Processors
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 2.8
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
Published: 2024-05-16T20:47:09.057Z
CVE-2023-45734 Dsoftbus has an out-of-bounds write vulnerability

in OpenHarmony v3.2.4 and prior versions allow an adjacent attacker arbitrary code execution through out-of-bounds write.


Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: OpenHarmony
product: OpenHarmony
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
version: 3.1
Published: 2024-02-02T06:19:00.202Z
CVE-2023-45735 Westermo Lynx Code Injection





A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning of the device.






Problem types: cwe_id: CWE-94
description: CWE-94 Code Injection
Affected products: vendor: Westermo
product: Lynx
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Aarón Flecha Menéndez, Iván Alonso Álvarez and Víctor Bello Cuevas reported these vulnerabilities to CISA.
Published: 2024-02-06T21:48:14.731Z
CVE-2023-45736 
Insecure inherited permissions in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-277
description: Insecure inherited permissions
Affected products: vendor: n/a
product: Intel(R) Power Gadget software for Windows
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2024-05-16T20:47:21.713Z
CVE-2023-45737 
Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of GROWI versions prior to v3.5.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
Problem types: description: Cross-site scripting (XSS)
Affected products: vendor: WESEEK, Inc.
product: GROWI
Published: 2023-12-26T07:20:36.390Z
CVE-2023-45740 
Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
Problem types: description: Cross-site scripting (XSS)
Affected products: vendor: WESEEK, Inc.
product: GROWI
Published: 2023-12-26T07:20:42.853Z
CVE-2023-45741 
VR-S1000 firmware Ver. 2.37 and earlier allows an attacker with access to the product's web management page to execute arbitrary OS commands.
Problem types: description: OS command injection
Affected products: vendor: BUFFALO INC.
product: VR-S1000
Published: 2023-12-26T07:28:42.765Z
CVE-2023-45742 
An integer overflow vulnerability exists in the boa updateConfigIntoFlash functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary code execution. An attacker can send a sequence of requests to trigger this vulnerability.
Problem types: cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
Affected products: vendor: LevelOne
product: WBR-6013
vendor: Realtek
product: rtl819x Jungle SDK
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Francesco Benvenuto of Cisco Talos.
Published: 2024-07-08T15:22:27.586Z
CVE-2023-45743 
Uncontrolled search path in some Intel(R) DSA software uninstallers before version 23.4.39.10 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-427
description: Uncontrolled search path element
Affected products: vendor: n/a
product: Intel(R) DSA software uninstallers
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2024-05-16T20:47:28.695Z
CVE-2023-45744 
A data integrity vulnerability exists in the web interface /cgi-bin/upload_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP request can lead to configuration modification. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Peplink
product: Smart Reader
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Matt Wiseman of Cisco Talos.
Published: 2024-04-17T12:55:48.462Z
CVE-2023-45745 
Improper input validation in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-20
description: Improper input validation
Affected products: vendor: n/a
product: Intel(R) TDX module software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.9
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
Published: 2024-05-16T20:47:24.558Z
CVE-2023-45746 
Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script. Affected products/versions are as follows: Movable Type 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Premium 1.58 and earlier, Movable Type Premium Advanced 1.58 and earlier, Movable Type Cloud Edition (Version 7) r.5405 and earlier, and Movable Type Premium Cloud Edition 1.58 and earlier.
Problem types: description: Cross-site scripting (XSS)
Affected products: vendor: Six Apart Ltd.
product: Movable Type 7 (Movable Type 7 Series)
vendor: Six Apart Ltd.
product: Movable Type Advanced 7 (Movable Type 7 Series)
vendor: Six Apart Ltd.
product: Movable Type Premium
vendor: Six Apart Ltd.
product: Movable Type Premium Advanced
vendor: Six Apart Ltd.
product: Movable Type Cloud Edition (Version 7)
vendor: Six Apart Ltd.
product: Movable Type Premium Cloud Edition
Published: 2023-10-30T04:57:43.561Z
CVE-2023-45747 WordPress WP Lightbox 2 Plugin <= 3.0.6.5 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Syed Balkhi WP Lightbox 2 plugin <= 3.0.6.5 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Syed Balkhi
product: WP Lightbox 2
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Rio Darmawan (Patchstack Alliance)
Published: 2023-10-24T11:24:56.788Z